Privacy Policy

Drop is a personal network drive and device-aware messaging platform. You create a private network — identified only by a name and a master PIN — and your devices use it to message each other and share files. This policy explains what information Drop processes when you use the service and the choices you have.

Drop is built around a simple principle: it holds the minimum needed to run your network, and it never sells your data or uses your messages and files for advertising.

• Network details. The network name you choose and a securely hashed form of your master PIN. We do not store your PIN in plain text.
• Device information. A name and icon you assign to each device, plus a device identifier so the network can recognize devices that have joined.
• Messages and files. The content you send within your network, including text messages and any files or media you share.
• Technical data. Basic logs such as timestamps and connection events that are necessary to deliver messages reliably and keep the service secure.
• Integration tokens. If you connect Google Drive, the access tokens required to upload files on your behalf, stored at the network level.

We use the information above only to operate the service — specifically to:

• Authenticate networks and devices, and keep unauthorized devices out.
• Deliver your messages, files, and real-time updates to the devices on your network.
• Let you approve, rename, and remove devices.
• Upload files to your connected Google Drive when you ask us to.
• Maintain security, prevent abuse, and diagnose technical problems.

Your messages and files are shared only with the devices that have joined your network. File transfers between devices may be sent directly, peer-to-peer, where supported.

We do not sell your personal information, and we do not share it with third parties for their own marketing. We may use service providers (for example, hosting and real-time delivery infrastructure) strictly to run Drop, and we may disclose information if required by law.

• Session cookie. A signed, HTTP-only cookie that keeps you logged in to your network.
• Device cookie. An HTTP-only cookie that identifies this browser as a specific device on your network.
• Theme preference. A small value stored in your browser to remember light or dark mode.

These are essential to how Drop works; the service cannot function without them.

Connecting Google Drive is optional and set up per network. When connected, Drop uses the access you grant only to upload the files you choose to share and to create links for them. You can disconnect at any time, and you may also revoke Drop's access from your Google account settings.

Messages and files remain available to your network until they are deleted or the network is removed. If you delete a device, its access ends immediately. When a network is deleted, its associated data is removed from active systems.

We protect your data with measures appropriate to its sensitivity, including hashing of your PIN, HTTP-only cookies, and access controls that limit data to the devices on your network. No system is perfectly secure, so we encourage you to keep your PIN private and remove devices you no longer use.

You control your network directly: you can add or remove devices, delete messages and files, disconnect integrations, and delete your network. Because networks are identified by a name and PIN rather than a personal account, keeping those credentials safe is the primary way you control access.

Drop is not directed to children under 13, and we do not knowingly collect personal information from them.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice.

Questions about this policy or your data can be sent to privacy@drop.app.