Privacy Policy

How Dropley collects, uses, and protects your personal data.

Version
1
Last updated
2026-08-20

Information We Collect

Information You Provide

When you upload a ZIP file to Dropley, we collect the file contents, filename, and any metadata included in the upload. We also collect the timestamp of your upload and your chosen expiration settings.

Information Collected Automatically

When you visit Dropley or access a published artifact, we automatically collect:

  • IP address: Used for rate limiting and abuse detection. It is not stored in the first-party acquisition funnel.
  • Browser information: User agent string, browser type and version, operating system, and device type.
  • Usage data: Pages visited, time spent, referring website, and interaction patterns.

Privacy-Limited Acquisition Measurement

To understand whether people who discover Dropley go on to publish an artifact, the main Dropley app sets a first-party anonymous dropley_session cookie. It contains a random identifier only, is host-only (not shared with published artifacts), is HttpOnly, Secure, and SameSite=Lax, and expires after 90 days. We use it to deduplicate three events: landing view, upload start, and successful publish.

For this funnel, we retain only normalized first-touch source, medium, optional campaign, and landing path. We do not retain a full referrer URL or arbitrary query strings, and we do not associate the funnel with an uploaded filename, uploaded contents, artifact token, email address, or IP address.

How We Use Your Information

We use the information we collect for the following purposes:

  • Service provision: Your uploaded content is stored, processed, and published as a hosted artifact at a unique URL according to your selected options.
  • Analytics: We use aggregated usage data to understand how Dropley is used, improve the service, and monitor performance. This includes Plausible, a privacy-first analytics service, and the limited first-party acquisition funnel described above.
  • Abuse detection and prevention: IP addresses and usage patterns are monitored to detect and prevent abuse, denial-of-service attacks, and violations of our Terms of Service and Acceptable Use Policy.
  • Error monitoring: We use Sentry to track and diagnose application errors. Sentry may collect device and usage information necessary for debugging.

We do not sell your personal data to third parties. We do not use your data for advertising or profiling.

Data Retention

  • Uploaded artifacts: Your published artifacts are retained according to the expiration setting you select at the time of upload. When an artifact expires or is deleted, the underlying files and metadata are permanently removed from our systems within a reasonable period.
  • Log data: Server logs containing IP addresses and request metadata are retained for a limited period for security and debugging purposes, after which they are deleted or anonymized.
  • Analytics data: Plausible stores anonymized, aggregate data without personally identifiable information. Acquisition funnel records use an anonymous session ID and limited first-touch fields to produce aggregate conversion reporting; they do not include uploaded content or other user-generated payloads.

Third-Party Services

Dropley uses the following third-party service providers:

  • Cloudflare: We use Cloudflare for content delivery (CDN), DNS, DDoS protection, and edge caching. Cloudflare processes traffic data including IP addresses in accordance with their privacy policy.
  • Plausible: We use Plausible for privacy-friendly, cookieless web analytics. It does not track visitors across sites or store personally identifiable information.
  • Sentry: We use Sentry for error tracking and performance monitoring. Sentry may collect error stack traces, device information, and usage context necessary to diagnose technical issues.

Each third-party service operates under its own privacy policy and data processing agreement.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: You may request a copy of the personal data we hold about you.
  • Correction: You may request that we correct any inaccurate or incomplete data.
  • Deletion: You may request that we delete your personal data, subject to legal retention requirements.
  • Objection: You may object to the processing of your personal data for specific purposes.

To exercise any of these rights, or if you have questions about this Privacy Policy, contact us at hello@dropley.app. We will respond to your request within a reasonable timeframe.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "updated" date at the top of this policy. Your continued use of Dropley after changes take effect constitutes your acceptance of the updated policy.

Contact

For questions, concerns, or requests regarding your privacy, contact us at:

hello@dropley.app