Security at Reafile

The short version

• Editing, converting and compressing happen inside your browser, so your file usually never leaves your device.
• If you save a file to your account, it goes into a private, encrypted storage space that only you can access.
• If you use an AI tool, only that file is sent over an encrypted connection to perform that one operation, then the result comes straight back to you.
• We never sell your data, never train AI on your files, and never look at them.

1. When you edit a file, it stays on your device

Reafile's editors run on WebAssembly, a technology that lets near-native code run directly in your browser, inside a sandbox enforced by the browser itself. When you crop an image, convert a spreadsheet, or trim an audio track, the work happens in your computer's memory. Nothing is uploaded to run these tools. You could disconnect from the internet mid-edit and most operations would still complete.

The file lives in temporary browser memory only for the duration of your session; it is not written to our servers or cached anywhere by us.

2. When you save a file to your account

If you choose to save a file (so you can reopen it later from any device), it is uploaded over an encrypted TLS connection to your personal cloud space, hosted on Supabase (a SOC 2 Type II certified infrastructure provider, with data encrypted at rest in the EU).

Every user's files are stored in a folder scoped to their account, protected by row-level security: the database itself enforces that only your authenticated session can read, list, or delete your files. This isn't an application-level check that could be forgotten. It is a rule enforced by the storage layer on every single request. Not other users, and not our team through the app, can browse your saved files.

Deleting a file from your history deletes it from storage. Deleting your account removes all of it.

3. When you use an AI tool

Some AI features (like background removal or image upscaling) need more computing power than a browser can provide. When you use one, the file you're working on is sent over TLS to our server, which forwards it to a specialized AI processing provider to perform that one operation only. The result is returned directly to your editor.

We keep no copy of the input or the output on our servers, your files are never used to train AI models, and nothing is shared beyond what is strictly needed to run the operation you asked for. If you don't use AI tools, none of this happens and everything stays local.

4. Your account and sign-in

Authentication is handled by Supabase Auth. Passwords are never stored in readable form, only securely hashed. If you sign in with Google or GitHub, we never see your password at all; we only receive your email and name. All authentication traffic is encrypted with TLS 1.3, and sessions use short-lived, automatically refreshed tokens.

5. Payments

Subscriptions are processed by Stripe, a PCI-DSS Level 1 certified payment provider. Your card number is entered on Stripe's secure checkout and never touches our servers. We only receive confirmation of your plan.

6. Anonymous analytics

We use PostHog to understand which features are used and where errors happen: page views and feature clicks tied to a random anonymous ID. It never sees file names, file contents, or anything that identifies you personally.

7. What we cannot do, even if we wanted to

• We can't read files you edit locally, because they never reach us.
• We can't browse your saved files, because row-level security binds access to your session, not ours.
• We can't see your password, because it's hashed before storage.
• We can't charge your card directly, because Stripe holds the payment details, not us.

8. You stay in control

You can delete any saved file at any moment, and you can delete your account entirely. All personal data and stored files are permanently erased within 30 days. For anything else, our Privacy Policy details your rights under GDPR.

9. Found a vulnerability?

We take reports seriously. If you believe you've found a security issue, please email privacy@reawon.comand we'll respond quickly and credit responsible disclosure.