Privacy Policy

This privacy policy describes the processing of personal data by the web application dropship (hereinafter “the application"). The application is a lightweight, login-free wrapper around the static hosting service here.now and publishes exclusively static files (HTML, CSS, JS, images, fonts, PDFs, video, etc.) under a public URL.

Responsible within the meaning of Art. 4 (7) GDPR is:

Please replace every placeholder in square brackets before going live.

The application uses no tracking cookies and no consent banner. There is no web analytics, no fingerprinting, and no audience measurement — neither self-hosted nor through third parties. During normal use, no cookies are set in your browser.

Fonts are fully self-hosted. The application uses Next.js Font Optimization (next/font), so font files are downloaded at build time and served from the same origin. No requests to Google's CDN or any other font provider occur at runtime.

The application stores your deployment history only locally in your browser's localStorage. This data never leaves your browser through the application itself and is not transmitted to any operator server. Each stored deployment record contains the following fields:

• slug — short identifier of the published site
• siteUrl — public live URL of the site
• claimUrl — one-time claim link used to manage anonymous sites later
• claimToken — associated claim token
• expiresAt — expiry timestamp (if any)
• retentionType — retention type (e.g. anonymous 24h, permanent, custom TTL)
• deploymentMode — “anonymous” or “apikey”
• fileCount — number of files
• totalSize — total file size in bytes
• timestamp — deployment timestamp (ISO 8601)

The API key is never stored inside a deployment record. Deployment records contain only public metadata and the claim link. The deployments page offers a “Delete record” and a “Clear all records” action that remove the corresponding records from localStorage immediately.

The application is anonymous by default; a here.now API key is optional. When such a key is entered, it remains only in the working memory of the browser session as long as the “Remember on this device” option is not enabled.

Only when the user explicitly enables the “Remember on this device” option is the key stored in the browser's localStorage. A dedicated “Remove stored key” button removes any stored key immediately. On browser close (without the remember option enabled), a key held only in memory is lost.

So that files can reach here.now even from browser environments with CORS restrictions, the application provides two transparent proxy routes:

• /api/herenow/[...path] — forwards API calls to here.now (manifest, finalize, claim, delete).
• /api/upload — SSRF-guarded fallback for uploads to presigned URLs.

Both proxies only forward bytes. They neither log file contents, deployment metadata, claim tokens, or API keys, nor do they persistently store any transmitted data. A host lock ensures that the /api/herenow proxy forwards requests only to here.now.

Uploaded files and any API key provided are therefore transmitted solely for the purpose of publishing to here.now — either directly from the browser to presigned URLs or through the proxies mentioned above.

The actual publishing, storage, and delivery of the static files is performed by the third party here.now. here.now may rely wholly or partly on infrastructure operated by Cloudflare, Inc. when processing data. Detailed information about the processing carried out there can be found in here.now's privacy policy and in Cloudflare's notices.

This may involve a transfer of personal data to a third country outside the European Union, engaging the rules of Art. 44 et seq. GDPR. To the extent that here.now or Cloudflare participate in the EU–US Data Privacy Framework, the transfer is covered by the European Commission's adequacy decision (Art. 45 GDPR). Otherwise, the transfer is based on appropriate safeguards (e.g. Standard Contractual Clauses under Art. 46 GDPR) or on your explicit consent (Art. 49 GDPR).

The application processes personal data on the following legal bases:

• Art. 6 Abs. 1 lit. b DSGVO — processing necessary for the performance of a contract or pre-contractual steps. The application lets you publish static files on here.now; the processing (transmitting file and manifest data to here.now) is necessary to provide that service.
• Art. 6 Abs. 1 lit. f DSGVO — legitimate interests pursued by the controller. The legitimate interest lies in the secure, auditable, and transparent operation of the application — in particular the local storage of deployment history, the temporary storage of an API key in memory, and the use of the proxy routes. This processing serves the user's direct interest and is not overridden by any conflicting interests.

Content published on here.now

Pages published anonymously via here.now normally expire automatically after 24 hours and are then deleted by here.now. Deployments carried out with an optional API key may be retained for longer or indefinitely, depending on the here.now account plan, API configuration, or the here.now rules in force at the time of publication. The decisive factor here is exclusively the storage duration at here.now; the application itself does not store any uploaded files.

Data stored locally in the browser

The deployment history stored in your browser (see “Data stored in your browser”) remains until you delete the records individually or in bulk, clear localStorage, or otherwise wipe browser storage (e.g. “clear data on close”). There is no server-side backup of this data.

API key

An API key held only in memory is discarded when the browser session closes. A stored key (when the remember option is enabled) remains in localStorage until removed via the “Remove stored key” button or until localStorage is cleared.

Under the GDPR you have the following rights, which you may exercise against the controller at any time:

• Access (Art. 15 DSGVO)
• Rectification (Art. 16 DSGVO)
• Erasure (Art. 17 DSGVO)
• Restriction of processing (Art. 18 DSGVO)
• Data portability (Art. 20 DSGVO)
• Objection to processing (Art. 21 DSGVO)
• Complaint to a supervisory authority (Art. 77 DSGVO)

The competent supervisory authority is normally the one at your place of residence or at the place of the suspected infringement. To answer access requests related to deployment data stored here, it is usually sufficient to look in your own browser — you can view and delete the data yourself.

The application does not perform any automated decision-making within the meaning of Art. 22 GDPR and creates no profiles. In particular, there is no scoring of behaviour, interests, or personality traits.

The application is not directed at persons under 16 years of age and does not collect any data suggesting that minors use the application. If you are under 16, please do not use the application without the consent of your legal guardians.

We reserve the right to adapt this privacy policy so that it always reflects current legal requirements or changes to the application's functionality. The “Last updated” date above indicates when this version was last revised. We do not keep an archive of previous versions.

This privacy policy applies exclusively to the dropship application. For processing carried out by here.now and possibly Cloudflare, the respective providers' privacy policies apply.