Privacy Policy

Effective date: September 22, 2026
Last updated: September 29, 2026

This Privacy Policy explains how FTS LLC, a Nevada limited liability company ("FTS," "we," "us," or "our") collects, uses, shares, and protects information when you use voidcay.net and its related APIs, dashboards, and custom-domain features (the "Service"). It is part of our Terms of Service. For users in the European Economic Area, the United Kingdom, and Switzerland, FTS is the data controller.

Summary

We collect the minimum data needed to run an image host: your Discord identity, your IP address, the files you upload, and basic technical logs. We don't sell your data, run third-party analytics, or show ads. Public files are visible to anyone with the link. Private and password-protected files are available on some tiers. We use automated tools to detect child sexual abuse material.

1. Information We Collect

Discord account data. When you sign in with Discord, we request only the identify scope and store your Discord user ID, username, and avatar hash. We cannot see your Discord messages, servers, friends list, or password.

IP addresses.

Upload IPs: we automatically record the IP addresses used to upload to your account, up to 5 per account, along with when each was first seen and last used. They are stored as keyed hashes (HMAC-SHA256 with a secret key), not in plain text. An address not used for 30 days is deleted. If a 6th address is detected, the account is flagged for manual review and uploads are blocked until the review is complete.
Banned IPs: stored as keyed hashes in the same way.
Hashed IP addresses can still be personal information, and we protect them accordingly.
Request handling: your IP address is processed when you make requests, for rate limiting, security, and abuse prevention.

Uploaded files and metadata. Files you upload are stored on Cloudflare R2. We store related metadata in our database: filename, display name, size, file type, upload date, the account that uploaded it, privacy status, and custom domain used. Uploaded images may contain embedded metadata such as camera information or GPS location; we do not remove it, so please strip it before uploading.

API keys. We store only a SHA-256 hash of each API key. The raw key is shown once at creation and is never stored by us.

File passwords. For password-protected files, we store only a salted, key-stretched hash of the password (PBKDF2). We never store the password itself.

Account configuration and status. When your account last made an authenticated request (used to apply the Basic-tier inactivity rule), whether it is flagged for review, your tier, storage usage, subdomains, custom embed settings, private-file settings, and other preferences.

Domain data. For subdomains and custom domains, we store the domain names you add and their configuration. If you delegate your nameservers to us, we store and manage your domain's DNS zone and records through Cloudflare's API.

Domain sharing. If a private domain is shared between users, we store which accounts have access to it.

Ban records. If an account or IP address is banned, we store the Discord user ID, hashed IP address, the reason for the ban, and the ID of the administrator who issued it.

Request headers. We check the Origin and Referer headers of requests that change data, to protect against cross-site request forgery. We don't store these headers.

Communications and reports. If you contact us, file a copyright notice or counter-notice, submit an abuse or removal request, or report content, we keep the contents of that communication and any contact information you provide.

Cookies. We use a strictly necessary session cookie to keep you signed in. Our infrastructure provider, Cloudflare, may set strictly necessary security cookies (such as for bot detection) to protect the Service. We do not use advertising or analytics cookies.

What we do not collect. We do not use third-party analytics, advertising trackers, or tracking pixels, and we do not collect payment card data.

2. How We Use Information

We use your information only to:

Authenticate you and operate your account, API keys, and custom domains;
Store, serve, and deliver your uploads;
Enforce rate limits, storage limits, upload IP limits, and our Terms of Service;
Detect, investigate, and prevent abuse, fraud, security incidents, and illegal content, including CSAM;
Respond to your requests and to copyright, NCII, and abuse reports;
Comply with legal obligations and respond to lawful requests; and
Maintain, troubleshoot, and improve the Service's reliability and security.

We do not use your information or uploads for advertising, profiling, or training AI models, and we do not sell it.

Legal bases (EEA/UK users). We process your data to perform our contract with you (operating your account and hosting your files); for our legitimate interests in securing the Service and preventing abuse, balanced against your rights; to comply with legal obligations (such as mandatory CSAM reporting and responding to legal process); and with your consent where we ask for it.

3. Content Scanning

We use automated tools, including Cloudflare's CSAM Scanning Tool, to compare uploads against hashes of known child sexual abuse material. If content is flagged:

Access to it is blocked;
The content and associated account information are preserved as required by law (under 18 U.S.C. § 2258A, for at least one year);
It is reported to the National Center for Missing & Exploited Children (NCMEC), which may share it with law enforcement; and
The associated account is terminated.

We may also review content that is reported to us or flagged by automated systems in order to enforce our Terms.

