Privacy Policy

Last updated: 6 June 2026

This Privacy Policy explains what information is involved when you use JustDrop at justdrop.ai (the "Service"), why, and what choices and rights you have. JustDrop is built so that we handle as little of your information as possible — most of what follows is about how little we hold, not how much.

1. Who we are

The Service is operated by Vibecraft Digital FZ LLC ("JustDrop", "we", "us"), a free-zone company registered at Meydan Free Zone, Dubai, United Arab Emirates. We are the controller responsible for the limited personal data described in this policy.

For any privacy question or request, contact us at support@justdrop.ai.

2. What we don't do

Because of how JustDrop is built, several things that most websites do simply don't happen here:

• We don't require an account, login, or any sign-up.
• We don't use advertising, ad networks, or marketing trackers.
• We don't set tracking cookies, and we don't use any third-party analytics or trackers (no Google Analytics, no pixels, nothing of the sort).
• We don't build profiles of you or track you across other websites.
• We don't sell, rent, or trade personal information, and we don't "share" it for cross-context behavioural advertising.
• Your content is end-to-end encrypted on your device. Your browsers exchange encryption keys through our server; we do not use those keys to open your files, but the exchange is not verified — see 'Limits'.

3. The information we handle, and why

To move a file from one device to another, a small amount of information has to pass through our systems. Here is all of it.

Encrypted content

When you send a file, photo, voice note, password, live location, or chat message, it is encrypted on your device first. We only ever receive the scrambled version and store it. Your browsers exchange encryption keys through our server; we do not use those keys to open your files, but the exchange is not verified — see 'Limits'.

Transfer details (room metadata)

To route a transfer, we store technical details about the room, such as:

• the room code;
• file names, file sizes, and file types;
• timestamps (when a file was added, downloaded, or the room created);
• who is currently present in the room;
• the encrypted key material for the content.

We use this only to make the transfer work. Metadata persists until the room is closed. We keep some technical records (such as server logs, which can include room codes and IP addresses) needed to run the service.

Security and abuse-prevention data

To protect the Service from abuse, our systems process your IP address in memory to count requests and apply rate limits. The in-memory entry stays until the instance restarts. Google Cloud request logs in our project record IP addresses and the URLs requested, which can include room codes. These request logs are kept for 30 days. Separately, our hosting and content-delivery providers may process your IP address at the network level to deliver the site and defend against attacks — this is standard for any website.

Usage counts

We keep a server-side tally of visit counts and campaign tags. These counts are kept indefinitely.

This tally does not include:

• your IP address;
• any unique or persistent identifier for you or your device;
• your location;
• room codes, file names, file contents, or how much you transferred.

We built this ourselves and keep it in-house — we don't use any third-party analytics services or trackers.

If you contact us

If you email support@justdrop.ai, we receive your email address and whatever you choose to put in your message, and we keep it for as long as needed to handle your request.

4. How your content is encrypted in your browser (see Limits)

JustDrop encrypts file contents in your browser. In plain terms: the file is locked on your device before it leaves your browser. Anyone with the room code can join or close the room and may receive files sent in it, so only share the code with the person you're sending to.

• Each file is encrypted on your device with a unique key (AES-256-GCM).
• Key verification between participants is not yet in place — see 'Limits'. The private keys are created in your browser and not sent to us.

Your browsers exchange encryption keys through our server. We do not use those keys to open your files, but the exchange is not verified — see 'Limits'. File names are not encrypted. We can see file names, file types, file sizes, upload times and download status, and our request logs, kept for 30 days, include IP addresses and room codes. We hold encrypted content, the room details above, and the logs described in Section 3.

Limits

Key verification between participants is not yet in place. Your browsers exchange encryption keys through our server. We do not use those keys to open your files, but the exchange is not verified, so someone running the server or anyone with the room code could substitute a key.

How encryption works

Files are encrypted in your browser before upload. The key exchange does not verify who joins, and the JustDrop server relays the keys, so you are trusting it to relay them honestly.

Anyone with the room code can join or close the room and may receive files sent in it, so only share the code with the person you're sending to. File names are not encrypted.

