Help
Privacy and Data Handling – Yoink
This page describes how Yoink handles data when you upload files or use the site.
Updated
Uploads and storage
Yoink runs on a Cloudflare Worker with files stored in Cloudflare R2. Uploaded files and their URLs are public: anyone with the link can open the file without signing in. Public URLs include a sanitized filename, a timestamp and a random segment. For signed-in uploads, the URL also includes an account identifier.
The recommended browser flow is a two-step presigned upload. Your browser sends the filename, media type, size and an optional Firebase token to Yoink, then the file is sent directly to R2 with its content type stored. A legacy route at /api/v1/upload additionally stores the original filename, upload timestamp, connecting IP address, and account id and email when available, as storage metadata. This extra metadata applies to the legacy route, not to every upload.
Sign-in
Optional Google sign-in is provided by Firebase Authentication. Firebase receives your Google profile details, and the Yoink interface displays the name, email and photo returned by the authentication flow. The Google authentication SDK maintains your sign-in session in the browser.
Browser storage
Your last 5 upload names, URLs, sizes and dates are kept in your browser's localStorage. The Clear button removes this local history only; it does not remove the remote files. The My Files list is held in memory for the current page session and is cleared by a page reload or account change. Removing a row there also does not delete the stored file.
Analytics
Yoink uses the Simple Analytics pageview script, served through a site proxy. Yoink also records custom funnel events that count content views, uploader button clicks, upload starts, upload completions and link copies. Custom event metadata contains only an allowlisted internal content slug and a coarse source category. It does not include names, file URLs, credentials or account IDs, and the custom helper creates no cross-page persistent tracking ID; it uses short-lived in-memory context and an internal URL hash handoff.
Practical notes
Yoink does not publish a retention or deletion timetable and does not guarantee that files remain available forever. Treat every upload as public. Keep your originals, and avoid uploading sensitive content or sensitive file names. See limits and retention and the API docs for more detail.
Contact
Questions about privacy on Yoink: kevin@bitgate.com.