Legal & Compliance
Privacy Policy
Last updated: October 17, 2026
DropItOver is engineered from the ground up to respect and protect user privacy. This policy provides complete, transparent disclosure regarding data handling, cryptographic protections, advertising cookies, and user rights under the European General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).
1. Data collected by transfer mode
No account is required to transfer files. The service still processes connection metadata and, for link shares and support requests, stores the information described below.
| Mode | Processing | Retention |
|---|---|---|
| Nearby devices and rooms | Signaling handles device nicknames, connection identifiers, transfer offers (including file names and sizes), SDP, and ICE candidates. WebRTC file bytes are DTLS encrypted between browsers. A TURN relay may carry encrypted packets when a direct route fails. | No application file storage for P2P. Room metadata lasts until room expiry; active connections hold signaling state. |
| Expiring links | Files travel over HTTPS to a Cloudflare Worker, which sees plaintext and encrypts chunks with AES-256-GCM before writing to R2. D1 holds file names, MIME types, sizes, expiry, and key-derivation metadata. Notes are stored in D1. | Links expire after the selected duration (1 hour to 7 days). Cleanup runs every 10 minutes and removes expired storage; deletion can be delayed by operational failure. Burn-after-read and the sender's delete control can remove a share earlier. |
| Contact inquiries | Name, email, category, subject, message, timestamp, random ticket ID, and a hashed IP identifier are stored privately in D1 for support and abuse prevention. | Up to 90 days, followed by scheduled deletion. Email correspondence is handled separately in the support mailbox. |
2. Encryption and the limits of zero-knowledge
Direct WebRTC transfers protect file contents with browser-to-browser DTLS, including when a TURN server relays the encrypted traffic. Our signaling service does not receive the file payload, but handles connection metadata. The app does not independently verify a recipient's identity: confirm the recipient and accept prompt yourself.
Link sharing is not zero-knowledge or client-side end-to-end encryption. Our Worker holds the master encryption key and encrypts and decrypts file chunks. The operator and infrastructure running that Worker are in the trust boundary. Encryption at rest does not hide file metadata or notes stored in D1. Do not assume that an expiring URL prevents copies, screenshots, or access by someone to whom the URL was forwarded.
3. Third-Party Vendors: Google AdSense and DoubleClick DART cookies
The site includes Google's AdSense verification script. Empty ad slots have been removed while approval is pending. If advertising is enabled, third-party vendors, including Google and its partners, may use advertising cookies, web beacons, IP addresses, and other identifiers to serve, personalize, measure, and limit ads based on prior visits to this site or other sites. Google's advertising cookies include cookies associated with DoubleClick domains, historically called the DoubleClick DART cookie.
Google's use of advertising cookies enables it and its partners to serve ads based on visits to this and other sites. You may opt out of personalized advertising through Google Ads Settings (adssettings.google.com). Other vendors may provide opt-outs through YourAdChoices. Browser cookie settings also let you block or delete cookies. Opting out of personalization does not necessarily remove all advertisements or operational cookies.
Read how Google uses data on partner sites and Google's required advertising disclosures. Where consent is required, advertising must follow the applicable consent choice. This disclosure does not itself implement an advertising consent mechanism.
4. Local storage, network identifiers, and infrastructure
The browser remembers a generated device identity and your chosen nickname in localStorage. These are used for peer discovery, not first-party analytics. Clear site data in your browser to reset them. Discovery groups connections by a hash derived from the public IP supplied by Cloudflare. Upload quotas also use hashed IP counters; a hash is pseudonymous and should not be treated as anonymous. Upload usage counters older than two days are swept automatically.
Cloudflare provides Workers, D1, R2, Durable Objects, and optional TURN services. It processes request IP addresses and operational metadata to deliver and secure the service, including under its own infrastructure policies. Google processes data when its scripts run. These providers may process data outside your country. We do not claim that having no account means no personal information is processed.
5. GDPR and CCPA/CPRA data rights
Depending on your location and applicable law, you may request access, correction, deletion, portability, restriction, or objection to processing, and withdraw consent where processing relies on consent. California residents may also request information about collected data and request opt-out of sale or sharing for cross-context behavioral advertising, where applicable. We do not sell uploaded file contents. Advertising vendors may process identifiers for advertising under their policies and your applicable choices.
Submit a rights request through the contact form or email support@dropitover.com. For a support record, include the ticket reference and use the same email address. We may request proportionate identity verification before disclosing or deleting records. Avoid sending identity documents unless needed and arranged with support. You may complain to your local data protection authority and exercise applicable rights without discriminatory treatment.
The sender can delete an active link using its private owner token. We cannot retrieve files from a completed direct transfer or erase copies saved by a recipient. Retention obligations or security investigations may affect a request; we will explain any applicable exception.
6. Children and privacy contact
The service is not intended to collect personal information from children under 13. If a child has submitted personal data, a parent or guardian can contact support to request review and removal. For all privacy questions, contact support@dropitover.com.