Privacy Policy

Zero-Knowledge • No Data Collection

Last updated: July 29, 2026

1. What We Know (Very Little)

GhostDrop is designed as a zero-knowledge system. We collect only what is technically necessary to operate the service:

• Email address — if you create an account (used for login and optional email verification).
• Encrypted file blobs — we store only encrypted data. We cannot decrypt or read your files.
• Timestamps and metadata — upload time, file size (encrypted), view count, expiration settings.

2. What We Never See

• Decryption keys — they live in the URL fragment (#) and are never sent to the server.
• Filenames — encrypted client-side before upload.
• File contents — encrypted with AES-256-GCM before leaving your browser.
• MIME types — encrypted as part of the metadata bundle.

3. Data Retention

• Files are automatically deleted upon expiration (burn mode or time capsule expiry).
• A background cleanup worker permanently removes expired files from storage and database every 5 minutes.
• Account data is retained until you request deletion.

4. Third-Party Services

GhostDrop does not use analytics, tracking scripts, or third-party data processors. The service uses self-hosted infrastructure (PostgreSQL, Redis, MinIO) with no external data sharing.

5. Cookies

GhostDrop does not use tracking cookies. A local storage token is used for session management if you choose to log in.

6. Your Rights

• You may request deletion of your account and associated data at any time.
• You can delete individual files via the upload history panel.
• Since we cannot decrypt files, we cannot provide file contents upon request.

7. Security

All data in transit is encrypted via HTTPS (TLS). Encrypted files at rest use AES-256-GCM. The system enforces rate limiting and file size limits to prevent abuse.

8. Contact

For privacy-related inquiries, contact us at feedback@ghostdrop.geekgy.com.

← Back to Home