Privacy

Updated 5 October 2026

stepto.link is run by Yuanzheng Yang in Sydney, Australia. Questions or requests: hello@stepto.link.

What is stored when you send a file

• The STEP file, and the 3D preview your browser makes from it.
• The title, message and notes you add, the file name and size, and when the link expires.
• How many times the link has been opened and downloaded.

Your account

You need an account to send a file. Your client does not need one to open it. Signing in uses your Google account: Google tells the site your name, your email address and an account number. Nothing else is asked for: the site cannot see your password, contacts or files at Google.

Those three things are stored, along with your plan, any access code you used, and which links are yours. They are used to sign you in and to show your links on your devices. They are not shared, sold or used for advertising.

If you pay for Pro

Payment is taken by Stripe through its Link checkout, which is the seller on your receipt. The site never sees your card. It stores the customer and subscription numbers Stripe gives it, whether the plan is active, and the date it renews.

Cookies

None unless you sign in. Signing in sets two: one keeps you signed in for 60 days, the other tells pages that you are signed in. A third lasts ten minutes while you are at Google. There are no analytics, no ads and no tracking.

What is not collected

• Your IP address is not stored. To limit abuse, links are counted per network address per day, using a scrambled value that cannot be turned back into the address once the day is over.
• Nothing is recorded about the people who open a link, beyond the two counts above.

Who can see a file

Anyone who has the link. Links are long random addresses. They are not listed anywhere, and search engines are told not to index them. Files are not sold, shared or used for anything else. A file would only be opened to look into a report of abuse, or if the law requires it.

How long it is kept

A link and its files are kept until the link expires, or until you delete it. That is up to 7 days on Free and up to 1 year on Pro. Expired links are removed within about an hour. An account is kept until you delete it. The hosting provider’s database backups can hold these details, but not the files, for up to 30 days after that.

Where it is kept

On Cloudflare, the hosting provider. Files are stored in its Oceania region. Cloudflare carries the network traffic and keeps its own security logs under its own privacy policy. Google is involved only when you sign in, and Stripe only when you pay.

In your browser

The browser you send from keeps a private key for each link it made. It stays on your device, and is removed when you sign out.

Your choices

Delete a file and its link at any time from your account. Delete your account from the account page: that removes the account, its links and their files straight away. Or email hello@stepto.link and it will be done for you. You can also ask what is held about you or about a link.

Changes

This page is updated whenever any of this changes.