Privacy policy

In short

The images and videos you upload are public: anyone with the link can see them. We do not keep your IP address, we keep no access logs, and the site has no analytics, ads or trackers.

sugi.moe is operated by YLDM Co., Ltd., which is responsible for the personal information described in this policy. Questions about this policy and your personal information go to hi@sugi.moe; report abuse to abuse@sugi.moe.

What you upload

We store the file itself and its name (if your browser or command supplied one), type, size, upload time and expiry. The file and its name appear on its public link and share page.

When you upload on the website, “Strip photo location” is on by default: EXIF and XMP metadata in JPEG, PNG and WebP files (including GPS position, camera model and capture time) is removed in your browser before upload and never reaches us. AVIF files, videos, and anything uploaded through the API, the CLI or MCP are not processed, so check them yourself.

Do not upload pictures that show personal details, IDs, passwords or keys. By uploading you confirm you have the right to make the content public.

What we record to fight abuse

For every file and album we record its upload time and an HMAC fingerprint of the uploader's IP address: a one-way function of the IP keyed with a secret only the server holds. We never store the IP itself. Without the key the fingerprint cannot be turned back into an IP; the maintainers, who hold the key, can check whether a known IP matches a fingerprint.

The fingerprint is used only to prevent and handle abuse: to find and remove violating content uploaded from the same source, and to cooperate with law enforcement when the law requires it. Our legal basis is our legitimate interest in preventing and handling abuse (GDPR Art. 6(1)(f)). The fingerprint is kept exactly as long as the file it belongs to and is deleted with it, except for files removed for breaking the terms (see “How long we keep things”).

To enforce rate limits, Cloudflare briefly counts upload requests per IP (for seconds up to a minute).

What we do not record

sugi.moe itself keeps no access logs; request logging for the Worker is turned off. sugi.moe runs on Cloudflare, so requests pass through Cloudflare's network; Cloudflare processes connection data, including IP addresses, as our processor under its standard Data Processing Addendum. See Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/.

What stays in your browser

Your “My files” history (links, file names, delete tokens and small thumbnails) and your preferences (day or night, upload options) are kept in your browser's localStorage, on this device only, and are never sent to us. Clearing the browser's data deletes them, so export them first.

When you switch the language we set a cookie named sugi_lang to remember the choice, for one year.

Accounts

Accounts are optional. If you log in we store: your email (when you log in with email), which files and albums belong to your account, and hashes of your login sessions.

While you are logged in your browser holds a cookie named sugi_session (HttpOnly, valid for 30 days) that only keeps you logged in. Login links sent by email are valid for 15 minutes and work once.

Login emails are sent through Resend (Resend, Inc.), using its Tokyo region (ap-northeast-1). As our processor, Resend handles the recipient address and the message content, which includes the one-time login link.

How long we keep things

Files kept “forever” stay until you delete them with their delete token or they are removed for breaking the terms. Files kept for 1 hour, 12 hours or 3 days stop working the moment they expire and are deleted within about ten minutes, and in any case within 4 days. When a file is deleted we also purge its copies from Cloudflare's cache; copies cached elsewhere (other websites, browsers) are out of our control.

Albums stay until you delete them; files deleted from an album's set simply stop appearing in it.

When a file is removed for breaking the terms, we keep a record of the removal: the file id, when and why it was removed, and the HMAC fingerprint of its source, to deal with further abuse from the same source. The source fingerprint is kept for at most 2 years; after that it is erased from the record, leaving only the file id, time and reason. Where needed we also put the SHA-256 hash of the content in a blocklist so the same file cannot be uploaded again: a hash is a one-way fingerprint that the file cannot be recovered from, it is kept as long as it is needed to stop re-uploads, and you can ask for it to be lifted. Sources barred from uploading are released when their own block expires. The removed file's link keeps saying that it was removed.

Account data is kept until you ask us to delete the account; sessions expire after 30 days and email login links after 15 minutes.

Who processes this data

Cloudflare, Inc. provides sugi.moe's hosting and CDN, file storage (R2, stored in the Asia-Pacific region), database (D1), email forwarding and its CSAM Scanning Tool.

The CSAM Scanning Tool compares content served through Cloudflare's cache against lists of known child sexual abuse material that child safety organisations such as the National Center for Missing & Exploited Children (NCMEC) provide to Cloudflare. According to Cloudflare's documentation, on a match a block is placed, where possible, to prevent further serving of the content, and we receive a daily email listing the file paths of content matched in the past 24 hours. Cloudflare's documentation places the obligation to report on the website operator; when we are notified of a match we remove the content and report it to the appropriate authorities as the law requires (for example through NCMEC's CyberTipline).

International transfers: Cloudflare and Resend operate in many countries, so your data may be processed outside the country you live in, including in the United States and Japan.

Cookies and tracking

sugi.moe only uses the language cookie described above (and the session cookie once you log in). There are no analytics, ads, third-party scripts, tracking pixels or fingerprinting, and pages load nothing from other websites.

Deletion and other requests

You can delete your own uploads at any time: press × under “My files”, or call DELETE /api/files/:id with the delete token returned by the upload.

You have the right to access, correct and delete the personal information we hold about you, to receive it in a portable format, and to object to our processing of it. To exercise these rights, or for anything else (such as removing a file you have no delete token for, or deleting your account), write to hi@sugi.moe with the relevant links. We answer within 30 days.

Children

sugi.moe is not meant for children. If you are under 16, please do not create an account.

Changes

When this policy changes, the date on this page changes with it; significant changes are announced on the home page.