Privacy policy

Updated as of July 27, 2016

First published: November 12, 2015

Our privacy principles

If you read nothing else, please read this:

  • The most fundamental privacy principle we follow is that, by default, anything you entrust with Upthere is private.
  • We are the custodian of your content on your behalf. Upthere doesn’t own your content. You own your content.
  • We think that your content should be easily accessible wherever you go, on whatever device you have.
  • Privacy goes hand in hand with security. Each is as important as the other and we take them both very seriously.
  • We believe that more transparency is better than less. We try to make our products easy to use, with settings and options that are easy to find and understand. To foster greater transparency, we have published a TRANSPARENCY REPORT, which is our summary of government and law enforcement requests for user data and content removal from Upthere. We are also committed to providing you with advance notice, whenever possible, if we receive a governmental or law enforcement request for your content.

Our privacy policy

This privacy policy is here to help you understand what information we collect at Upthere, how we use it, and what choices you have. Upthere is available for use via a web browser or applications specific to your desktop or mobile device. When we talk about Upthere in this policy, we are talking about Upthere, Inc., the company, our various downloadable applications, our web app at APP.UPTHERE.COM, the Upthere cloud storage system and the Upthere website at WWW.UPTHERE.COM.

This policy describes how Upthere treats your information, not how other organizations treat your information. If you are using Upthere in a workplace or on a device or account issued to you by your employer or another organization, that company or organization likely has its own policies regarding storage, access, modification, deletion, and retention of communications and content which may apply to your use of Upthere.

Information we collect and receive

We collect different kinds of information. Some of it is personally identifiable and some is non-identifying or aggregated. Here are the types of information we collect or receive:

  • Account information. When you create an account on Upthere, we collect your email address, your name, your country, and your password. We use either your email address or mobile phone number as your account name.  If you sign up for two-factor authentication over SMS, we also collect your mobile phone number.
  • Log data. When you use Upthere, our servers automatically record information, including information that your browser sends whenever you visit a website or information your mobile app sends when you’re using it. This log data may include your Internet Protocol address, the address of the web page you visited before coming to Upthere, your browser type and settings, the date and time of your request, information about your browser configuration and plug-ins, language preferences, and cookie data. Log data does not contain your content and is not routinely deleted.
  • Device information. In addition to log data, we may also collect information about the device you’re using Upthere on, including what type of device it is, what operating system you’re using, device settings, unique device identifiers, and crash data. Whether we collect some or all of this information often depends on what type of device you’re using and its settings.
  • Your contacts.  With your express permission, we may access the contacts on your phone or computer in order to, among other things, facilitate sharing by providing a more fully featured auto-complete.
  • Geo-location information. Precise GPS from mobile devices is collected only with your permission. WiFi and IP addresses received from your browser or device may be used to determine approximate location.  We also derive location information from the photos and videos that you take or upload through one of our services.
  • Upthere usage information. This is information about which features, content, services, and links you interact with within Upthere.
  • Content that you send and receive within Upthere. This includes:
    • The content itself. This content can include photographs, videos, music, documents, messages, comments, and various other types of files.
    • Metadata related to the content itself.  Some of this metadata is included with the content itself and some we extract and derive from the content to help you find and enjoy your content.
    • When content is sent or shared and by whom, when or if they were seen by you, where you received them, when you or others comment on your content.
  • Information from partners or other 3rd parties. Upthere uses Stripe to handle its payment processing and, when you give your payment information to Stripe, Stripe will generate and give you a token that you will send to us when you set up your payment plan. Through Stripe, we have access to certain information about your payment source. This includes the name, type, expiration date, and last four digits of the credit card you use to subscribe to Upthere through Stripe, as well as a history of all charges Stripe makes on our behalf. We never have access to your full credit card number.  We also use third party service providers such as Crashlytics and HockeyApp for crash log analytics. Upthere may receive information from partners or others that we could use to make our own information better or more useful. This might be aggregate-level information about which IP addresses go with which zip codes or it might be more specific information about how well an online marketing or email campaign performed.
  • Surveys and other research requests.  From time to time, Upthere may directly (or through a 3rd party) reach out to you with a survey or other customer research requests.  Any data you voluntarily provide to us through these channels will be used by us to improve our services among other things.  Any data you voluntarily provide to us through these channels will not be directly linked to your user account or user data.  It may be correlated to your account e.  usage data on an anonymous basis.
  • Support information.  Support issues are accessible by any Upthere employee. We may use a 3rd party to handle support tickets in the future. We won't access a user's data without their explicit permission.
  • During troubleshooting.  We may need to troubleshoot system issues where employees may be exposed to data stored. Access to this data is restricted and logged.

