diff --git a/code/app.py b/code/app.py
index 04d1793..e6ff4e8 100644
--- a/code/app.py
+++ b/code/app.py
@@ -28,6 +28,7 @@ from utils import (
     db_add_download,
     db_get_file,
     db_delete_file,
+    db_maintenance,
 )
 
 __MINI_FLEES_VERSION__ = "20230818.0"
@@ -109,6 +110,12 @@ def ls():
     return "\n".join(file_list()), 200
 
 
+@app.route("/maintenance", methods=["GET"])
+def maintenance():
+    secret = request.headers.get("Secret", "")
+    if secret != app.config["ACCESS_TOKEN"]:
+        return "Error", 401
+    return db_maintenance(), 200
 
 
 @app.route("/dl/<token>/<name>", methods=["GET"])
diff --git a/code/utils/files.py b/code/utils/files.py
index b7d5d19..7461cd4 100644
--- a/code/utils/files.py
+++ b/code/utils/files.py
@@ -7,6 +7,7 @@ import json
 import stat
 import time
 import sqlite3
+import shutil
 from .misc import *
 from .crypt import *
 
@@ -41,6 +42,7 @@ def db_get_file(token, name):
         (token, name),
     ).fetchone()
 
+
 def db_get_files():
     db, c = get_db()
     return db.execute(
@@ -78,39 +80,45 @@ def db_add_download(token, name):
     return
 
 
-def file_autoremove():
+def db_maintenance():
+    messages = []
     db, c = get_db()
     rows = db.execute(
         """
             select
               token, name
             from files
-            where expires > ? or downloads >= max_downloads
+            where expires < ? or downloads >= max_downloads
             """,
         (int(time.time()),),
     )
     deleted_tokens = []
     for row in rows:
-        try:
-            os.remove(os.path.join(os.getenv("DATAFOLDER"), row[0], row[1]))
-        except FileNotFoundError:
-            pass
-        try:
-            os.rmdir(os.path.join(os.getenv("DATAFOLDER"), row[0]))
-        except FileNotFoundError:
-            pass
-        deleted_tokens.append(row[0])
+        deleted_tokens.append((row[0],))
+        messages.append(f"Deleting DB {row[0]}/{row[1]}")
     if len(deleted_tokens) > 0:
         db, c = get_db()
-        for token in deleted_tokens:
-            c.execute(
-                """
-                    DELETE FROM files WHERE token = ?
-                """,
-                (token,),
-            )
-        db.commit()
-    return
+        c.executemany("DELETE FROM files WHERE token = ?", deleted_tokens)
+        if c.rowcount > 0:
+            db.commit()
+
+    subdirs = next(os.walk(app.config["DATAFOLDER"]))[1]
+    db, c = get_db()
+    for d in subdirs:
+        keep = db.execute(
+            "SELECT 1 FROM files WHERE token = ?",
+            (d,),
+        ).fetchone()
+        if not keep:
+            try:
+                for fname in os.listdir(os.path.join(app.config["DATAFOLDER"],d)):
+                    os.remove(os.path.join(app.config["DATAFOLDER"],d,fname))
+                    messages.append(f"Deleting file {d}/{fname}")
+            except Exception:
+                pass
+            shutil.rmtree(os.path.join(app.config["DATAFOLDER"],d), ignore_errors=True)
+            messages.append(f"Deleting folder {d}")
+    return "\n".join(messages)
 
 
 def file_age(path):
@@ -146,24 +154,16 @@ def file_details(token, name):
     except FileNotFoundError:
         return {}
 
-def file_list():
 
+def file_list():
     files = list(db_get_files())
     details = []
-    maxlen = 4
-    for file in files:
-        maxlen = max(maxlen, len(file[1]))
-    details = []
-    details.append(
-        "Added/Expiry  DL/MaxDL  URL"
-    )
+    details.append("   Added/Expiry     DL/MaxDL  URL")
     details.append("=" * 75)
     for file in files:
+        url = f"{app.config['PUBLIC_URL']}/dl/{file[0]}/{file[1]}"
         details.append(
-            " ".join((
-            str(file[2]),str(file[3]),str(file[4]),str(file[5]),
-            f"{app.config['PUBLIC_URL']}/dl/{file[0]}/{file[1]}"
-            ))
+            f"{file_date_human(file[2])}/{file_date_human(file[3])} {file[4]:4d}/{file[5]:4d} {url}"
         )
 
     return details
diff --git a/code/utils/misc.py b/code/utils/misc.py
index 0c862e3..40f06f9 100644
--- a/code/utils/misc.py
+++ b/code/utils/misc.py
@@ -3,6 +3,10 @@ from flask import current_app as app
 
 
 def file_date_human(num):
+    return datetime.fromtimestamp(num).strftime("%y-%m-%d")
+
+
+def file_time_human(num):
     return datetime.fromtimestamp(num).strftime("%y-%m-%d %H:%M")
 
 
diff --git a/test/run-tests.sh b/test/run-tests.sh
index 8961dde..86e7e4e 100755
--- a/test/run-tests.sh
+++ b/test/run-tests.sh
@@ -148,3 +148,20 @@ if true; then
         -H "Secret: dff789f0bbe8183d3254258b33a147d580c1131f39a698c56d3f640ac8415714" \
         "$ROOTURL"/ls
 fi
+
+if true; then
+    pv "$SMALL" | \
+        curl -fL -w "\n" -F file="@-" -X POST \
+        -H "Name: $SMALL" \
+        -H "Max-Downloads: 4000" \
+        -H "Expires-Days: -5" \
+        -H "Secret: dff789f0bbe8183d3254258b33a147d580c1131f39a698c56d3f640ac8415714" \
+        "$ROOTURL"/upload
+
+
+    curl -fL -w "\n" \
+        -H "Secret: dff789f0bbe8183d3254258b33a147d580c1131f39a698c56d3f640ac8415714" \
+        "$ROOTURL"/maintenance
+fi
+
+