Privacy Policy

Effective date: 10 July 2026 Last updated: 10 July 2026

Short version: We collect only what we need to run the service. We don't sell your data. Your Vault files are encrypted on your device — we literally cannot read them. You can delete your account and all your data anytime.

1. Who We Are

DataDrop is a pay-as-you-go cloud storage service operated from India. Our service is available at app.datadrop.co.in. For privacy-related matters, you can contact us at datadrop.contact@gmail.com.

2. Data We Collect

We collect information in the following categories:

Category What & Why

Account information

Email address and name provided at sign-up. Used for authentication, billing communication, and account recovery.

File metadata

File names, sizes, upload timestamps, MIME types, and storage locations. Used to display your files and calculate billing. We do not read file contents for standard Files storage.

Billing data

Byte-second usage records, monthly totals, and spending limit settings. Used to calculate and collect charges. UPI payment details are handled by Razorpay and are not stored by DataDrop.

Usage logs

Access timestamps, IP addresses, and user-agent strings. Retained for up to 30 days. Used for security monitoring and debugging.

Share records

Records of which files were shared with which accounts, and share settings (expiry, view limits). Deleted when the share is revoked or expires.

3. How We Use Your Data

To provide the Service: Storing, retrieving, and sharing your files as you instruct.
To calculate and collect billing: Real-time byte-second metering and monthly UPI AutoPay.
To communicate with you: Billing receipts, account alerts (payment failure, trial expiry, upcoming deletion), and responses to your support queries.
To maintain security: Detecting and preventing unauthorised access, abuse, and violations of our Terms of Service.
To improve the Service: Aggregate, anonymised usage analytics. We do not use your files or personal data to train AI models.

We do not use your data for advertising. We do not sell your data to any third party.

4. Data We Do Not Collect

We do not read the contents of files stored in your standard Files storage, except as technically necessary to transfer them to you.
We do not read your Vault files — they are encrypted on your device before upload (see Section 5).
We do not collect payment card numbers. UPI payments are processed by Razorpay.
We do not track your activity across other websites.
We do not sell or rent your personal information.

5. Vault & Zero-Knowledge Encryption

The Vault is designed with zero-knowledge architecture. Files are encrypted on your device using keys derived from your Vault PIN before they leave your browser. Our servers receive only ciphertext.

What this means in practice:

DataDrop employees cannot read your Vault files — ever.
If we receive a legal request for Vault content, we can produce only encrypted data that is meaningless without your PIN.
If you forget your PIN and lose your recovery phrase, your Vault files are permanently inaccessible. We cannot help you recover them.

The encrypted private key blob associated with your Vault is stored on our servers, but it can only be decrypted with your PIN. We never have your PIN.

6. Third-Party Services

DataDrop uses the following third-party services to operate:

Cloudflare: Infrastructure, edge network, DDoS protection, and DNS. Cloudflare may process request metadata (IP, user-agent) as part of its services. Cloudflare Privacy Policy.
Backblaze B2: Object storage for your files. Files are stored in B2 buckets accessible only via DataDrop's authenticated API. Backblaze Privacy Policy.
Clerk: Authentication and user account management (email verification, session management). Clerk Privacy Policy.
Razorpay: UPI AutoPay processing. Payment data is handled by Razorpay under their PCI-DSS compliance. We do not store payment credentials. Razorpay Privacy Policy.

We do not share your personal data with these services beyond what is technically necessary for them to perform their functions.

7. Cookies & Local Storage

DataDrop uses cookies and browser local storage for the following purposes:

Session cookies: Required to keep you signed in. These are set by Clerk (our authentication provider) and are strictly necessary for the Service to function.
Vault key material: Derived encryption keys may be held temporarily in browser session storage during an active Vault session. This data is cleared when you close the browser tab.
Preferences: UI preferences (e.g., view mode) may be stored in local storage.

We do not use third-party advertising cookies or tracking pixels.

8. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account deletion.
Files: Retained while you are an active, paying user. Deleted per the timeline in our Terms of Service upon trial expiry, payment failure, or account deletion.
Usage logs: Retained for up to 30 days, then automatically deleted.
Billing records: Retained for 7 years as required by Indian financial regulations.
Share records: Deleted when the share is revoked, expires, or the file is deleted.

9. Your Rights

You have the right to:

Access: Request a copy of the personal data we hold about you.
Correction: Update inaccurate account information from your account settings.
Deletion: Delete your account and all associated data at any time from account settings. Deletion is permanent and irreversible.
Portability: Download your files at any time. There are no egress charges for downloads.
Objection: Object to processing of your data in ways not described here by contacting us.

To exercise any of these rights, contact us at datadrop.contact@gmail.com. We will respond within 30 days.

10. Children's Privacy

DataDrop is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account and associated data promptly.

11. Data Security

We take reasonable technical and organisational measures to protect your data, including:

TLS encryption for all data in transit
AES-256 encryption for Vault files (on your device, before upload)
JWT-based authentication for all API requests
Access controls limiting which employees can access production systems
Cloudflare DDoS protection and edge security

No security system is perfect. In the event of a data breach affecting your personal data, we will notify you in accordance with applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the Service. The effective date at the top of this page reflects the date of the most recent update.

13. Contact

For privacy-related questions or to exercise your rights, contact us at:

datadrop.contact@gmail.com

We typically respond within 2 business days.