Our cookie policy

Upthere uses cookies, or similar technologies like single-pixel gifs and web beacons, to record log data. We use both session-based and persistent cookies.

Cookies are small text files sent by us to your computer and from your computer to us, each time you visit our website. They are unique to your Upthere account or your browser. Session-based cookies last only while your browser is open and are automatically deleted when you close your browser. Persistent cookies last until you or your browser deletes them or until they expire.

Some cookies are associated with your Upthere account and personal information in order to remember that you are logged in. Other cookies are not tied to your Upthere account but are unique and allow us to do site analytics and customization, among other things. Upthere may also use cookies, single-pixel gifs or beacons to communicate with you via tailored advertisements. These advertisements may employ Facebook Custom Audience targeting or similar technologies.

If you access Upthere through your browser, you can manage your cookie settings there but if you disable all cookies you may not be able to use Upthere.

Use of 3rd party analytics services

In addition to our own services, we use 3rd party services like Google Analytics and Mixpanel who provide website analytics cookies to help us improve the experience we offer you. This may involve transmitting your device id, anonymized analytics identifiers and anonymized event data to these 3rd parties for analysis so that we can better understand your experience with our service.  You may opt-out of third party cookies from Google Analytics and Mixpanel on their respective websites. We do not currently recognize or respond to browser-initiated Do Not Track signals as there is no consistent industry standard for compliance.

How we use your information

We use your information for the following:

  • Providing the Upthere service. We use information you provide to authenticate you and deliver and share content to you and from you. Our servers create previews of your content which are versions of your content at potentially different resolutions, file sizes, or formats.  We use these previews to deliver your content in a format that is optimized for your current device.
  • Grouping your content.  We use the location information we derive from your photos and videos to group your content and to enable you to find it more easily.  Our servers also extract and derive metadata from your content. This may include, among other things, file name, type, size, creation and modified date, resolution, bitrate, and length.  We use this metadata to group your content and to enable you to find it more easily.
  • Understanding and improving our products. To make the product better we have to understand how users are using it. We will freely review aggregated and anonymized usage data to learn from our users and improve the product.
  • Investigating and preventing bad stuff from happening. We work hard to keep Upthere secure and to prevent abuse and fraud.
  • Communicating with you
    • Solving your problems and responding to your requests. If you contact us with a problem or question, we will use your information to respond to that request and address your problems or concerns. We will only access your content or user data with your explicit permission.
    • Email messages. We may send you service and administrative emails. We may also contact you to inform you about changes in our services, or our service offerings, or new product features. These messages are considered part of the service and we may not allow you to opt out of them. In addition, we sometimes send emails to Upthere users about other news about Upthere. You can opt out of these at any time by unsubscribing from within one of these emails.  We may use a third party service provider, such as Sendgrid, to help us with some or all of the above emails.
    • Apple Push Notifications and Firebase Cloud Messaging. If you install our apps, we may send you notifications when content is shared with you.
    • Short Message Service (SMS). If you enable two-factor authentication over SMS, we will send you SMS messages with two-factor codes.  We may use a third party service provider, such as Twilio, to help us with SMS messages.

Export options

Upthere does not currently offer options for content export other than by manually downloading the content through the Upthere service. Please see our support page for more specific information about what options exist for exporting your content.

Choices for users

When you use Upthere, you have control over a number of things with respect to your own privacy and choices about how your content is visible to others or not.

