Scope and contact
Ultra is a pre-release file-transfer service operated by egomonk. Questions and data-rights requests can be sent to contact@egomonk.com. Do not email file payloads, access tokens, passcodes, private keys, or full share links.
Data categories and purposes
| Category | Purpose | Typical location |
|---|---|---|
| Transfer payloads | Store or relay a transfer until expiry or deletion. | Cloudflare R2 or short-lived Worker/Durable Object transfer state. |
| Transfer metadata | Address, authorize, resume, verify, expire, and clean up transfers. | Cloudflare KV, Durable Objects, and R2 multipart state. |
| Account and authentication data | Send magic links, maintain finite sessions, and manage account-scoped controls. | Cloudflare KV/Durable Objects, EmailIt, and the recipient mail system. |
| Operational telemetry | Diagnose reliability, integrity, capacity, abuse, and exact-release regressions. | Cloudflare runtime logs, bounded KV records, and a redacted Better Stack copy when configured. |
| Security and audit records | Rate limiting, quota enforcement, abuse response, and owner-scoped accountability. | Cloudflare KV and Durable Objects. |
| Webhook delivery records | Deliver signed lifecycle events with bounded retries and dead-letter handling. | Cloudflare KV and the configured HTTPS destination. |
Ultra does not sell personal data or use transfer data for behavioral advertising.
Encryption and content visibility
| Surface | Protection | What Ultra can process |
|---|---|---|
| Live Pipe and Hybrid browser paths | Browser AES-256-GCM E2EE plus TLS. | Routing, size, expiry, and operational metadata; not plaintext payload bytes. |
| Browser encrypted folders | Browser E2EE plus TLS when the issued plan requires encryption. | Folder/file structure and transfer metadata; not plaintext encrypted file bytes. |
| Turbo and transport-only plans | TLS in transit and provider-managed encryption at rest. | The service path is not browser E2EE and may process payload bytes to operate the transfer. |
| Direct R2 | HTTPS directly to signed provider endpoints; browser E2EE only when the selected client path encrypts before upload. | Cloudflare stores ciphertext for E2EE paths and uploaded bytes for transport-only paths. |
| API, SDK, CLI, MCP, and retired TUS/legacy endpoints | TLS for active interfaces; no blanket browser-E2EE promise. Retired endpoints are unavailable. | Inputs and payload bytes required by an active invoked operation. |
| Metadata and logs | TLS and provider-managed encryption at rest; application redaction for external telemetry. | Bounded operational fields. Credential, filename, email, request-path, and URL fields are redacted before external delivery; raw payloads and URL fragments are not intentionally included. |
Retention and deletion
Selectable transfer windows include 30 minutes, 1, 2, 4, 6, 24, and 72 hours, and one week. Expiry makes content ineligible for continued use; asynchronous cleanup and provider lifecycle controls may delete underlying state later. Ultra does not currently promise immediate erasure at the expiry timestamp.
Operational, audit, authentication, webhook, and provider records use separate bounded policies. Exact Better Stack and EmailIt retention and deletion handling are not yet verified and must be resolved before stable launch.
Access, export, correction, and deletion
Authenticated account export and account closure controls exist in the candidate. A request may also be sent to contact@egomonk.com. Ultra must verify account control before acting. Transfer payload export is performed through the normal authorized download path; account exports intentionally exclude payload bytes and secrets.
Jurisdiction-specific rights, legal bases, response periods, and appeal routes remain subject to legal-owner approval. Ultra will publish that handling before stable production.
Processors and locations
The current architecture uses Cloudflare for compute, storage, state, and static delivery; EmailIt for authentication email; Better Stack for optional redacted telemetry; and recipient mail systems or user-configured webhook destinations where applicable. Exact subprocessors, contractual roles, and processing/storage regions have not yet been provider-verified for launch.
Security and abuse
Ultra uses least-data telemetry, bounded fields, capability-based access, finite expiries, and browser E2EE on explicitly identified paths. E2EE also limits payload inspection. Reports are handled through the abuse process; security vulnerabilities follow the published security contact.