Four short pages in one: what you agree to, what we hold (almost nothing), the closed beta, and how to report a link.
Last updated 4 September 2026
Cubit lets you send files. On heycubit.com you drop a file, it is encrypted in your browser, and you get a link. Whoever opens the link before it expires can download the file. The Cubit apps for Mac, Windows and iPhone do the same between your own devices and your contacts. The service is run by Isac Ehrstedt, Sweden ("we", "us").
By using Cubit you agree to these terms. If you do not agree, do not use it.
You keep every right to what you send. We claim none. We ask for exactly one permission: to store and transmit the encrypted file so that the person you sent it to can get it. That is the whole licence, and it ends when the link expires or is deleted.
We cannot read what you send. Files are encrypted on your device before they leave it, and the key lives in the link, never on our servers. This is a design fact, not a promise of good behaviour: we do not have the key.
A web link lasts for the time you chose when you made it (one, three or seven days today). After that the file is deleted from our storage and the link is dead. Keep your own copy; Cubit is a way to hand a file over, not a place to keep it.
Do not use Cubit to send anything you have no right to send, or anything that is illegal where you are or where the receiver is. In particular:
We cannot see inside your files, so we act on what we can see: reports, patterns of abuse, and the law. If a link is reported and we have reason to believe it breaks these rules, we delete it. We may also refuse or block use of the service without notice.
Cubit is provided as it is and as it is available. We work to keep it up and fast, but we do not promise that it is always available, error-free, or that a file always arrives. Links can fail, storage can fail, we can be down. Do not rely on Cubit as your only copy of anything.
We may change, pause or stop the service, or any part of it, at any time. We will try to say so in advance when we can.
To the extent the law allows, we are not liable for indirect or consequential loss, lost data, lost profit, or any loss arising from your use of Cubit or from a file someone sent you through it. Where liability cannot be excluded, it is limited to the amount you paid us for the service in the twelve months before the claim, which for the free service is nothing.
Nothing here limits liability for fraud, or for anything the law does not let us limit.
You are responsible for the files you send and for having the right to send them. If someone brings a claim against us because of something you sent, you agree to cover the loss and the reasonable costs that claim causes us.
We may update these terms. The date at the top tells you when. Using Cubit after a change means you accept the new version.
These terms are governed by Swedish law. Disputes go to the courts of Sweden, unless the law where you live gives you the right to something else.
Questions about these terms: isac@heycubit.com.
Last updated 5 September 2026
When you send a file through heycubit.com we store the encrypted file until the link expires (one, three or seven days), then delete it. We cannot decrypt it. Next to it we store the encrypted size, the expiry, and a hash of the throwaway key the link was made with. Nothing that names you.
The Cubit apps send files between devices through the same relay. What passes through is encrypted end to end; the relay sees a device's public key, an encrypted envelope and its size, and holds it only until the receiving device has picked it up.
If you previously signed up for a launch email, or chose that option when creating your account, we keep that address, the platform you asked about, and the date, and we use it for exactly one mail: the one that says the app is out. Then we delete the list. Write to isac@heycubit.com and we take you off it any time before that.
The beta waitlist is separate from the public launch list. We first send a one-time code to verify your email. Temporary code and verification records expire after 15 minutes; their stored secrets are hashed. Verification alone does not register you, create an account or grant beta access. When you join the list after verification, we keep your email address, verification date, chosen platform, signup date and your explicit beta-availability consent, including its date and wording version. We use this information only to contact you about a beta place. Joining does not grant access. Write to isac@heycubit.com to ask us to remove your registration.
An account is a list of your own devices, signed by a key that never leaves them. On our side we hold: a hash of your address, never the address itself; the public half of the key that signs the list; for each device on the list, its public key, the name that device gave (the website gives none) and the day it joined; the date the account was made; how you signed in (a link in the mail, from the website or from an app); the language your browser sent; and a two-letter country — which our host works out from your connection, not something your browser told us. We keep that record until you ask us to delete it: write to isac@heycubit.com and we do it by hand. A button of your own comes later.
The sign-in mail is sent through Resend, our mail provider, which sees your address at that moment and nothing else. Its link and its six-digit code work once and for fifteen minutes; after that they are gone, and the count of wrong codes goes with them. Saying yes to hearing about new features puts your address on the launch list above — nothing about that is kept on the account.
heycubit.com keeps a few small things in your browser's own storage: the link lifetime you last picked, whether you have visited before (so the first visit gets a particular colour), and whether you already joined the launch list, and, once you sign in, this browser's own device key and the account's ring key — a spare ring key too, while a sign-in is still in flight — plus your email address in plain text, so the page can name the account you are in. The dashboard keeps its own passphrase there as well. They never leave your browser. Signing out removes the keys and the address; clear your site data and everything here is gone.
Cubit runs on Cloudflare (Workers, R2 storage, Pages). Like every hosting provider, Cloudflare keeps short-lived request logs that include IP addresses, for security and to keep the service running. We keep aggregate counts of use (how many links were made and opened per day, how many bytes, how many requests failed). Those counts contain no names, no file names and no contents.
Under the GDPR you may ask what personal data we hold about you and ask for it to be corrected or deleted. In practice we hold almost none: we cannot connect a link to a person, and an account holds a hash of your address rather than the address. If a link of yours is live and you want it gone, write to us with the link and we delete it. Contact for privacy questions: isac@heycubit.com. You may also complain to the Swedish Authority for Privacy Protection (IMY).
Cubit is not meant for children under 13, and we do not knowingly collect anything from them. We collect almost nothing from anyone.
Version 2026-09-29
If you join the Cubit closed beta with an invite code, we store your email address, the identifier of your device key (the public half of a key made on your device), the country you connect from (coarse, country level only), and how much you use Cubit (usage volume per tester).
To run the beta, to stop misuse of invite codes, and to tell testers about the beta: new builds, requests to update, and changes to their access. We store your email address in the clear so we can track beta testers and contact them about the beta. This applies to testers only. The email addresses of ordinary users are not stored this way.
A separate box, unticked by default, lets you ask for one email when Cubit launches. You can join the beta without ticking it. If you do not tick it, we do not use your address for the launch email.
We do not share your email address with anyone except our mail provider, Resend, which sends the mail for us. We do not sell it.
Write to isac@heycubit.com and we delete what we hold about you as a tester. Every email we send you has an unsubscribe link. Using it stops those emails.
Last updated 4 September 2026
If a Cubit link is being used to share something illegal, or something you hold the rights to and did not allow, tell us. We cannot see inside files, so your report is how we find out.
Email abuse@heycubit.com with:
1. the full Cubit link, exactly as you received it (the part after # is what identifies it);
2. what the problem is, in a sentence or two;
3. if it is a rights claim: what you own, and a way to reach you.
What happens next: we look at the report, and if we have reason to believe the link breaks our terms or the law, we delete the file. A deleted link stops working at once, everywhere. We answer every report, usually within a day. For a rights claim we may tell the sender that a report was made, without saying who made it.
Security researchers: if you found a weakness in Cubit, write to isac@heycubit.com. We would rather hear it from you than read about it.
Cubit is made in Sweden. Back to the start.