Privacy Policy

Overview

Ceribell is a self-hosted file sharing application. This privacy policy describes how your data is handled by this specific deployment.

Data We Collect

• Account information — email address, display name, and authentication credentials if you register an account.
• Uploaded files — files you upload and associated metadata (file names, sizes, timestamps).
• Session data — an encrypted session cookie is set to maintain your login state.
• Audit logs — security-relevant actions are logged with hashed IP addresses for abuse prevention.

How Data Is Protected

• All files are encrypted at rest using XChaCha20-Poly1305 with keys sealed by a hybrid ML-KEM-1024 + P-384 vault.
• All database fields are encrypted or hashed before storage.
• IP addresses are one-way hashed — the original IP is never stored.
• Session cookies are encrypted with post-quantum cryptography.

Data Retention

• Uploaded files are retained until they expire or are manually deleted.
• Audit logs are retained according to the configured retention period.
• You may delete your account and all associated data from the Profile page.

Third Parties

This is a self-hosted application. Your data remains on this server unless the administrator has configured external services (S3 storage, SMTP email, Google OAuth). No data is sold or shared with advertisers.

Contact

For privacy inquiries, contact the administrator of this Ceribell deployment.