Privacy

Drop does not require an account. Direct transfers use an encrypted WebRTC connection and do not pass through our storage. Session signalling stores only short-lived room identifiers, hashed access tokens and connection identifiers for up to two hours.

Session records expire automatically after two hours. We do not inspect, index, sell or use transferred content for advertising.

Operational security logs are minimized and never contain access tokens or URL fragments.