Privacy Policy

Last updated: 2026-08-09 · Includes the cookies, analytics and advertising notice

This policy covers the public website at sharedrop.org (the “Site”), the web file transfer application at app.sharedrop.org(the “App”), and the ShareDrop.org mobile apps distributed through app stores (Android and iOS; the “Mobile Apps”). The Mobile Apps transfer files the same private way as the App but additionally use Google advertising and analytics, as described in section 8.

1. What the App processes

The App enables direct browser-to-browser file transfer over WebRTC. We designed it to process the minimum data technically required:

• File content, file names, folder names, file checksums: exchanged only between the two participating browsers over an encrypted WebRTC data channel. Our servers provide no upload endpoint and neither receive nor store this data.
• Room and session data: when you create or join a transfer room, our signaling service stores a random room identifier, connection state and short-lived access credentials in memory-style storage with automatic expiry. This data is deleted when the session ends and at the latest when the room's time-to-live (minutes) lapses.
• Connection negotiation messages (SDP/ICE): relayed between the two browsers to establish the connection; not persisted and excluded from logs.
• IP addresses and technical connection data: processed transiently to operate the service and defend against abuse (rate limiting, denial-of-service protection). Security-relevant logs containing full IP addresses are retained for the shortest necessary period, targeted at no more than 24 hours.
• Relay (TURN) traffic: when a direct connection is impossible, our relay servers forward WebRTC packets that remain end-to-end encrypted. Relay servers do not store forwarded data and hold no decryption keys.
• Aggregate reliability metrics: de-identified counters (e.g. connection success rates, transfer size buckets) used to operate and improve the service. These contain no file information and no persistent identifiers.

2. What we deliberately do not do

• No user accounts, profiles or persistent identifiers in the App.
• No advertising or ad-tech scripts in the web App at app.sharedrop.org. The Site and the web App use Google Analytics for aggregate usage measurement (see the analytics notice below); the Mobile Apps use Google AdMob and Firebase Analytics — see section 8.
• No collection of file names, contents, hashes or transfer history.
• No sale of your personal data, and no use of any transfer data (file names, contents, checksums, room or session data, safety codes) for advertising.

3. Legal bases

Where the GDPR or similar laws apply, we process session and connection data on the basis of performing the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in securing and operating the service (Art. 6(1)(f) GDPR).

4. Your rights

You may have rights to access, rectify, erase, restrict or object to processing of your personal data, and to lodge a complaint with a supervisory authority. Note that because the App keeps no accounts and session data expires automatically, we typically cannot associate any stored data with a specific person after a session ends — in most cases there is nothing retrievable to disclose or delete. Requests: [email protected].

5. Data recipients and transfers

We use infrastructure providers (hosting, content delivery, relay servers) as processors bound by data processing agreements. A current list of processor categories is available on request. Where data is transferred across borders, we rely on recognized safeguards such as adequacy decisions or standard contractual clauses.

6. Children

The service is not directed at children under 16 and provides no accounts or profiles.

7. Changes; controller and contact

Material changes will be announced on this page with an updated date. The data controller for sharedrop.org is the ShareDrop.org team, identified on the About page. Contact: [email protected].

8. Mobile apps (Android & iOS)

The ShareDrop.org mobile apps (Google Play & App Store) transfer your files the same private, device-to-device way described above: we never receive, store, or use the files, photos, videos or music you send or receive, and they are never used for ads or analytics. The mobile app additionally uses two Google services:

• Google AdMob (advertising): the app shows ads. AdMob may collect your device's advertising ID (AAID) and coarse, non-identifying device and usage data to serve and measure ads, and may share this with Google and its advertising partners. In the EEA, the UK and Switzerland we ask for your consent through Google's User Messaging Platform before serving personalized ads. You can reset or delete your advertising ID in Android Settings › Privacy › Ads, and manage ad personalization in Google's ad settings.
• Google Firebase Analytics (product analytics): we collect app interaction and usage data, session and device information, and an app-instance identifier to understand how the app is used and improve it. This does not include the names or contents of your files. Google processes this data on our behalf; see Firebase's privacy information.

For connections the app temporarily processes IP and technical data that expires automatically, exactly as described in section 1. The app keeps a transfer history on your device only; it is never sent to us, and you can clear it from within the app.

Subscriptions (iOS): Pro subscriptions are billed by Apple through your App Store account. We never receive your payment details; we only receive an anonymous receipt that unlocks Pro features.

Cookies, analytics and advertising notice

Cookies: the transfer application at app.sharedrop.org uses Google Analytics for aggregate measurement (see below) and sets no other client-side storage. This content site sets no cookies of its own; the Google advertising described below can set advertising cookies and similar identifiers in your browser, subject to your consent where consent is required.

Analytics: this content website (sharedrop.org) and the transfer application (app.sharedrop.org) use Google Analytics (gtag.js) to measure aggregate usage — page views, referrer, approximate region, device and browser type, and interaction events. Google Analytics may set cookies and use an analytics identifier; Google processes this data on our behalf (see how Google uses information from sites that use its services). The content site additionally uses Cloudflare Web Analytics, a privacy-preserving, cookieless measurement tool with no cross-site identifier. Analytics never sees the contents or names of transferred files: the transfer application's build remains verified at release time to contain no advertising scripts, and file data never reaches any analytics service.

Advertising: this content site (sharedrop.org) shows ads served by Google AdSense. Ads appear only on content pages here — never in the transfer application, never on pages where a transfer is created, joined or performed, and never adjacent to action buttons, QR codes or safety codes.

• Third-party vendors, including Google, use cookies and similar identifiers to serve and measure ads based on your prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this and/or other sites on the Internet.
• You can opt out of personalized advertising in Google Ads Settings, and out of many third-party vendors at aboutads.info or youronlinechoices.eu. Opting out of personalization does not remove ads — they become contextual only.
• Where consent is required (EEA, UK, Switzerland), a Google-certified consent management platform asks for your consent before any advertising cookies or personalized processing are used, and lets you withdraw it at any time.
• For details, see How Google uses information from sites or apps that use our services.
• No transfer data — room identifiers, file names or contents, checksums, safety codes — is ever shared with advertising vendors. The transfer application at app.sharedrop.org carries no ad code at build level.