FileIt keeps some of the most important documents in your life, and those of your family. This Privacy Policy explains, as plainly as we can, what personal information we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have.

This policy applies to the FileIt website at fileit.com, the FileIt web application, the FileIt mobile apps for iOS and Android, our email-to-vault service, and the related features and apps (together, the “Service”). It is part of our Terms of Service.

1. Who we are

The Service is operated by Verge Inc., a United States company (“FileIt”, “we”, “us”). For the personal information described in this policy we are the “business” or “controller”, meaning we decide how and why it is processed, except where we say otherwise below.

If you use FileIt for an organization, for example to keep employee records, that organization decides what information it puts into FileIt and why, and it is responsible for its obligations to the people concerned. In that situation we process that information on the organization’s behalf and according to its instructions.

You can reach us about privacy at any time at [email protected].

2. Information we collect

2.1 Information you give us

• Account information: your name, email address, password (which we store only as a secure hash), country, preferred language and date format, profile photo if you add one, and your settings and preferences. If you invite sub-users, we store their names, email addresses, access levels and the folders they may see.
• Sign-in with Google or Apple: if you choose one of these, we receive your name and email address (for Apple, possibly a private relay address) and an identifier from that provider. We do not receive your Google or Apple password.
• Documents and files: the files you upload, attach, email to your vault or create in FileIt (for example, converted PDFs, edited images and completed forms), together with their file names, types, sizes and a fingerprint (hash) of each file used to detect duplicates.
• Document details: information about each document, such as its title, type, owner, document number, issuing country, issue and expiry dates, notes, tags, folder and the extra email addresses you want reminded about it.
• People and entities: the people (“members”) and organizations (“entities”) you add, which may include names, relationships, dates of birth, photos or logos, email addresses, and for entities a contact name, phone number, postal address and notes.
• Reminders and recurring items: reminder schedules, recurring reminders such as bills or renewals (including any amounts and currencies you enter) and their completion history.
• Sharing: the email addresses and names of people you share folders with or send documents, share links or signature requests to, and the settings you choose for them.
• eSignature: the documents you send for signature, signers’ names and email addresses, the fields you place, and signers’ signatures, initials and entries (see section 8).
• Forms you create: if you use the Forms app, the forms you design (their questions, settings and the folder their responses are filed in), the names and email addresses of people you send a form to, and the responses you receive (see section 8).
• Compliance forms: your answers to government forms, which can include highly sensitive information such as Social Security or other government identification numbers, dates of birth, addresses, immigration status and employment details.
• Payments: your plan and subscription status. Card payments are handled by Stripe or Apple; we receive and keep only identifiers for your customer, subscription and payment records, and the amount, currency and date of each purchase. We never receive or store your full card number.
• Communications: messages you send us through the contact form or by email, and any information you provide when asking for support.
• Assistant questions: questions you type into the AI assistant, if your plan includes it.

2.2 Information collected automatically

• Log and device information: IP address, browser and device type, operating system, the pages and features you use, date and time, and error information. We record the IP address and browser used to create an account, to help us detect abuse.
• Sign-in and security information: session identifiers, failed sign-in attempts, and two-factor authentication settings, used to keep your account secure.
• Share-link activity: how many times a share link you created has been opened.
• Cookies and similar technologies: see section 9. On our public pages, and only with your consent, Google Analytics collects information about your visit, and Google Ads records whether a visit that came from one of our ads led to a sign-up.
• Mobile apps: the apps store your sign-in token and preferences securely on your device. If you choose to scan or pick a photo, the app uses your camera or photo library only to capture the image you choose to upload. The apps check for updates using Expo’s update service, which receives your device’s IP address and basic app and device information. The apps do not contain advertising, analytics or crash-reporting tools.

