Privacy Policy

Template, not legal advice. This page is a starting point for the person who runs this service. A qualified lawyer must review and adapt it before the service is opened to the public. Remove this notice only after that review.

This policy explains what personal information Altron collects, why, where it is kept, who else handles it, and what choices you have. DJ SHOLAY ("we", "us") decides how it is used and is the "controller" under data protection law.

1. Who we are

Operator: DJ SHOLAY
Address: Fairfax, VA USA
Privacy contact: deejaysholay@gmail.com

2. What we collect

Account details. Your username, which is permanent, and a one-way hash of your password, so we cannot read your password. We do not ask for your real name, email address or phone number, and we do not collect your date of birth: you only confirm that you are at least 18 years old.
Sign-in security data. The secret used by your authenticator app, stored encrypted, and your recovery codes, stored only as one-way hashes.
Sessions. When you sign in we create a session. We store only a hash of its random token, with the times needed to expire it. Sessions end when you sign out, when they expire, or when an administrator changes your access.
Account status. Whether your account is waiting, active or disabled, which music tools you may use, whether you have file server access, when you last signed in, and any request you made for file server access.
Files and folders. The names, sizes and folder placement of your files and folders, who may see which folder, and who uploaded what and when. The contents of your files are stored encrypted, as described in section 5.
Music tool data. The files you give to the music tools and what the tools make from them. These are kept in a workspace on our server that only your account can reach.
Network address. The IP address your connection comes from, as passed on to our software by our web server. We use it to slow down repeated sign-in attempts. The activity and audit records keep only a shortened form of it (an IPv4 address keeps its first three numbers, an IPv6 address its first three groups). The full address is also kept with the last use of an upload key and with a request for access to a protected share.
Activity and audit records. A record of events such as sign-ins and failed sign-in attempts, uploads, downloads and deletions, and of administrators' actions such as approving, rejecting, disabling or resetting an account. Each record has a time, the account involved, a short description (which can include the name of a file or folder) and, for some events, the shortened network address. A record refers to an account by its internal number, and the username is looked up only when an administrator reads the log. A name typed by someone who is not signed in, such as a failed sign-in attempt or a visitor to a share link, is not recorded.
Reports. If you send a report through the report form, we keep what you write in it: what you are reporting, where it is, your description and, if you give them, your name and email address and, for a copyright claim, your signature and your confirmation of the two statements the form asks for. We also keep the time and your network address with its last part cut off, so that it no longer points to one connection, and we use it to spot repeated or abusive reports. The form accepts five reports an hour from one network.
Web server logs. Our web server may log the network address, time, requested path and result of each request. We keep these logs for 365 days.

We do not use your information for advertising, for profiling, or for automated decisions that have legal or similarly significant effects on you, and we do not sell it.

3. Why we use it, and our legal basis

To create and run your account and to provide the file server and music tools you asked for (performance of our agreement with you).
To keep the service secure, to prevent abuse, to limit repeated sign-in attempts, to look into reports, and to keep a tamper-evident record of administrative actions (our legitimate interest in protecting the service and the people who use it).
To comply with the law, for example by answering copyright notices and lawful requests, and by reporting illegal content where we are required to (legal obligation).
To establish, exercise or defend legal claims (our legitimate interest).

If we ever rely on your consent for something, you can withdraw it at any time.

4. Who else handles your information

Telegram (the messaging service). All file contents are kept there, as encrypted pieces. Telegram also holds encrypted copies of our database. It receives the pieces with meaningless names, their sizes and the times they were sent, and it cannot read them without our key. Telegram's own privacy policy applies to what it receives.
Our hosting provider. The company whose servers and network run the service processes data on our behalf and can technically reach the server.
Websites you ask the link downloader to contact. If you are allowed to use the link downloader, the site you point it at sees our server's address, not yours.
Authorities and other parties where the law requires it, or where needed to protect people from serious harm, or to establish, exercise or defend legal claims.

We do not use advertising, analytics or tracking services, and we do not give your information to data brokers.

5. Where it is stored, and how it is protected

On our server. A database holds the account, folder and file records and the activity and audit records. A data folder holds the music tool workspaces and temporary files used while an upload is being processed. The server also keeps backup copies of the database on its own disk: recent daily copies, and a copy made before each software upgrade.
In Telegram. Your files are cut into pieces and each piece is encrypted with AES-256-GCM on our server before it is sent. A full copy of our database is also posted there regularly (by default every day), encrypted with a separate passphrase.
Limits of the encryption. Our server holds the keys, because it must decrypt files when you open them. The encryption protects your files from Telegram and from anyone who obtains only the stored pieces. It does not protect them from someone who gains control of our server, or from the people who run it.
Other safeguards. Passwords are hashed with scrypt. An authenticator code is required at every sign-in. Session and sign-in tokens are stored only as hashes. The music tools run on a separate web address and can be reached only through our server.
Limits of security. No system is perfectly secure, and we cannot promise that your information will never be lost, disclosed or altered.

