Privacy
Last updated 2 October 2026
Hazelwing (hazelwing.com) is an invite-only service for syncing folders and sending files by email. It is run by one person, Alfred Westerveld, in the Netherlands, who is the controller of the data described here. This page says what is stored and why.
What we store
- Your account: your email address, and the devices and browsers you have signed in with.
- Your files: the folders and files you sync, their names and version history, and who you share a folder with.
- Transfers: files you send by email, the recipients' email addresses and the optional message you write. A recipient link expires after 1, 7 or 30 days (7 by default), and the files are then removed.
- The waiting list: the email address you enter, plus a coarse network prefix of your IP address (for example the first two numbers), never the full address.
- Passkeys: if you add one, the public key only. Biometrics and private keys never leave your device.
- Sign in with Google: if you use it, your Google account
ID and email address (scopes
openid email). We never ask for your contacts, Drive or anything else. - Security logs: operational logs with the network prefix of an IP address and only the domain part of an email address, used to spot abuse and fix faults.
Why, and who handles it
To run the service you asked for: sign you in, sync and deliver your files, and send you email. Files and records are stored on Cloudflare, which acts as our processor, and sign-in and transfer mail is delivered through Cloudflare's email service. Cloudflare runs a global network, so data may be processed outside the EU under its safeguards. We do not sell data and do not share it with anyone else.
Cookies and tracking
No ads, no analytics, no tracking. The public pages set no cookies. When you sign in to the web app a session cookie keeps you signed in for up to 7 days; it is strictly necessary and used for nothing else. A transfer protected by a PIN may set a short-lived cookie scoped to that transfer, for the same reason.
How long we keep it
- Files you delete are fully purged after 30 days.
- Transfers are removed after they expire (1, 7 or 30 days).
- Sign-in links work once and expire after 15 minutes.
- Account data stays until you ask for deletion. Waiting-list entries stay until you ask for removal.
Your rights
You can ask for a copy of your data, a correction, an export or deletion of your account and everything in it. Write to alfredwesterveld@gmail.com and you will get an answer within a month. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).