4. How We Share Information

We share information only as described here:

Service providers. Cloudflare (hosting, R2 storage, content delivery, security, and content scanning) and Discord (sign-in). They process data on our behalf or under their own terms as needed to provide their services.
Anyone with a link. Public files, and anything visible in them or their metadata, are accessible to anyone who has the file's URL. Password-protected files are accessible to anyone who has both the link and the password.
Other users you share with. If you share a private domain with other users, they can see and use it as the sharing feature allows.
Cloudflare, for domains. When you add a subdomain or custom domain or delegate your nameservers, we send your domain name and DNS configuration to Cloudflare through its API so it can host the zone, issue TLS certificates, and route traffic.
Copyright and removal processes. If we receive a DMCA notice about your content, we may forward it to you. If you submit a counter-notice, we forward it, including your name, address, and phone number, to the person who filed the original notice, as the law requires.
Legal and safety. We disclose information to NCMEC as required by law, and to law enforcement, courts, or other parties when we believe in good faith it is required by law or legal process, or is necessary to protect the rights, property, or safety of FTS, our users, or the public.
Business transfers. If FTS or the Service is involved in a merger, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
With your consent or at your direction.

We do not sell personal information and do not share it for cross-context behavioral advertising.

5. Data Retention

Data	Kept until
Discord account data	You delete your account or it is terminated
Uploaded files and metadata	You delete them, or your account is deleted or terminated. Deleted files may remain in CDN caches and backups for up to 30 days.
Uploads on Basic-tier accounts	Deleted automatically after 180 days of account inactivity, if not deleted sooner
File password hashes	The file is deleted or made public
Last-activity timestamp	Your account is deleted
Hashed upload IPs and their timestamps	Deleted after 30 days of non-use, or when your account is deleted
Account review flag	The review is resolved, or your account is deleted
Ban records, including hashed IPs	The ban is removed
Domain and DNS configuration	You remove the domain, or your account is deleted or terminated
Domain sharing records	The share is revoked or the domain is deleted
API key hashes	The key is revoked or your account is deleted
Support, DMCA, NCII, and abuse records	As long as needed to handle the matter and comply with law
Content related to a CSAM report	At least one year, as required by 18 U.S.C. § 2258A

We may retain information longer where required by law, to resolve disputes, or to enforce our Terms, including data about accounts terminated for abuse so we can prevent re-registration.

6. Deleting Your Data

You can delete individual files from your dashboard at any time. Uploads on Basic-tier accounts are also deleted automatically after 180 days of inactivity. To delete your entire account and all associated data, email support@fts.gg from, or message us on Discord (https://fts.gg/discord) with, the Discord account linked to your Service account. We will complete deletion within 30 days, except for data we are legally required or permitted to keep as described above.

7. Your Rights

Wherever you live, you can ask us to access, correct, export, or delete the personal information we hold about you. We will respond within 30 days (45 days where local law allows).

EEA, UK, and Swiss users also have the right to restrict or object to processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your local data protection authority.

California residents. We honor the access and deletion rights described above. We do not sell or share personal information as those terms are defined under California law. Under California's "Shine the Light" law, we do not disclose personal information to third parties for their direct marketing purposes.

Nevada residents. We do not sell covered information as defined in NRS 603A.340. You may still submit a request directing us not to sell your covered information by emailing support@fts.gg, and we will record and honor it.

To exercise any right, contact us as described below. To protect your account, we verify requests by confirming you control the linked Discord account. We will not discriminate against you for exercising your rights.

8. Do Not Track and Global Privacy Control

We do not track users across third-party websites, so we do not respond differently to Do Not Track signals. Because we do not sell or share personal information for advertising, Global Privacy Control signals do not change how we process your data.

9. Security

We use reasonable technical and organizational safeguards, including TLS encryption in transit, HTTP Strict Transport Security (HSTS) and other security headers, cross-site request forgery checks, hashed API keys, file passwords, and IP addresses, upload IP limits, rate limiting, and access controls on our infrastructure. No system is perfectly secure, and we cannot guarantee the security of your information. If a breach affects your personal information, we will notify you and any relevant authorities as required by law.

10. International Data Transfers

FTS is based in the United States, and your information is processed in the United States and wherever Cloudflare operates its global network. If you are outside the United States, you understand that your information will be transferred to and processed in countries whose data protection laws may differ from yours. Where required, we rely on appropriate safeguards, such as the standard contractual clauses our providers offer.

11. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it and terminate the account. If you believe a child under 13 is using the Service, contact us at support@fts.gg.

12. Changes to This Policy

We may update this policy from time to time and will post the new version with an updated date. For material changes, we will give at least 14 days' notice through the dashboard or our Discord server before they take effect.

13. Contact

FTS LLC (Reno, Nevada)
Email: support@fts.gg
Discord: https://fts.gg/discord
Website: https://fts.gg