Privacy Policy
Last updated: 4 November 2026
This policy explains what personal data Bojko Drive processes, why, for how long, and what rights you have. It is provided in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR) and Czech Act No. 110/2019 Coll. on personal data processing, and it also covers the use of cookies under Section 89(3) of Czech Act No. 127/2005 Coll. on electronic communications.
1. Who is the controller
The controller of your personal data is Jan Bojko, Písek 450, 73984, Písek u Jablunkova ("we", "us").
Contact for all privacy matters: honzabojko@seznam.cz.
We have not appointed a data protection officer, because we are not required to by Article 37 GDPR.
2. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account data: e-mail address, name and profile picture (depending on your sign-in method), user ID | Creating and running your account, signing you in | Art. 6(1)(b) GDPR – performance of the contract (providing the service you asked for) | Until you delete your account; deleting the account also erases your files and folders (see section 7) |
| Your files and folders: file names, file contents, sizes, folder structure, upload dates | Storing and displaying your files, enforcing the storage limit | Art. 6(1)(b) GDPR – performance of the contract | Until you delete the file or folder, or your account |
| Technical data: IP address, browser and device type, request time, error logs | Security, abuse prevention, keeping the service running | Art. 6(1)(f) GDPR – our legitimate interest in a secure and working service | Short-term, as set by our hosting and authentication providers (typically days to weeks) |
| Analytics data (only if you accept analytics cookies): pages viewed, browser and device type, approximate location derived from IP address, and – when you are signed in – your pseudonymous user ID (no name or e-mail address) | Understanding how the site is used so we can improve it | Art. 6(1)(a) GDPR – your consent (and Section 89(3) of Act No. 127/2005 Coll. for the cookie/storage access) | Up to 12 months, or until you withdraw consent and ask for deletion |
| Record of your choices (cookie choice and confirmation of this policy): a random ID generated in your browser, the choice, policy version, time, and a keyed hash of your IP address. No name, e-mail or user ID | Being able to demonstrate that you gave (or declined) consent | Art. 6(1)(c) GDPR in connection with Art. 7(1) GDPR and Section 89(3) of Act No. 127/2005 Coll. – legal obligation to be able to prove consent | 3 years from the record |
Confirmation before sign-up. Before you register we ask you to tick a box confirming that you agree to the processing of personal data described here. Processing that is necessary to provide the service rests on the contract (see the table above); the box confirms that you have been informed about it. A record of this confirmation is stored in your browser and, as proof, in our database (see the last row of the table above). The record cannot be linked to you without the random ID stored in your browser; if you want it deleted, send us that ID (visible in your browser's local storage under "bojko-drive:consent-id").
We do not sell your data, we do not show advertising, and we do not use your files for anything other than showing them back to you.
3. Is providing the data mandatory
Providing account data and uploading files is voluntary, but without an account we cannot provide the service. Analytics are entirely optional: if you choose "Only necessary", everything keeps working.
5. Who receives your data
We share data only with service providers (processors) who work for us under data processing agreements, and only as needed for the purposes above:
- Clerk – authentication and account management.
- UploadThing – upload and storage of your files.
- SingleStore – database holding your folder structure and file metadata.
- Netlify – web hosting.
- PostHog – product analytics, only if you accepted analytics cookies.
We may also disclose data to public authorities if the law requires it.
6. Transfers outside the EU/EEA
Some of the providers above process data in the United States or other countries outside the European Economic Area. Such transfers rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can request a copy of the safeguards by contacting us.
7. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15),
- have inaccurate data corrected (Art. 16),
- have your data erased ("right to be forgotten", Art. 17),
- restrict processing (Art. 18),
- receive your data in a structured, machine-readable format and transmit it to another controller (Art. 20),
- object to processing based on legitimate interests (Art. 21), and
- withdraw your consent at any time (Art. 7(3)) – as easily as you gave it – without affecting the lawfulness of processing before the withdrawal.
To exercise any of these rights, write to honzabojko@seznam.cz. We will answer within one month. You can delete your files yourself at any time inside the app.
Deleting your account. You can delete your account in the account menu (the profile picture in the top right corner). When the account is deleted, we automatically erase all your files and folders from our database and from the file storage. Analytics data (if any) and the record of your cookie choice are erased or expire as described above; ask us if you want them removed earlier.
You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.gov.cz, or with the authority in your own EU member state.
8. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22 GDPR).
9. Children
Bojko Drive is not intended for persons under 15 years of age. If you are younger, you may use the service only with the consent of your parent or legal guardian.
10. Security
Data is transmitted over encrypted connections (HTTPS), access to your files in the app requires signing in, and access to our systems is limited. No system is perfectly secure; if a breach puts your rights at risk we will notify you and the authority as required by Articles 33 and 34 GDPR.
Share links. Your files are stored at UploadThing and can be opened through a long, random link (the "Copy link" button shows it). The link is not guessable, but anyone who has it can open the file without signing in, so share it only with people you trust. Deleting the file disables the link.
11. Changes to this policy
We may update this policy when the service or the law changes. The rules for using the service are in our Terms of Service. The date of the latest version is shown at the top. If a change is significant, we will ask you to confirm the new version.