5. How long we keep things

• When a room is closed, its files and room details are being removed from our storage. Our cloud provider may keep a recoverable copy for up to 7 days. Closing the browser tab does not close the room — use Close.
• A completed download does not remove the file; close the room to remove it.
• Rooms that are not closed remain stored, including file names, until they are closed or removed.
• Support emails are kept only as long as needed to deal with your enquiry.

We do not make our own archive of your content after a room is closed. Our cloud provider may keep a recoverable copy for up to 7 days.

In rare cases, such as a very large room, a file still uploading when the room closes, or a room whose record is already missing when it is closed, a file can remain in storage after the room is closed. We do not currently run an automatic cleanup for these files.

6. Where your data is processed, and international transfers

We are based in the UAE. To run the Service, encrypted content and room metadata are processed using Google's cloud infrastructure (see Section 7), which may store or process data in locations outside your country, including outside the UAE and the European Economic Area (EEA). Your encrypted files and room details are stored with Google Cloud in the United States (us-central1). The website and app are served from Google Cloud in the Netherlands (europe-west4).

Where personal data of EEA or UK individuals is transferred internationally, those transfers are covered by appropriate safeguards such as the Standard Contractual Clauses offered by our infrastructure provider.

7. Who we work with (sub-processors)

We keep our list of third parties deliberately short:

• Google (Firebase Realtime Database & Google Cloud Storage): stores the encrypted transfer and its routing details until the room is closed.
• Direct browser↔Cloud Storage transfers: your browser transfers encrypted files directly to and from Google Cloud Storage.
• Google (Cloud Logging): request logs.
• Google (Firebase App Hosting): hosts and serves the website and the app to your browser.

We do not use third-party analytics, advertising, email-marketing, or customer-tracking services. The only usage measurement we keep is a tally of visit counts and campaign tags, described in Section 3.

8. Your privacy rights

Depending on where you live, you have rights over your personal data. Because JustDrop has no accounts, we may be unable to connect a given transfer to you. We will still help wherever we can. To make a request, email support@justdrop.ai.

United Arab Emirates (PDPL)

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and ask about cross-border transfers, subject to the law's conditions.

European Economic Area & United Kingdom (GDPR / UK GDPR)

You have the right to access, rectify, erase, restrict, or object to the processing of your personal data, and the right to data portability. You also have the right to lodge a complaint with your local data protection authority. Where we cannot identify you from the data we hold, we may ask for more information or, if we still cannot identify you, may be unable to action the request (Article 11, GDPR).

California (CCPA / CPRA)

California residents may request to know, delete, or correct personal information, and may opt out of its sale or sharing. To be clear: We do not sell your personal information. We use service providers, such as our cloud host, to run the service. We will not discriminate against you for exercising your rights. You may use an authorised agent to make a request.

9. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on:

• Performing the service you ask for — processing the room and encrypted content so your transfer actually reaches the people you share the room code with.
• Our legitimate interests — keeping the Service secure, preventing abuse, and operating it reliably, balanced against your rights.

10. Children's privacy

JustDrop is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will address it.

11. Security

We use HTTPS for data in transit, and file contents are encrypted in your browser before upload. No method of transmission or storage is ever completely secure.

12. Cookies and tracking

We don't use tracking cookies, advertising cookies, or any third-party analytics. We keep a tally of visit counts and campaign tags. These counts are kept indefinitely (described in Section 3). The full details, including the small, purely functional things we store on your device, are in our Cookie Notice.

For the rules that apply when you use JustDrop, see our Terms of Use.

13. Changes to this policy

If we update this policy, we'll change the date at the top and, for significant changes, highlight them on the site. Continuing to use JustDrop after an update means you accept the revised policy.

14. Governing law

This policy is governed by the laws of the United Arab Emirates and the applicable regulations of Meydan Free Zone, Dubai, without affecting any mandatory data-protection rights you have under the laws of your own country.

15. Contact & complaints

Questions, requests, or complaints: support@justdrop.ai. If you are in the EEA or UK and aren't satisfied with our response, you may also complain to your local data protection authority.