---
title: What data quickS3 keeps
description: "A plain list of what quickS3 stores about you, your organisation, and your activity, what it never stores, and how long each part is kept."
section: Security
order: 50
audience: [owner, admin, member, agent-user]
status: published
lastVerified: 2026-09-15
sources:
  - web/src/pages/privacy.astro
  - src/lib/database.ts
  - src/objects/organisation-db.ts
  - src/objects/organisation.constants.ts
  - web/src/components/app/bucket-browser/PreviewDialog.tsx
---

This is a plain list of what quickS3 stores to work. The legal version is the [Privacy Policy](/privacy/); if the two ever disagree, please tell us.

## About you

- Your email address, and your name and picture if you sign in with Google.
- A hash of your password, if you set one. Never the password itself.
- Your sign-in sessions and pending invitations.
- Sign-in events, with the IP address and browser they came from.

## About your organisation

- Its name, members, and their roles.
- Custom roles and their rules.
- Connections: provider, region or endpoint, bucket scopes, and the encrypted storage key.
- Share links: which file, who created it, and when it expires.
- AI clients: their name, which roles they were given, when they were last used, and when they expire.
- Audit events: who did what to which file, and whether it was allowed.

## About your files

quickS3 sees bucket names, file names, sizes, and dates when it lists folders for you. It doesn't store your files or their contents. Uploads, downloads, and previews go straight between your browser and your storage provider. The only exception is the backend upload fallback, which Owners can turn on for a connection; see [where your files travel](/docs/security/file-data/).

## How long it's kept

Audit events are deleted after 14 days. Sessions, invitations, share links, and AI access each expire on their own schedule. When you remove someone from an organisation, their past activity stays in the audit log until it ages out. Deleting a connection never deletes anything in your storage.

## Keeping less

- Give organisations, connections, and roles plain names, without customer names or other sensitive details.
- Keep share links and AI access short.
- Remember that audit exports and screenshots are copies you'll need to look after yourself.