PRIVACY POLICY
Private by design.
1. Scope
This policy explains how DirectDrop handles information when you visit the public homepage or use its browser-to-browser file-transfer service.
2. Files are not uploaded to DirectDrop
Selected file contents, file names, sizes, and integrity hashes travel through the encrypted WebRTC connection between the sender and recipient. The DirectDrop application server does not receive or store that file content or metadata. The recipient you choose necessarily receives the shared files and their metadata.
3. Connection and service data
DirectDrop processes limited information needed to serve pages, prevent abuse, and connect peers. This may include:
- IP address, request time, browser and protocol information, and security signals.
- A random room identifier, short-lived role ticket, peer role, and connection state.
- WebRTC signaling data such as offers, answers, and network candidates, plus authentication signatures.
- Cloudflare Turnstile verification results when an abuse-prevention check is required.
The DirectDrop application keeps room and signaling state in memory rather than a database. Unused admission state expires after approximately 30 minutes; active rooms have a maximum lifetime of 24 hours. Infrastructure and security providers may retain their own operational records under their policies.
4. Link secrets
The private room secret is placed after # in the share URL. It is not sent in ordinary HTTP requests or WebSocket join messages. Anyone with the complete link may be able to receive the file while the session is available, so do not post it publicly.
5. Service providers
Cloudflare
Cloudflare provides domain registration, reverse proxying, transport security, traffic protection, and Turnstile. Cloudflare may process IP addresses, routing information, and security telemetry. See Cloudflare’s Privacy Policy.
Google STUN
The transfer page currently uses Google’s public STUN service to help browsers discover a peer-to-peer network path. A STUN request necessarily exposes network addressing information to the STUN operator.
Google AdSense and consent management
The public homepage—but not sender or receiver transfer pages—may load Google AdSense. Google and participating advertising partners may use cookies, local storage, IP addresses, web beacons, or similar technologies to select, deliver, limit, and measure ads. Depending on your region and choices, ads may be personalized using prior visits to this and other websites.
You can manage personalized Google advertising through Google Ads Settings. See how Google uses information from partner sites and how Google uses advertising cookies.
6. Cookies and consent choices
DirectDrop does not use an application account or create its own advertising profile. Google advertising and consent services on the homepage may place or read cookies and similar storage. Where configured or legally required, Google’s consent message lets you consent, decline, or manage advertising purposes. Transfer pages do not load Google advertising or CMP code.
7. Security and retention
DirectDrop uses HTTPS, encrypted WebRTC, authenticated signaling, random room identifiers, short-lived tickets, rate limits, and automatic expiration. No internet service can guarantee absolute security. The application does not intentionally persist file data, room contents, or signaling messages to a database.
8. Your choices and rights
You can avoid advertising technologies by navigating directly to the transfer page, reject or manage consent where the CMP is available, adjust browser storage settings, and stop a transfer by closing the page. DirectDrop has no user accounts and normally has no stored file or room record to retrieve or delete. Depending on your location, you may have additional privacy rights relating to information held by infrastructure or advertising providers.
9. Children
DirectDrop is a general-purpose file-transfer utility and is not specifically directed to children. If you are not old enough to agree to online service terms where you live, use DirectDrop only with permission from a parent or legal guardian.
10. Changes
This policy may be updated when the service, its providers, or applicable requirements change. Material updates will be reflected by changing the effective date on this page.