  • You may always deactivate your account through an email to goodbye@upthere.com. Deactivation of an account disables your access to the content associated with that account but does not delete your profile or content.  Content that you have shared with others will still be accessible by the people with which you have shared it. Please see our FAQ for more detail.
  • You are always able to delete any content you have uploaded to your account. When you do so, you will no longer be able to access the content. Other users with whom you have shared the content will also no longer be able to access it. Please note, however, that if someone you share some content with copies that content into their own account, if you later delete that content, such content will still be available to the user that made the copy. Also, please note that, when you delete content, we do not immediately overwrite this deleted data on our servers.  Consequently, the data may still be on our servers and technically accessible for a limited time. Please see our policies on Sharing and Disclosure below.
  • You cannot currently update your profile information or modify your email or phone number.  We are working hard to implement these features.
  • When you upload content on Upthere, you can decide where to share it and with whom.
  • One way you can share content on Upthere is by the creation of a private group, which we call a Loop. Any member of a Loop can add content to that Loop. When you add content to a Loop, all members of the Loop can access it. You own the content and can remove it from the Loop at anytime; however, this does not stop someone from making a copy of it while they have access to it. Any member of a Loop can remove him or herself from that Loop and, if he or she does so, his or her content will also be removed from the Loop. Any member of a Loop can remove any other member from the Loop, if you are removed from a Loop your content will also be removed. Any member of a Loop can make that Loop public at any time by creating a public link to the Loop and sharing the public link externally.
  • When you comment on your content or on content shared with you, that comment is visible to anyone in the Loop where the content is placed.  You can always delete your comments.  If you later leave the Loop, your comments on content shared with you will remain. The content you placed in the Loop, and all its associated comments, will be removed when you leave a Loop. If your content or content shared with you is placed in more than one Loop, your comments will only be visible in the Loop in which they were made.
  • You can also share content using email, text, AirDrop, and many other sharing mechanism present on your device.
  • Another way we may allow you to share content using Upthere is by creating a public link to the content and then sharing the public link externally.

Other choices

  • The browser you use may provide you with the ability to control cookies or other types of local data storage.
  • Your mobile device may provide you with choices around how and whether location or other data is shared with us.

Sharing and disclosure

There are times when communications and related content and other user information may be shared by Upthere. This section discusses only how Upthere may share user information. Upthere may share information:

  • To comply with legal process, or to protect Upthere and our users. We may disclose – or preserve for future disclosure – your information, if we believe, after due consideration, that doing so is required to comply with a law, regulation, or valid legal process. If we are going to release your information pursuant to the foregoing, we will do our best to provide you with notice in advance, unless we are prohibited by court order from doing so. We reserve the right to delay notice in cases involving the exploitation of minors and when we believe a delay is necessary to prevent imminent and serious bodily harm to a person.  We may disclose your information in certain emergency circumstances; we may also disclose your information when we believe it's necessary to prevent imminent and serious bodily harm to a person; to address fraud, security, or spam; or to protect our rights or property. To foster greater transparency, we have published a Transparency Report, which is our summary of government and law enforcement requests for user data and content removal from Upthere.
  • With third parties and agents. We may employ third party companies or individuals to process personal information on our behalf based on our instructions, under contractual promises of confidentiality and in compliance with this Privacy Policy. For example, we may share data with a security consultant to help us get better at preventing unauthorized access, with an email vendor to send messages on our behalf, and/or with hosting providers, payment processors, marketing vendors, and other consultants who work on our behalf.
  • In the event of a merger or sale. If we engage in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction or proceeding that involves the transfer of the information described in this Privacy Policy.
  • That is aggregated and non-identifiable. We may also share aggregated or non-personally identifiable information with our partners or others for business or research purposes.

Where information is processed

Upthere is based in the United States. Although we welcome users from many places all over the world, keep in mind that no matter where you live or where you happen to use our services, you consent to the processing and transfer of information in and to the U.S.  We may also transfer your information to other countries, either at your direction, or for processing purposes. We want you to know this because the laws of the United States and those of other countries where your information is transferred and/or processed might not be as comprehensive or protective as the laws in the country where you live.

While in transit or while stored in our datacenter, it is possible your data will be subject to surveillance, without our cooperation, by the government of the United States or other countries. We will resist surveillance to the maximum extent permitted by law and in accordance with the terms of this privacy policy.

Security

Upthere takes reasonable steps to protect information you provide to us as part of your use of the Upthere service from loss, misuse, and unauthorized access or disclosure. We follow generally accepted standards to protect the personal data submitted to us, both during transmission and once we receive it. All traffic to our website and all communication between our apps and our servers is encrypted using secure socket layer technology (SSL). Emails, SMS, and notifications we send are not encrypted. However, no electronic or email transmission or digital storage mechanism is ever fully secure or error free.

Children's information

Upthere is not directed to children under 13. If you learn that a minor child has provided us with personal information without your consent, please contact us at legal@upthere.com.

Changes to this privacy policy

We may change this policy from time to time, and if we do we’ll post any changes on this page. If you continue to use Upthere after those changes are in effect, you agree to the revised policy. If the changes are material, we may provide more prominent notice or seek your consent to the new policy.

Contacting Upthere

Please also feel free to contact us if you have any questions about Upthere’s Privacy Policy or practices. You may contact us at PRIVACY@UPTHERE.COM or at our mailing address below:

Upthere, Inc.
2221 Broadway Street
Redwood City, CA  
94063