Privacy Policy

1. Who we are

The controller responsible for the processing described in this policy is 프로젝트팀포유 (Project Team For You), represented by 이유상, business registration number 495-25-02209, 1166-68 Yebong-ro, Sangun-myeon, Bonghwa-gun, Gyeongsangbuk-do, Republic of Korea. You can reach us at [email protected].

2. Summary

• The App works locally on your devices and needs no account. Your content never passes through our servers; only short-lived, end-to-end encrypted connection offers pass through our rendezvous service when you connect over the internet.
• We do not collect the files, clipboard contents, links or other content you send between your devices.
• The App sends no usage analytics (telemetry) by default.
• The Website uses no cookies, no analytics and no third-party scripts.

3. Data processed by the App

To pair and connect your devices, the App creates and stores the following data only on your devices:

• a device key pair (the private key never leaves the device and is protected by the operating system where available) and a device ID derived from the public key;
• the device name you choose;
• the list of trusted devices and the permissions you granted to each of them;
• transfer journals, My Drop items and settings needed to resume transfers and to expire items automatically.

To find devices on your local network, the App announces its device ID, device name and connection hints (such as local IP address and port) using mDNS and UDP broadcasts that stay within your local network. Other devices on the same network can see this information; it is not sent to us.

Content you send (files, clipboard text, links, Continue context and My Drop items) travels directly between your devices and is encrypted end to end. We never receive, store or have access to it. Because none of the data in this section reaches us, you control it yourself and can delete it at any time by removing trusted devices or uninstalling the App and its data.

4. Data processed when you visit the Website

The Website is a static site hosted by Cloudflare, Inc. (Cloudflare Pages). When you visit it, your browser necessarily transmits technical data such as your IP address, browser type (user agent), requested URL, referring page and time of the request. Cloudflare processes this data to deliver the Website and to protect it against attacks and abuse. We do not use it to identify you, do not combine it with other data and do not run analytics on it.

The Website sets no cookies. It stores only your language choice in your browser’s local storage and caches files with a service worker so pages also load offline. Both stay on your device, are never sent to us and can be cleared at any time in your browser settings.

Share buttons are plain links. No data is sent to a social network unless you click one; you are then taken to that service, whose own privacy policy applies.

5. When you contact us

If you email us at [email protected], we process your email address, your name if you provide it, the content of your message and any attachments in order to answer you. Our mailbox is provided by Google LLC (Gmail).

6. Purposes and legal bases (GDPR)

Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:

• Delivering and securing the Website: our legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR).
• Answering your enquiries: steps taken at your request (Art. 6(1)(b) GDPR) and our legitimate interest in responding to messages (Art. 6(1)(f) GDPR).
• Complying with legal obligations, such as statutory retention duties or lawful requests from authorities (Art. 6(1)(c) GDPR).
• Setting up internet connections you ask for: performance of the service at your request (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

We do not use personal data for automated decision-making or profiling, and we never sell or rent it.

7. Retention and deletion

• App data: stored only on your devices until you delete it. My Drop items expire automatically.
• Website request data: processed by Cloudflare only for as long as needed for delivery and security under its own retention rules; we keep no copies.
• Emails: kept for up to one year after your enquiry has been resolved, unless the law requires a longer period or we need them to establish, exercise or defend legal claims.
• Rendezvous offers: deleted as soon as they are delivered, at the latest after 120 seconds; IP addresses are not stored.

When a retention period ends, we delete the data without undue delay so that it cannot be restored.

8. Recipients and processors

We do not sell personal data or share it with third parties for their own purposes. We use the following service providers, who process data on our behalf:

• Cloudflare, Inc. (USA): Website hosting, content delivery and security.
• Google LLC (USA): email (Gmail) for answering enquiries.
• Railway Corporation (USA): hosting of the rendezvous service and its database (encrypted connection offers only).

We may disclose data if we are legally required to do so, for example by a binding order of a competent authority.

9. International transfers

We are based in the Republic of Korea, which the European Commission recognises as providing an adequate level of data protection. Our service providers may process data in other countries, including the United States. Where the GDPR applies, such transfers are based on an adequacy decision (for example the EU–U.S. Data Privacy Framework, where the provider is certified) or on Standard Contractual Clauses included in the providers’ data processing terms.

10. Your rights

Depending on the law that applies to you, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw any consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

To exercise your rights, email [email protected]. We respond within one month, which may be extended where the law allows, and may ask you to verify your identity. Because App data never reaches us, you manage it directly on your devices.

11. Children

The App and the Website are not directed at children. We do not knowingly collect personal data from children under 14, or under the higher age that applies in your country. If you believe a child has sent us personal data, please contact us and we will delete it.

12. Security

Devices authenticate each other using the Noise protocol framework, and all traffic between them is encrypted end to end with a separate key for each stream. Private keys are stored locally and protected by the operating system where available. The Website is served only over HTTPS with strict security headers. No system is perfectly secure; please report vulnerabilities to [email protected].

13. Connecting over the internet (rendezvous)

When your devices are not on the same local network, the App can connect them over the internet. To set up the connection, the two devices exchange a short connection offer through our rendezvous service, hosted by Railway Corporation (USA) with a PostgreSQL database. To learn its public network address, the App also contacts public STUN servers run by Cloudflare, Inc. and Google LLC, which see only the device’s IP address and port.

Each offer is encrypted end to end with a key that only your two paired devices can compute, and it is stored under a random-looking mailbox ID. The service cannot read offers and never learns device IDs, names or keys; the network addresses inside an offer can be read only by your other device.

Like any internet service, the rendezvous service receives the IP address of the connecting device. It uses it only in memory to limit abuse and neither stores nor logs it. Offers are deleted as soon as they are delivered, and at the latest after 120 seconds. Your content then travels directly between your devices and never through the rendezvous service.

You can turn internet connections off by setting the environment variable PDB_RENDEZVOUS to “off”; the App then works only on your local network.

14. Korean Personal Information Protection Act

As we are established in the Republic of Korea, we also comply with the Personal Information Protection Act (PIPA). Our privacy officer is 이유상, who can be reached at [email protected]. The Korean version of this policy contains the additional disclosures required by the PIPA.

15. Changes to this policy

We may update this policy when our software or the law changes. We will publish the new version on this page with a new effective date and announce material changes on the Website in advance. This policy is effective from September 24, 2026.