Privacy Policy

When you send files to a nearby device, they go directly between the two devices over an encrypted WebRTC connection. Our server only helps the devices find each other: it sees device names you chose, a temporary pairing code and connection details. It never receives or stores the files.

• Account details: username, display name, email (if you give one), a hashed password (never the password itself) and, if you add one, a profile photo. We strip its metadata.
• Files you upload: the file, its name, size and type, and previews or video versions we make so it plays smoothly. We delete these when the file expires or you delete it.
• Rooms: room names and settings, the names people give when joining, posts and their files, and when members joined and were last seen.
• Notifications: in-app notifications. If you turn on alerts, we also keep a push address from your browser's push service (Apple, Google, Mozilla or Microsoft).
• Payments: your plan, invoice amounts, dates and payment status. Card details are handled entirely by Paddle and crypto payments by Plisio. We never see your card number or wallet keys.
• Technical data: IP address, browser type and request logs. We use these for security, abuse prevention and rate limiting. Download counts and simple usage stats help you and us see how links are used.

We only use cookies needed to run the Service:

• dc_session: keeps you signed in, including guest accounts.
• dc_dev: remembers this browser's room memberships.

Your browser also stores your device name and, so uploads can resume, unfinished uploads. These stay on your device. There are no analytics, advertising or third-party tracking cookies.

• to provide the Service: store and deliver files, run rooms, send notifications and apply your plan;
• to keep it secure: stop abuse, spam and attacks, and enforce our Terms;
• to handle payments and support requests;
• to meet legal obligations.

The legal bases are performing our contract with you, our legitimate interest in a safe and working service, and legal obligations. Where the law requires it, we also ask your consent (for example for push alerts).

Files and posts are visible to the people you share them with: anyone with the link, room code or QR, and members of the room. Room hosts can see members' names and when they joined and were last seen. Our administrators can access data only when needed to run the Service, handle abuse reports or comply with the law.

We share data only with providers who help us run DropCircle:

• our hosting provider (servers and storage);
• Paddle (card payments, as merchant of record) and Plisio (crypto payments);
• browser push services, for alerts you turn on.

We may also disclose data if the law requires it, or to protect people from harm. We don't sell or rent personal data. These providers may process data in other countries, with appropriate safeguards.

• Uploaded files: until they expire under your plan or your chosen expiry, or until you delete them.
• Unused guest accounts: deleted automatically after about a week.
• Notifications: 60 days. Room join requests that are never answered: 30 days.
• Activity history: up to about 13 months.
• Payment records: as long as tax and accounting laws require.
• Your account: until you delete it. Backups are overwritten within about 30 days.

We protect your data with:

• HTTPS everywhere and hashed passwords;
• strict security headers, a firewall and rate limits;
• signature checks on payment notifications;
• processing uploads in an isolated way.

No system is perfectly secure. If we learn of a breach that affects you, we'll tell you as the law requires.

Depending on where you live (for example under the GDPR or the CCPA), you can ask to access, correct, export or delete your data, or object to some uses. You can edit your profile and delete files or your whole account yourself in Account. For anything else, email support@dropcircle.net. You can also complain to your local data protection authority.

DropCircle isn't meant for children under 13. We don't knowingly collect their data. If you believe a child has an account, contact us and we'll delete it.

If we change this policy in a meaningful way, we'll update the date above and tell account holders on the site or by email.