Privacy & security

What we store, and for how long

Free rooms become inaccessible 30 minutes after creation. Expired room data and files are queued for scheduled cleanup. Ending a room immediately revokes room access; file deletion may take longer during retries or service outages. Uploads already in progress may finish into private storage after expiry but cannot attach to the expired room. Minimal upload and deletion records, including storage paths, are retained for recovery. An already downloaded or copied item on another device cannot be recalled.

Installation and local data

Installing QDrop saves its app assets and an offline connection screen, never room pages, clipboard content or transferred files. Transfers require internet. Device names and a random device identifier stay in this browser. Favorites are kept only in the current room tab and never extend the ten-item limit or room expiry.

How rooms are protected

• Room codes are generated with a cryptographically secure random source — never sequential.
• Only the creating device holds the owner key needed to clear or end a room.
• All traffic is encrypted in transit (HTTPS). Files sit in private storage and are reachable only through short-lived signed links.
• QDrop is not end-to-end encrypted: the service processes clipboard content. Do not send sensitive secrets.
• Room data is accessible only through server-side room checks, including expiry. Creation, joining, sending and upload requests are rate-limited; transfers are validated against size limits.
• Executable file types are rejected.
• Anyone with the code can read, send or delete individual items. Only the creating device can clear or end the room. Downloads require a click; files are never automatically opened. QDrop does not scan for malware.

Analytics

We count events like "room created" or "item copied" with sizes and types only. We never record clipboard contents, file names or room codes.