Privacy Policy

Account Information. When you create an account we collect your name, email address, and authentication credentials. If you sign in via Google or GitHub, we receive your profile name and email from the identity provider — we do not receive or store your social account passwords.

Usage Data. We automatically collect information about how you interact with the service, including: files uploaded (metadata only — file type, size, timestamp, IPFS CID), storage usage, API key usage, and access timestamps.

Payment Information. If you subscribe to a paid plan, payment processing is handled entirely by Stripe. We receive your subscription status and plan type but do not store credit card numbers or banking details.

Technical Data. We collect standard web server logs including IP addresses, browser type, and referring pages. AWS CloudFront and API Gateway generate these logs for operational purposes.

We use your information to:

• Provide, maintain, and improve the IPFS Ninja service
• Authenticate your identity and manage your account
• Process subscriptions and billing via Stripe
• Track storage usage and enforce plan limits
• Send transactional emails (verification codes, password resets)
• Monitor service health and prevent abuse
• Comply with legal obligations

We do not sell, rent, or share your personal information with third parties for marketing purposes.

Content you upload. Files you upload are pinned to the IPFS network and become accessible via their content identifier (CID). Once pinned, content is distributed across the IPFS peer-to-peer network and may be cached or replicated by third-party IPFS nodes beyond our control.

Permanence. Due to the nature of IPFS, content identified by a CID may remain accessible on the network even after you delete it from your IPFS Ninja account. We cannot guarantee the removal of content from all IPFS nodes.

No inspection. We do not inspect, monitor, or analyze the content of files you upload, except as required to determine file type for processing purposes.

Your account data and file metadata are stored in AWS DynamoDB in the US East (N. Virginia) region. File content is stored on IPFS nodes operated by BWS and distributed across the IPFS network.

We implement industry-standard security measures including:

• Encryption in transit (TLS/HTTPS for all connections)
• Authentication via AWS Cognito with JWT tokens
• API key authentication with hashed storage
• AWS IAM role-based access controls
• Secrets Manager for credential storage

We use the following third-party services that may process your data:

• Amazon Web Services (AWS) — infrastructure hosting, authentication (Cognito), data storage (DynamoDB), content delivery (CloudFront)
• Stripe — payment processing for paid subscriptions
• Google — OAuth authentication (if you choose to sign in with Google)
• GitHub — OAuth authentication (if you choose to sign in with GitHub)
• IPFS Network — decentralized file storage and distribution

Each third-party service is governed by its own privacy policy.

We use essential cookies and browser local storage for:

• Authentication session tokens (AWS Cognito)
• CSRF protection during OAuth flows

We do not use advertising or tracking cookies. We do not use any third-party analytics services.

You have the right to:

• Access your personal data stored in your account
• Correct inaccurate information via your profile settings
• Delete your account and associated data by contacting us
• Export your file metadata via the API
• Withdraw consent for optional data processing at any time

Note that deleting your account removes your data from our systems but cannot remove content already distributed on the IPFS network.

We retain your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law. File metadata (CIDs, timestamps) may be retained for operational records. IPFS-pinned content is unpinned from our nodes upon account deletion but may persist on other IPFS nodes.

IPFS Ninja is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.

For questions about this Privacy Policy or to exercise your rights, contact us at:

BWS
Email: info@bws.ninja
Website: www.bws.ninja