Privacy & transfer details
Endez lets you upload up to 10 files totaling 10 GB and share one download link. Send folders as ZIP files. The Share text tool saves typed or pasted text as a UTF-8 .txt file, up to 1 GB, and provides a short download link. You can also select a .txt file, which is uploaded without changing its bytes. Text shares use the same private storage, optional passwords, and access controls. They keep a seven-day expiry and a separate daily allowance. You must verify your email before uploading or creating short links. You can also shorten a public website URL and share the resulting Endez link.
What we store
We store your files, their names and sizes, and the timestamps needed to operate your transfer. Your email is used to send verification codes through Mailgun and establish a verified session. Before starting a new upload or creating a short link, Cloudflare Turnstile checks for automated abuse. Cloudflare processes browser and device signals, network information including your IP address, and a short-lived verification token. The server validates the token before allowing creation. Mailgun processes the recipient address, verification email content, and delivery events. Transfers and short links are associated with a hashed email identifier. For website short links we store the destination URL, a random or custom link code, and the creation time. Optional short file links use a separate code mapped to the transfer ID and creation time. This mapping contains no filenames or password and remains reserved after cancellation or expiry so the code cannot be reused for another transfer. If you set an optional password, we store a salted password hash rather than the password itself. A recipient submits the password securely to unlock the link. Password-protected short links reveal their destination only after a correct password; Endez does not fetch or check the destination. Protected file transfers use a temporary access token kept in browser memory; only a hash of that token is stored with its transfer and access revision, and access expires after 30 minutes or when the transfer expires, whichever comes first. An administrator password or status change invalidates existing unlock tokens. Hashed network identifiers are used for rate limits. Endez uses one essential, secure session cookie, which expires after 24 hours. We do not use advertising cookies.
Who can download
Anyone with the complete share link can download your files unless you set a password. For password-protected transfers, recipients must also enter the password before seeing filenames or requesting a download. Share the password separately from the link. Treat both as private, and share them only with your intended recipients. Files are stored in private Amazon S3 storage in the United States and encrypted in transit and at rest. This is not end-to-end encryption.
Short links
Short website links under /s/ do not expire automatically. Short file links under /f/ follow their transfer’s link expiry and keep any password protection set by the sender. Anyone with a short link can visit its destination unless you set a password. Protected links ask for that password first. Once a recipient opens the destination, they can share its original URL. Do not shorten URLs containing information you do not intend to share. Shortening a URL does not change access permissions at the destination. We do not provide click analytics.
QR codes
The standalone QR tool requires email verification and a Cloudflare Turnstile check. Endez stores your target URL, a generated short code, its creation time, and a hashed email identifier to create a /q/ short link. The PNG and SVG images encode that short link and are rendered in your browser without a third-party QR service. QR links have no automatic expiry. The authorized administrator can add or change a password or deactivate a QR link. Anyone with an active link or QR image can visit its destination unless it is password protected; the destination can also have its own access rules. Website and QR short links share the daily short-link allowance. After creating a file transfer, text share, or website short link, you can also download a QR code for that existing link. This creates no additional link or stored mapping and keeps the original password protection and expiry.
Link administration
The authorized Endez administrator can view website and QR destinations and completed transfer metadata, replace or remove link passwords, and deactivate or reactivate links. Existing passwords cannot be viewed or recovered. Deactivation blocks new visits and download requests through Endez and does not delete stored files or release reserved IDs. An already issued download URL may remain usable for up to five minutes, and a download already in progress may continue. Reactivation does not extend file expiry. Endez cannot revoke access to an external destination or a file a recipient has already downloaded.
File expiration
New Send files links expire three days after upload finalization begins. Files are automatically scheduled for deletion by an Amazon S3 lifecycle rule after four days, measured from S3 object creation (multipart upload initiation). S3 rounds the deletion eligibility time to the next midnight UTC and processes deletion asynchronously, so physical deletion can occur later. Older transfers that used the original seven-day policy and Share text links keep their seven-day expiry. New download requests are refused at expiration. An already issued download URL remains valid for at most five minutes and never beyond the link’s expiry, although a download already in progress can continue. Share text files and older transfers are scheduled for S3 deletion after seven days; physical deletion is asynchronous. New Send files objects have a retention tag that selects the four-day S3 lifecycle rule. There is no periodic application cleanup job. The seven-day lifecycle rule remains a fallback. Incomplete uploads are scheduled for cleanup after one day. Verification codes expire after ten minutes, and expiring transfer metadata is automatically cleaned up after expiration. File-link code reservations remain as described above.
Operational logs are retained for 14 days. Metadata backups may persist for up to 35 days. Logs are configured not to record verification codes, link passwords, access tokens, session cookies, file contents, or share links.
Service limits
To limit abuse, regular verified senders may start up to three Send files transfers and ten Share text transfers per UTC day. The verified administrator has no daily file or text creation limit. Each Send files transfer may contain up to ten files totaling 10 GB. These limits reset at midnight UTC. If a limit is reached, the error shows when to try again. A transfer supports up to 100 download requests per UTC day, shared across all files in the transfer. Verified users may create up to 20 short links per UTC day. Email requests, verification attempts, and password-unlock attempts are also limited. Passwords cannot be recovered; ask the sender for the password or a new link. Downloads are not screened for malware; open files only from senders you trust.
Emailing a link
You can email a link you created to up to 10 recipients per request, with up to 10 requests per day. Each recipient receives a separate email that includes your verified email address and the generated link. Recipient addresses and the link are processed by Mailgun to deliver the email. Endez stores a fingerprint and delivery counts for up to seven days to prevent duplicate sending; recipient addresses are not saved in that record. Only send links to people who expect them. Link passwords are not included, and link access rules and expiry stay the same.
Your responsibilities
Only upload files you have the right to share. Do not use Endez to distribute unlawful, harmful, or abusive content. Keep your own copy of important files; Endez is temporary transfer storage, not a backup service.