6. Cookies and browser storage

Sign-in token. Your browser keeps the token that proves you are signed in to the file server, in session storage (cleared when you close the tab or browser) or in local storage if you chose to stay signed in. It is not a cookie.
Preferences. Choices such as your language and how files are displayed are kept in your browser's local storage.
Offline copy. A service worker and your browser's cache keep copies of the app's own pages, scripts and styles so that it loads faster. They do not hold your files.
Tools cookie. When you open the music tools we set one cookie on the tools web address. It is HttpOnly, Secure, SameSite=Lax and limited to that address, and it identifies your tool session. It stops working when you sign out or your access changes.
Share links. If public share links are turned on, opening a protected share link may set a cookie that remembers that you entered the share's password. It applies only to that share.
Other requests. The pages of this service load their scripts, styles, fonts and images only from our own servers and do not call advertising, analytics or other outside services.

All of this is needed to provide the service you ask for, so we do not use a cookie consent banner. We use no cookies or browser storage for analytics, advertising or tracking.

7. How long we keep it

Sign-ups never completed. If you do not confirm your authenticator app after signing up, the account is deleted automatically after 24 hours.
Accounts and records. We keep your account and file records while your account exists. If your account is closed, we delete the account record and your files, except for the items below.
Files. Until you or a folder administrator delete them, or your account is closed. When a file is deleted it disappears from our index at once and its pieces are queued for removal from Telegram. Telegram does not always let us delete them (in a private chat, for example, only messages younger than 48 hours), so unreadable encrypted pieces can remain there.
Music tool workspaces. Kept in your workspace on the server until the workspace is closed, for example when your access to the tools is withdrawn or your account is closed or disabled. There is no fixed storage period, and we may clear workspaces at any time, so do not use the tools as storage.
Audit records. The audit log is an append-only chain of records in which each entry is linked to the one before it, so that tampering shows. Entries are kept for the audit retention period set by the operator, 365 days unless changed. After that the oldest entries are removed together, from the start of the log only, and a signed marker takes their place so that the remaining chain can still be checked. Entries identify an account by its internal number and can mention the name of an affected file or folder, but never the contents of files. While an account exists, its username is shown next to its entries; once it is deleted, they show only a placeholder (deleted- followed by a number).
Backups. Copies of the database are kept for disaster recovery. The encrypted copies in Telegram are not deleted automatically, and copies on our server are replaced over time or removed by the operator. Information we have deleted from the live service, including a closed account, can therefore remain in older backups for some time. We use backups only to restore the service after a failure.
Web server logs. 365 days.
Reports. As long as needed to deal with the report and any follow-up, and to keep a record of copyright notices.

8. Your rights

Whatever country you live in, you can ask us what we hold about you, ask us to correct it, and ask us to delete it. Depending on where you live you may have more rights.

If the GDPR or UK GDPR applies to you, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to our use of it, to receive it in a portable form, to withdraw consent where we rely on it, and to complain to your data protection authority (in the UK, the Information Commissioner's Office). Where our use of your information is based on legitimate interests, you can object to it.
If you are a California resident, you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, to opt out of its sale or sharing, and not to be treated worse for using these rights. We do not sell your personal information or share it for advertising.

To use a right, write to deejaysholay@gmail.com. Because we hold no email address for you, we may ask for information that lets us confirm that the request comes from the account holder. We reply within one month (the GDPR allows two more months for complex requests) or within 45 days (California allows another 45 days), and we do not charge a fee unless a request is clearly unfounded or excessive.

Some rights have limits. We may keep audit records and backups as described in section 7, and information we need to meet a legal obligation or to deal with a legal claim. We will tell you what we kept and why.

9. Children

The service is not for anyone under 18. You confirm your age when you sign up, but we do not verify it. If we find that an account belongs to someone under 18, we close it and delete the data we hold about it, subject to section 7. If you think a child has an account, write to deejaysholay@gmail.com.

10. If something goes wrong

If we become aware of a personal data breach that is likely to put your rights at risk, we will notify the data protection authority within 72 hours where the law requires it, and tell the people affected without undue delay where the law requires it. We do not hold email addresses, so we will do this by a notice on this website.

11. Transfers between countries

Our server may be in a different country from you, and Telegram operates worldwide. Where personal information is transferred out of the UK or the European Economic Area, we rely on the safeguards the law recognises, such as an adequacy decision or standard contractual clauses, where they apply.

12. Changes to this policy

When we change this policy we update the date this page was last updated, and for significant changes we put a notice on this website.

13. Contact

Privacy contact: deejaysholay@gmail.com
Operator: DJ SHOLAY
Address: Fairfax, VA USA

Last updated 2026-10-30