Privacy

Drop does not require an account. Direct transfers use an encrypted WebRTC connection and do not pass through our storage. Session signalling stores only short-lived room identifiers, hashed access tokens and connection identifiers for up to two hours.

Session records expire automatically after two hours. We do not inspect, index, sell or use transferred content for advertising.

Usage analytics

We use a random browser identifier to count visits, sessions, transfers, event-page visits and completed uploads. We retain first-touch campaign or referral source, browser timezone, language and broad device type for up to 400 days. We do not store precise location, IP address, participant details or transferred filenames in product analytics.

Advertising

Drop uses Google AdSense. Google and its advertising partners may use cookies or similar technologies and process information such as your IP address, browser or device details, and interactions with advertisements to provide, measure and protect advertising. Transferred file contents are not provided to advertisers.

You can manage personalised advertising in your Google ad settings. Where consent is legally required, advertising choices will be presented before personalised advertising technologies are used.

Operational security logs are minimized and never contain access tokens or URL fragments.