Socorin

Privacy Policy

Effective

Socorin is an open-source app for taking screenshots and recording the screen. The app, the website socorin.com and the file sharing service behind the app's share links are run by the maintainers of the Socorin project, called "we" below. This page describes what each of the three does with your data.

There are no accounts, and the app does not report how you use it. A screenshot or a recording leaves your computer only when you choose to upload it to get a share link.

The desktop app

The app has no sign-in and contains no analytics, telemetry or crash reporting. Screenshots and recordings are saved as files on your disk or copied to your clipboard. The app does not send them anywhere on its own.

The app uses the network in two cases:

  • Once a day it fetches https://socorin.com/version.json to see whether a newer version exists. The request names the app version and carries no install ID or other identifier. You can switch the check off under Settings → Updates. When you install an update, the app downloads it from socorin.com.
  • It uploads a file when you ask it to: with Upload & copy link, with Stop & upload, or after every capture if you chose Upload and copy the link immediately under Settings → After capturing.

The update check always goes to socorin.com. Uploads go to the server named under Settings → Share, which is socorin.com unless you change it, and this policy covers socorin.com only. Like any request on the internet, both arrive from your IP address, and they pass through Cloudflare on the way (see The website).

When you upload a file

An upload sends the file, its type and size, a SHA-256 checksum, a file name, the app's version and your operating system (macOS, Windows or Linux), and a random install ID. The server hands that ID to the app the first time you upload. It is not derived from your device or from anything about you, and its only purpose is to let the server limit or block an install that abuses the service. Settings → Share → Reset install ID makes the app forget it and ask for a new one at the next upload.

The server keeps:

  • The file, under a random ID. Images are re-encoded when they arrive, which removes EXIF and other embedded metadata such as a GPS position. Videos are stored exactly as uploaded, including any metadata inside the video file. The file name is held only while the upload is in progress, for at most an hour, and is not stored with the file.
  • A record of the file: its type, size, pixel dimensions, checksum, upload and expiry time, the install ID, the IP address the upload came from, and a hash of the delete token. The token itself is not stored.
  • A record of the install: the install ID, the operating system, the app version, and when the install first registered and last uploaded. There is no name, email address or device identifier in it.

Files are kept for 60 days from the upload and then deleted automatically; a cleanup job runs every hour. A file can be at most 15 MB. If the server runs out of space, it removes the oldest files early to make room.

Deleting an upload

Each link comes with a delete token that the app keeps on your computer. While the app still has it, Delete from server takes the file down, both in the Link copied popover and under Settings → Share, and the file is removed from the server right away. The app remembers your 20 most recent links. For a link it no longer remembers, wait for the expiry or write to [email protected] with the link.

Deleting removes the file. The record of the file described above, including the checksum and the IP address, stays in our database, and at the moment nothing erases these records on a schedule. We use them to look into abuse. Install records stay in the same way, also after Reset install ID. When we block a file for breaking the Terms of Use, its checksum stays on a blocklist so that the same file cannot be uploaded again.

Rate limits and your IP address

The service is free and open to anyone, so the server counts requests to keep one source from using it up. It counts uploads, uploaded bytes and new install registrations per IP address, uploads per install ID as well, and views of shared files per IP address. The counters live in an in-memory store (Redis) and are keyed by the IP address as it is, unhashed. They expire on their own: the per-minute ones after about two minutes, the hourly and daily ones within about a day. An upload in progress is also tracked with its IP address until it finishes, for up to an hour.

Anyone who has a share link can view and download the file. The link contains a random 22-character ID, the page asks search engines not to index it, and we do not list shared files anywhere. That makes a link hard to guess. It does not make the file private: there is no password, and the file is not end-to-end encrypted, so we are technically able to open it.

Do not upload passwords, keys, identity documents or anything else that must stay secret. Cover sensitive parts with the pixelate tool before you upload.

When you paste a link into a chat app, that app's servers usually fetch the page and the file to build a preview.

The website

Everything on socorin.com, including the addresses the app talks to, is delivered through Cloudflare, which works as our content delivery network and protects the site from attacks. To do that, Cloudflare processes every request, including your IP address, the address you asked for and details about your browser, under its own privacy policy. Our own web server may keep ordinary access logs (IP address, time, requested address, browser identification) for a limited time, to keep the service running and to look into abuse.

We use Cloudflare Web Analytics to count visits and measure how fast pages load. It is a small script that, according to Cloudflare, sets no cookies and does not fingerprint or follow visitors across sites. What we get from it are totals. There is no advertising on the site and no other tracker.

The site sets one cookie of its own, socorin-locale, which remembers whether you read the site in Vietnamese or English. It lasts a year and is used for nothing else.

When you open an address without a language in it, such as socorin.com or a share link, and you have no language cookie yet, the server looks up the country of your IP address to choose between Vietnamese and English. The lookup runs against a table on our own server. Your IP address is not sent to anyone for it, and it is neither logged nor stored.

IP address data powered by IPinfo. The country table is the IPinfo Lite database, used under the CC BY-SA 4.0 license.

Who we share data with

We do not sell your data, use it for advertising, or hand it to anyone else. Cloudflare handles it on our behalf as described above. We disclose information only when the law requires us to, for example in response to a valid order from a court or an authority.

Access and deletion requests

Because there are no accounts, we cannot find your files by your name or email address. Write to [email protected], include the share link, and tell us whether you want a copy of what we hold about that upload or want it deleted. We may ask for a detail that shows the upload was yours, such as when you made it or the install ID shown under Settings → Share.

Children

Socorin is a general-purpose tool and is not aimed at children. We do not knowingly collect personal information from children, and since there are no accounts we never ask anyone's age. If a child has uploaded something that should come down, send the link to [email protected].

Changes and contact

When this policy changes, we update this page and the date at the top.

Questions about privacy go to [email protected]. Reports about a shared file go to [email protected]. The app's source code is public on GitHub, so everything this page says about the app can be checked there.