Privacy Policy
DeadDrop is end-to-end encrypted. Your password and the contents of your drop — whether a file or pasted text — are encrypted in your browser before anything leaves your device. The server only ever sees opaque ciphertext, and we collect as little additional data as possible. No accounts, no tracking, no analytics.
How encryption works (web)
When you upload a file or send text from this site, your browser does all the cryptographic work:
- A 256-bit key is derived from your password using Argon2id (memory-hard, slow on purpose) inside a WebAssembly module that runs in your tab.
- The filename, the per-drop verification token, and every chunk of your file (or pasted text) are sealed with AES-256-GCM using that key. Each ciphertext is bound to its purpose (and chunks are bound to their position) so the server can't mix and match what it stores.
- Only the resulting ciphertext is sent to the server. Your password and the derived key never leave your browser.
This means a server compromise — or a court order to the operator — cannot reveal the contents of a drop without also obtaining the password from the recipient.
What we store
- Your drop contents (file or text), as opaque ciphertext chunks the server cannot decrypt. The chunks are kept in a per-drop key prefix in our object store (Cloudflare R2 in production; local disk in development) and are deleted when the drop is consumed or expires.
- An encrypted metadata blob containing the filename, content type, and a flag indicating whether the drop is a file or pasted text, sealed with your password-derived key. Without the password it cannot be read.
- An Argon2id salt and parameters so your browser can re-derive the same key at download time, plus an encrypted verification token used to confirm the password is correct without ever revealing it to the server.
- A drop key (a random UUID) that identifies the drop. You share this key with the recipient.
- A creation timestamp and expiry time (1 hour, 24 hours, or 7 days — your choice).
- The plaintext byte sizes of each ciphertext chunk and the chunk count, used for upload progress and integrity. We do not store the file size of the underlying plaintext — only the geometry of the ciphertext that arrived.
What we do not store
- Your password in any form — neither plaintext nor a hash. The server never receives it.
- Your encryption key — it is derived in your browser, used in your browser, and discarded when you close the tab.
- Your plaintext filename or any other plaintext metadata that could identify a drop.
- Your IP address — a one-way hash is derived in memory for per-request rate limiting only and is never written to disk or the database.
- Browser cookies, tracking pixels, or analytics of any kind.
- Any account information — there is no registration.
How long data is kept
A drop is deleted after it is downloaded once, or when it expires — whichever comes first. The maximum retention period is 7 days. Expired and consumed drops are purged from the database and disk by a background cleanup process.
Security
- End-to-end encryption: file content and metadata are encrypted in your browser with a key derived from your password. The server only sees opaque ciphertext.
- All traffic is additionally encrypted in transit using TLS (rustls/ECDSA).
- The challenge endpoint returns the same shape of response for known and unknown drop keys, so a probing caller cannot tell from a response whether a given drop exists.
- Server logs are structured and explicitly exclude filenames, drop keys, and IP addresses.
A note on the CLI
The optional command-line client (deaddrop-cli) speaks the same JSON-over-HTTPS API the browser uses and runs the same end-to-end encryption locally — Argon2id key derivation and AES-256-GCM sealing happen before any byte leaves your machine. Browser and CLI uploads are equivalent from a privacy standpoint.
Third parties
Requests to this service pass through Cloudflare, which acts as a reverse proxy and DDoS shield. Cloudflare may observe connection metadata (IP addresses, request headers, timing) under its own privacy policy. The file content and your password are never exposed to Cloudflare — they are encrypted in your browser before any network request is made.
No third-party analytics or advertising
This service does not use Google Analytics, Meta Pixel, or any other analytics or advertising service. No data is sold or shared with third parties for marketing purposes.
Contact
Questions about this policy can be sent to admin@imperialsteel.net.