Legal
Privacy Policy
Last updated March 31, 2026
Dropway is built so we see as little as possible. Files are uploaded from your browser directly to Cloudflare R2 using short-lived signed URLs. Our Workers API stores transfer metadata, not file bytes.
What we store
- Original file names, sizes, MIME types, and object keys.
- Transfer identifiers, expiry time, and a salted password hash if you set a password.
- A truncated hash of the requester IP, used only for rate limiting.
- A download counter for abuse response.
What we do not do
- We do not require accounts or collect names, emails, or billing data for the core product.
- We do not scan file contents for advertising.
- We do not sell personal information.
Retention
Transfers expire after the period you select (1 hour to 7 days). Metadata is deleted with the objects. Incomplete uploads are discarded after one hour. Cloudflare R2 lifecycle rules delete leftover objects after 8 days as a safety net. Rate-limit counters expire with their time window.
Processors
File objects and metadata are processed on Cloudflare’s global network (Workers, KV, and R2). The website may be served from Vercel or Cloudflare Pages. Those providers process data according to their own terms.
Contact
Privacy questions: support@dropway.app. Copyright: dmca@dropway.app.