Addressed privacy policy

Last updated: 2026-10-19

What Addressed is

A Windows app that protects files and folders with Windows Hello, made by Addressed.me. Protecting and opening your own files happens only on your PC: the files themselves, their contents and their passwords are never sent to us. The only data we receive is described under Sharing a file below, and only when you share one.

Sharing a file

When you share a protected file, the Addressed share service (run by us on Cloudflare) stores: a random ID for the share, the email addresses you named, any end date you set, and one piece of the file's key. The service cannot open the file: that piece is useless without the file, which you send yourself.

When someone you named opens the file at app.addressed.me/open, they sign in with Microsoft or Google (or a passkey they saved there) so the service can check the email address. The service stores the time of each open, the email address, how they signed in and the IP address it came from, and shows that list to you, the file's owner. A saved passkey is stored as its public key and the email address it belongs to. Sign-in tokens are checked and then discarded, never stored. To slow down abuse, the service also counts requests per IP address for two minutes.

This data is kept until you ask us to delete it. Taking someone off a share stops their access at once but keeps the record of their past opens for the owner.

Microsoft and Google sign-in on the open page

The open page asks Microsoft or Google only for the email address and the fact that it is verified (openid email). Nothing else from the account is requested, read or stored.

Google Drive backup

Addressed asks you to sign in to Google once and backs up every file password to your own Google Drive. It asks Google only for the drive.appdata permission: access to a hidden folder that belongs to Addressed in your Drive. It cannot see, read or change any of your other Drive files.

For each protected file, that folder holds one small record: a random tag that identifies the file, the file's name, its password and the date it was protected. The record is stored by Google under your account and is read back only by Addressed on your PC, when you ask it to recover a file's password.

The Google sign-in token is kept on your PC, sealed with your Windows Hello. It is never sent anywhere except to Google.

Google user data

Addressed's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data is used only to back up and recover your file passwords. It is not sold, not shared with anyone, not used for advertising, and not read by any person.

Removing your data

Remove Addressed's access at myaccount.google.com/permissions, or under Google Drive > Settings > Manage apps. Removing it from Manage apps deletes the hidden folder and every backed-up password in it, so files whose passwords you don't have elsewhere can then be opened only on a PC whose Windows Hello still holds them.

To delete a share, its open records or a saved passkey from the share service, email us from the address involved (below); we delete it within 30 days.

Contact

Questions: privacy@addressed.me