2.3 Information from other people and sources

• Other FileIt users may add information about you, for example a family member who stores your passport, an employer who keeps your work documents, someone who shares a folder with you, someone who sends you a document to sign, or someone who sends you a form to fill in. See section 8.
• Form responses: when someone fills in a form you created with FileIt Forms, we receive their answers, any files they upload and any signature they draw, as described in section 8.
• Email-to-vault: when you email documents to FileIt, we receive the message, the sender’s address, the attachments and email headers.
• Payment providers: Stripe and Apple tell us whether a purchase, renewal, cancellation or refund succeeded.
• Sign-in providers: Google and Apple, as described above.

3. Sensitive information

Many documents people keep in FileIt contain sensitive personal information, such as government identification numbers (passport, driver’s license, national ID or Social Security numbers), dates of birth, citizenship and immigration status, photographs, and sometimes health or insurance information. Documents may also belong to children.

We use this information only to provide the Service you asked for: to store it, show it to you and the people you authorize, read documents to suggest their details, send the reminders and messages you set up, keep the Service secure, and meet legal obligations. We do not use sensitive information to profile you or to infer characteristics about you, and we do not sell it or share it for advertising.

Please upload only what you need. If you would prefer that your documents are not read by AI, turn off AI reading in Settings (see section 5).

4. How we use information

We use personal information to:

• Provide the Service: create and run your account; store, organize, display, search, convert and deliver your documents; calculate and send reminders; run the features you use, such as sharing, share links, emailing files, email-to-vault, eSignature, Compliance forms, Forms (turning each response into a PDF in your vault), translation, reports and the assistant; and process your plan and storage.
• Read documents for you: suggest a document’s type, owner, number and dates so you do not have to type them (see section 5).
• Communicate with you: send activation and security codes, reminders, receipts, service announcements and replies to your questions. On a free account we also send a short series of tips about using FileIt: one when your account is activated, then a few over the following weeks, about the features you have not tried yet. They stop when you subscribe to a paid plan or when the series ends. Every tips email has an unsubscribe link that works in one click, and you can turn them off in Settings → Emails. Unsubscribing never stops reminders, security codes or receipts. We do not send other marketing emails without your permission, and we never sell or share your email address for others to market to you.
• Keep FileIt secure: authenticate users, prevent fraud, spam and abuse, limit repeated sign-in attempts, investigate suspicious activity, and fix errors.
• Support you: answer questions and resolve problems. When you ask for help, our authorized staff may access your account to investigate, and we limit that access to what is needed.
• Improve FileIt: understand which features are used and where things go wrong, using logs, error reports and, on public pages, consented analytics. We do not use the contents of your documents for this purpose.
• Meet legal obligations and protect rights: keep financial records, respond to lawful requests, enforce our Terms, and protect the rights, property and safety of our users, the public and FileIt.

We do not use automated decision-making that produces legal or similarly significant effects on you.

5. AI features and your documents

FileIt uses AI for three things. Here is exactly what is sent, and to whom:

• Reading documents (extraction). When you upload a document, or press Re-read, we send the document to our AI provider so it can suggest details such as type, owner, number and dates. Images and PDFs are sent as the file itself (for long or very large PDFs, images of the first pages). Word and Excel files are sent as their text. The suggested details are stored with the document and shown to you to confirm or change. Nothing is treated as confirmed until you save it.
• Translation. When you ask FileIt to translate a document, we send the document (or its text) to our AI provider and store the translation with the document so you do not pay for it twice.
• AI assistant (on plans that include it). When you ask a question, the assistant sends your question and the relevant details it looks up from your vault, such as document titles, owners, types and dates, to our AI provider. It does not send your files. Assistant conversations are not stored on our servers.

AI apps you connect (on Premium and Enterprise). You can connect your account to an AI app of your choice, such as Claude or ChatGPT, using the Model Context Protocol. This is off until the account owner turns it on in Settings → AI apps, and each app must be approved by you after you sign in, or use an access key or Client ID you create there. When you ask that app something, it asks FileIt for what it needs, and FileIt sends it the information it requests from your account only, within the permissions you chose: the details of your documents, people, entities, folders and reminders; the files themselves, if you allowed it; and changes to document details, people and reminders, if you allowed it. A connected app can never delete anything, share, send email, or change your settings, plan or password. That AI app's provider is not our service provider: you choose it, and its own terms and privacy policy apply to what it receives. You can see every request a connected app made, and disconnect it at any time; changing your password disconnects every app.

