What we store
To host an image we need to keep the image file itself and a small record containing the filename, file type, size, dimensions, upload time, and — if you are signed in — the account it belongs to.
Guest uploads are not linked to an identity. Instead, your browser stores a random deletion token in localStorage. That token proves the upload belongs to you so you can delete it or claim it later. It never leaves your browser except when you ask us to verify it.
Accounts
Registration is optional. If you create an account, we store your email address, display name, a scrypt password hash (never the password itself), and your upload history. Session cookies keep you signed in for up to 30 days.
Cookies and local storage
We use a minimal amount of browser storage:
- hubie_session — an httpOnly cookie used only to keep you signed in.
- hubie.guest.uploads.v1 — the guest upload tokens described above.
- hubie_locale — remembers your chosen language.
Image metadata
Static JPG, PNG, and WEBP files are re-encoded on upload, which removes EXIF metadata such as camera details and GPS coordinates and applies the correct orientation. Animated GIF and WEBP files are stored as uploaded so their animation is preserved; consider removing sensitive metadata before uploading an animated file.
Who can see your images
Uploads are unlisted: they are not indexed or listed publicly, but anyone with a link can view them. Treat upload links as public. Deleting an image removes the file from storage and its link stops working.
Service providers
UploadWithHubie runs on infrastructure chosen by the operator of this instance. We do not sell or rent your information. Data is only shared where necessary to run the service, comply with the law, or protect the platform from abuse.
Retention
Images remain until you delete them or an administrator removes them for a terms violation. Deleting an account or image removes the associated metadata. Backups, where they exist, are cycled on a short schedule.
Security
Passwords are hashed with scrypt, sessions use random tokens stored as hashes, and uploads are validated by file signature rather than trusting the browser. No system is perfect; please use a unique password and report anything suspicious.
Children
The service is not directed at children under 13, and we do not knowingly collect their personal information.
Your choices
You can delete images from your dashboard or the Recent Uploads page, change your display name and password in Settings, and request account deletion by contacting us. Guest visitors can clear their history by clearing site data for this domain.
Contact
Questions about this policy? Email info@uploadwithhubie.com or use the contact page.