Storage and quota

The quota#

A fixed number of gigabytes, set by the operator. There is no billing by usage here and there never will be: that is the reason this exists rather than a missing feature.

Uploads stop at 100 percent. Delivery never stops. A full quota refuses new files and keeps serving every file already stored, because breaking existing links punishes players for an operator's capacity planning.

Warnings fire the first time you cross 80, 90 and 100 percent, once each rather than once per upload.

The refusal at 100 is not configurable. A full disk stops the database, not just uploads, so the ceiling is a safety control rather than an accounting one.

Server assets (logos, interface images, sounds) are not counted against the quota and are never purged by retention: see Server assets.

Your own FTP server#

If the feature is enabled you can point us at your own server. The files land on your disk, your quota here stops applying, and you pay for the bytes.

You give us credentials and nothing else. We fetch what we wrote there and serve it, from our hostname or from your own once you have verified one. There is nothing to expose publicly and no web server to run in front of your files.

The FTP server itself has to be reachable from the internet. A private address, a name that resolves to one, or a bare name such as ftp is refused when you save. Your saved password is only ever sent back to the server it was typed for, so changing the host, the port, the username or FTPS asks for it again. When the connection check fails, the page says which step failed (host not reachable, connection refused, no answer in time, sign-in refused, test file not written) and what to check next.

That used to be a choice, and the other option asked you for a public URL your own server answered on. It was removed because it defeated the point: somebody who has to stand up and maintain a web server has not been saved any work, and most storage of this kind speaks FTP and nothing else. It also bypassed your custom domain, stopped your delivery statistics at the upload, and made your outbound traffic unmeasurable.

Files are mirrored locally after the first request. FTP is a storage protocol, not a delivery one: a fresh session per thumbnail is slow, and it answers a range request with the whole file, so scrubbing a video would refetch it from the start. The first request for a small file fetches and caches it, and every request after that is served from local disk with full range support. A file larger than eight megabytes is fetched by a background worker instead, so the first request for one answers "come back in a moment" rather than holding a connection open for the length of the transfer.

Why FTP is verified after every write#

FTP has no server-side checksum, its connections are temperamental, and a passive-versus-active mismatch can fail in a way that looks like success. Every write is followed by a size comparison, and a mismatch discards the file.

Without that check a truncated upload produces a URL that answers 200 with a corrupt file, and it surfaces weeks later as a broken image nobody can trace.

Use FTPS. Plain FTP sends your username and password in clear text, readable by anything between us and your server, and that password is usually reused.

Egress, and when it cannot be known#

Outbound bytes are read from the web server's own access log, because the file is handed to nginx and the application never sees how many bytes actually left. A range request, which is what a phone does when it scrubs a video, sends only a slice, so counting the file size at request time would overstate egress by an order of magnitude.

Every byte passes through us, whichever storage it came off, unless the operator of this instance has set a bucket to send players straight to it: those bytes leave from the bucket, and an organisation with files there reads not measured (its deliveries are still counted). Otherwise the figure is attributable for everybody, and what it still depends on is the operator having pointed the reader at that access log. Where they have not, the dashboard says not measured rather than showing zero, because a zero on that tile reads as an outage rather than as a missing configuration.

Retention#

Nothing is deleted automatically by default. A profile picture inside a phone is expected to stay, and a dead link in a roleplay server is not something anyone diagnoses.

Two optional modes: delete a fixed number of days after upload, or delete after a number of days without a single request. The second saves the most space and can catch a rarely viewed avatar, so it is the one to think about before enabling.

Any file can be marked to keep forever, from the library or over the API.

Deleting sends a file to a recycle window for seven days. The URL stops resolving immediately, which is what delete has to mean, and the bytes survive long enough for a mistake to be noticed.