Our AI provider. We currently use OpenRouter, an AI gateway that routes each request to a large-language-model provider to process it and return the result. We may also use our own self-hosted models. We do not use your documents to train our own models. The AI provider and model provider process your content under their own terms and privacy policies, which we choose and review with this in mind.

You can turn AI off. In Settings you can opt out of AI reading and translation for your account. When you do, your documents are not sent to any AI provider for these features and you enter document details yourself. Some processing, such as converting files to PDF, editing images and generating previews, always happens on our own servers and does not involve AI providers.

6. Service providers

We use carefully chosen companies to help us run the Service. They may process personal information only on our instructions, to provide their services to us, and under contracts that require them to protect it.

We may change providers over time. We will update this list when we do.

7. Other ways information is shared

We do not sell personal information, and we do not share it for cross-context behavioral advertising. Besides our service providers, information is shared only:

• When you direct us to. The Service shares information with the AI apps you connect, as described in section 5, and with the people you choose: sub-users on your account; people you share folders with; anyone with a share link you create; recipients of files you email; people, entity contacts and extra recipients you set to receive reminders; signers of documents you send for signature, who receive the document and, once complete, the signed copy with its Certificate of Completion; people you send a form to, who receive a link to fill it in; and, if you turn it on, the people who fill in your forms, who receive a PDF copy of their own response.
• Within your account. The account owner and authorized sub-users can see information in the folders they have access to.
• For legal reasons. We may disclose information if we believe in good faith that the law, a court order or a valid legal process requires it, or that it is necessary to protect the rights, property or safety of our users, the public or FileIt, or to prevent fraud or abuse. Where lawful, we will try to tell you before disclosing your information in response to a government request.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, information may be transferred as part of that transaction, subject to this policy. We will tell you before your information becomes subject to a different privacy policy.
• With your consent, for any other purpose we describe to you when we ask.

Profile photos and people and entity images are served from our content delivery domain using long, hard-to-guess addresses, so that pages load quickly. Anyone who obtains such an address could view that image.

8. Information about other people

FileIt users store documents and details about other people, such as family members, employees and business contacts, and send documents to other people to sign. If your information is in FileIt because someone else put it there:

• The FileIt user who added it decides what is stored and why, and is responsible for having the right to do so. We process it to provide the Service to that user.
• If a user gives FileIt your email address so you receive reminders about your own documents, you will receive those reminder emails. They do not contain your documents. You can ask the user to remove your address, or contact us.
• If you sign a document through FileIt eSignature, we collect your name, email address, signature and initials, the information you enter, your IP address and browser details, and the times you viewed, agreed to sign electronically, signed or declined. This is recorded in the Certificate of Completion attached to the signed document, which is given to the sender and all signers and stored in the sender’s account, so the signature can be verified later.
• If you receive a shared folder, we create a limited login for you with your email address and name.

Filling in a form sent through FileIt Forms

FileIt account holders can design their own forms and ask other people to fill them in, by emailing a personal link or sharing a public link. If you fill in one of these forms:

• Who decides. The person or organization who sent you the form (the “form owner”) decides what it asks, why, and what happens to your answers. The form owner is responsible for complying with privacy law for your answers. We process them on the form owner’s behalf and according to their instructions. The form shows who it is from.
• What we collect. We collect:
  • your answers, including your name and email address if the form asks for them;
  • any files you upload, and any signature you draw or type;
  • your IP address, browser details and the time you submitted, to keep the service secure and the record reliable;
  • when you opened a personal link you were emailed.
• What happens to it. Your answers are stored encrypted in the form owner’s FileIt account. Each response is turned into a PDF that is filed in the form owner’s vault, with the files you uploaded attached to it. The form owner can see your response, as can anyone they give access to that part of their vault. They may be notified by email when you submit, and they can export responses.
• Your copy. If the form owner has turned it on and we have your email address, we email you a PDF copy of your response.
• On your device. While you fill in a form, your unfinished answers are kept in your own browser so you don’t lose them. Uploaded files are not kept. This copy is deleted when you submit, and discarded after 60 days if you never do. If the form owner allows only one response per person, we also set a cookie on that form’s link after you submit (see section 9).
• Your rights. To see, correct or delete your response, please contact the form owner, who controls it. You can also contact us and we will pass your request on. We don’t use your answers for our own purposes, and we don’t sell them.

