Privacy Policy

Last updated: 4 October 2026

What we collect

Account data: name, email address, hashed password, plan and billing identifiers. Transfer data: file name, size, checksum, creation and expiry time, download counters. Technical data: IP address, user agent and timestamps in server logs, kept for 14 days for abuse and security purposes.

What we do not collect

We do not use advertising trackers, we do not build behavioural profiles, and we do not sell personal data. There is no third-party analytics script on this site.

Why we process it

To provide the service and authenticate you (contract).
To detect abuse, malware and fraud (legitimate interest).
To meet tax and accounting obligations (legal obligation).
To send service notices you cannot opt out of while the account is active.

File contents

Files are encrypted at rest. We do not access the contents of private transfers except to investigate a specific abuse report, or where legally compelled. Public transfers are visible to anyone with the link and may be listed in Browse.

Retention

Transfers are deleted when they expire. Account data is kept while the account exists and for 30 days after deletion, then purged. Billing records are kept for 7 years as required by law. Server logs are rotated after 14 days.

Sub-processors

Hosting within the EU, object storage in the EU and North America, transactional email, and card payments. A current list is available on request from privacy@dropnest.example.

Your rights

You may request access, correction, export or deletion of your data, and you may object to processing based on legitimate interest. Write to privacy@dropnest.example. We respond within 30 days. You may also complain to your local supervisory authority.

Cookies

We set one essential session cookie after you sign in. No advertising or analytics cookies are used, which is why there is no consent banner on this site.