xtrasauce

Drop files. Share instantly. Gone in 24h.

House Rules

  1. 1.

    You can upload whatever you want. Common-sense disclaimer: please do not upload malware, stolen dumps, doxx, private personal information, revenge slop, or anything illegal or "technically not illegal if you squint". If it would make a lawyer, a cop, or your future self sigh deeply, maybe do not upload it.

  2. 2.

    I am not responsible for whatever damage a file causes after it gets uploaded. That said, bad actors still need to be watched and moderated, but one person cannot be everywhere at once, yeah?

  3. 3.

    If you honestly do something BAD then I shall smite you even if it means cooperating with the law. On the less dramatic side: once a file is deleted, whether by you or by administration, all data related to that file is purged without a trace.

What we log

This is a file dump, not a bank. Nothing about your file contents gets logged. I do run standard site stats through Vercel (page views, country, referrer, browser) so I can tell if the site is alive or on fire — no ads, no data selling, no profiling, no dossier on you. And yeah, there's a dumb third-party hit-counter badge on the landing page (it just shows a number; it doesn't read anything else). Your IP is not private information — every server you touch on the internet gets it. Ours is used for rate limiting and abuse handling, and isn't kept beyond the operational window. If you need privacy, you're using the wrong tool.

  • Session key (hashed)sha-256 hex digest
  • IP addressrate-limit window, no long-term storage
  • Upload / delete timestampsISO 8601, UTC
  • File size + MIME typeoperational accounting
  • Storage key + bucket IDB2 path, needed to serve/remove
  • Expiry timestampscron uses these for cleanup
  • Rate-limit countersRedis, TTL-bound
  • Auth attemptssuccess / failure, no payload content
  • Server errors (5xx)stack + route, debug aid only

Session keys are hashed (sha-256) before persistence; the full digest is stored (shortened forms you might see on screen are display-only). IPs are stored only for rate-limit accounting and are not retained beyond the rolling window.

If you got a complaint (like takedown or smtg), come get me at: abuse@extrasauce.lol