If you want to exercise your rights over information another user has stored about you, you can contact that user directly or contact us, and we will help or pass on your request where appropriate.

9. Cookies and similar technologies

FileIt sets a small number of essential cookies. The site cannot work without them, so they are always on:

Analytics cookies (optional). Only if you accept, our public pages also load Google Analytics, which sets its own cookies (_ga and _ga_*) to measure visits. Google Analytics is never loaded inside your vault, and it never sees your documents. Until you accept, the analytics script is not loaded at all. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can change your mind at any time with the Cookie settings link at the foot of any page — declining also deletes the analytics cookies.

Browser storage. We also store a few preferences in your browser, such as light or dark mode and which settings tab you last used. When you fill in a form sent through FileIt Forms, your unfinished answers are also kept in your browser until you submit (see section 8). These stay on your device.

Advertising cookies (optional). Only if you choose “Accept all”, or turn on Advertising under “Choose”, our public pages load the Google Ads tag, which sets its own cookies (such as _gcl_au). We use it for one thing: to measure whether a visit that came from one of our ads led to someone creating a FileIt account. We do not use it for retargeting, personalised ads or building profiles, it is never loaded inside your vault, and it never sees your documents. Advertising and analytics are separate choices — you can accept one without the other — and withdrawing either with the Cookie settings link also deletes its cookies.

We do not use cookies for cross-site tracking or personalised advertising, and we do not respond to the older “Do Not Track” signal differently because we do not track you across other sites.

Cookie 设置

10. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Service, and then as described below.

We may keep information longer where the law requires it, or where it is needed to resolve disputes, enforce our agreements or protect against fraud and abuse.

11. How we protect information

We take security seriously and use technical and organizational measures designed to protect your information, including:

• encryption of data in transit using HTTPS;
• storing files in private cloud storage that is not publicly accessible and that encrypts stored objects at rest;
• additional application-level encryption of Compliance form answers (which can contain Social Security and other identification numbers), of responses to forms created with FileIt Forms, and of two-factor authentication secrets;
• hashing passwords and share-link passcodes with bcrypt, and storing only hashed session tokens and hashed access tokens for connected AI apps;
• limiting each connected AI app to your account and to the permissions you approved, with a secure sign-in (OAuth with PKCE) and a record of every request it makes;
• optional two-factor authentication, sign-in rate limits and account lockout after repeated failed attempts;
• rate limits and checks against automated submissions on public form links, which the form owner can also switch off, close on a date, or limit to a number of responses;
• protection against cross-site request forgery, hard-to-guess identifiers for documents and links, and expiring, revocable share links with optional passcodes;
• access controls so that sub-users and people you share with see only what they are allowed to see; and
• limiting staff access to accounts to what is needed to operate, secure and support the Service.

No system is perfectly secure. You can help by using a strong, unique password, turning on two-factor authentication, keeping your email account secure, and sharing links only with people you trust. If we learn of a security breach affecting your personal information, we will notify you and the authorities as the law requires. To report a security issue, email [email protected].

12. Your choices and rights

Wherever you live, you can:

• Access and download your documents and information in the Service at any time.
• Correct your account information and document details in the Service.
• Delete individual documents, people and other records, or your whole account, in the Service.
• Turn off AI reading and translation in Settings.
• Control reminders and who receives them, and turn on two-factor authentication.
• Unsubscribe from tips emails with the link in any of them, or in Settings → Emails.
• Disconnect AI apps, or switch AI apps off entirely, in Settings → AI apps.
• Decline or withdraw consent to analytics using Cookie settings.
• Ask us for a copy of your information, or to correct or delete information you cannot change yourself, by emailing [email protected].

