Privacy

The short version

RELEASE exists to deliver creative work securely and get creators paid. We collect the minimum needed to do that, we never sell personal data, we never use it for advertising, and you can export or delete your data yourself from your account at any time.

What we collect

Creators — your account details (name, email, password stored as a salted hash), your profile (handle, bio, avatar, banner, social links, page theme), optional billing details you enter for your invoices, and the files you upload.

Clients — the name and email entered at checkout (plus optional company and billing address), used to deliver the purchase, grant re-access, and issue the invoice. Clients never need an account.

Technical — session cookies required for sign-in and for linking an in-progress upload or purchase to your browser. We do not run third-party advertising trackers.

Your files

Uploaded originals are stored in private object storage and are never exposed through public URLs. What clients see before payment is a separate, watermarked preview. Originals are delivered only through short-lived, signed download links after a confirmed payment. Each original's SHA-256 checksum is recorded so its integrity can be verified — the file delivered is byte-for-byte the file uploaded.

Payments

Payments are processed by Stripe. RELEASE never sees or stores card numbers, and payout banking details live entirely inside Stripe's onboarding — not on our servers. We store the transaction record (amount, currency, status, buyer name and email) because delivery, re-access and invoicing depend on it, and because we are legally required to keep records of completed transactions.

Where data lives

Files are stored on Cloudflare R2 and application data on Railway-managed infrastructure. Payment data is processed by Stripe. These providers act as processors for the purposes described above.

Your rights

From Account → Security & privacy you can download everything RELEASE holds about you as a single file, and permanently delete your account. Deletion removes your profile, login, and unsold work immediately; records of completed transactions and files your clients already paid for are retained (legal obligation and your clients' continued access), unlinked from your personal identity. These controls implement your GDPR rights of access, portability and erasure — directly, without a support ticket.

Contact

Privacy questions can be raised through your account's support channels.