To protect your information, we will need to verify your identity before acting on a request, usually by confirming it from the email address on your account. We will respond within the time the law requires. We will not discriminate against you for exercising your rights. Depending on where you live, you may have additional rights, described below.

13. U.S. state privacy rights (including California)

If you live in California or another U.S. state with a comprehensive privacy law, you have the right, subject to certain exceptions, to:

• know what personal information we collect, use and disclose, and to access a copy of it in a portable format;
• correct inaccurate personal information;
• delete personal information we collected from you;
• opt out of the sale or sharing of personal information, targeted advertising and certain profiling (we do not do any of these);
• limit the use of sensitive personal information (we use it only to provide the Service, as permitted by law); and
• not be discriminated against for exercising these rights, and, in some states, appeal a decision we make about your request by replying to our decision.

Notice at collection. In the last 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 2 and 4: identifiers (such as name, email address, IP address and account identifiers); personal information described in California Civil Code § 1798.80 (such as identification-document numbers, photos, and signatures); characteristics of protected classifications (such as age, date of birth, citizenship or immigration status, where these appear in your documents or forms); commercial information (plan and purchase history); internet or network activity (logs and, with consent, website analytics); approximate location derived from IP address; audio or visual information (photos and document images); professional or employment information (where included in documents or forms); and sensitive personal information (such as Social Security, driver’s license, state ID and passport numbers, account sign-in credentials, and citizenship or immigration status). We disclose these categories for business purposes to the service providers listed in section 6 and to the recipients you direct in section 7. We keep each category for the periods described in section 10.

We do not sell or share (as those terms are defined in California law) personal information, including that of consumers under 16, and we do not use or disclose sensitive personal information for purposes other than those permitted by California regulations.

You or an authorized agent may make a request by emailing [email protected]. We may ask an agent for proof of authorization and ask you to confirm your identity directly with us.

14. EEA, UK and Swiss residents

If data-protection law in the European Economic Area, the United Kingdom or Switzerland applies to our processing of your personal information, we rely on the following legal bases:

• Contract: to provide the Service you signed up for, including storage, reminders, sharing and the features you use, and to process payments.
• Legitimate interests: to keep the Service secure, prevent abuse, fix and improve it, and communicate with you about it, including the tips emails we send free accounts (which you can unsubscribe from at any time), where these interests are not overridden by your rights.
• Consent: for optional analytics cookies, and any other processing we ask your consent for. You can withdraw consent at any time without affecting earlier processing.
• Legal obligation: to keep financial records and respond to lawful requests.

Where documents contain special categories of data, such as health information, we process them on the basis of your explicit instructions to store them, and only to provide the Service.

You have the right to access, correct, delete, restrict or object to our processing of your personal information, to data portability, and to withdraw consent. You can exercise these rights by emailing [email protected]. You also have the right to complain to your local data-protection authority, although we would appreciate the chance to address your concern first.

15. International transfers

FileIt is operated from the United States, and our servers and service providers are located mainly in the United States. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States and other countries where our providers operate, which may have different data-protection laws from where you live. Where the law requires, we protect these transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and their UK and Swiss equivalents.

16. Children

The Service is intended for adults. Children cannot create FileIt accounts, and we do not knowingly collect personal information directly from children under 13 (or the equivalent minimum age where they live).

Parents and legal guardians may store their children’s documents in their own FileIt accounts. In that case the parent or guardian provides and controls the information, and can view, correct or delete it at any time. If you believe a child has given us personal information directly, please contact us at [email protected] and we will delete it.

17. Changes to this policy

We may update this policy from time to time, for example when we add features or change providers. We will post the updated policy on this page and change the “Last updated” date. If we make material changes, we will notify you by email or in the Service before they take effect. If a change would allow us to use personal information we have already collected in a materially different way, we will ask for your consent where the law requires it.

18. Contact us

If you have any questions about this policy or how we handle your information, or want to exercise your rights, please contact us:

Verge Inc. (FileIt)
Email: [email protected]
Contact form: fileit.com/contact