Privacy

QuickDrop is designed with privacy as a core principle. We don't track you, and we don't want to.

What we store

  • File metadata — name, size, type, expiry date. Stored in D1 until the file expires or is deleted.
  • Upload/download counts — for delete-after-download and rate limiting.
  • Country code — from Cloudflare's CF-IPCountry header, used for anonymous aggregate analytics (never linked to a specific user).
  • Encrypted password hash — if you set a password, only a PBKDF2-SHA256 hash is stored.

What we do NOT store

  • Email addresses or phone numbers
  • IP addresses (transiently used in KV for rate limiting with a 24h TTL, then discarded)
  • Cookies, tracking pixels, or analytics scripts
  • Browser fingerprints or user agents
  • Personal identifiers of any kind

File storage

File content is stored temporarily in a private Telegram chat or Cloudflare R2 bucket. File names are randomized before storage — the original name is only visible to you through the share link. No one browsing the storage backend can see what files belong to whom.

The share link contains a random token. The token cannot be guessed — only someone with the exact link can access the file.

Our Telegram group has a server-side auto-delete timer of 7 days as a safety net, but this is separate from the per-file expiry you select. Telegram may cache file blobs on their CDN beyond our control — once a file is sent to Telegram, we cannot guarantee its immediate removal from Telegram's infrastructure, even after we mark it as deleted. The authoritative deletion is our D1 soft-delete: the share link stops working immediately, and the file's metadata is gone.

Upload history (browser only)

Your recent uploads are stored only in your browser's localStorage. This data never leaves your device. Clearing your browser cache will remove it.

Data retention

Files are permanently deleted when the selected expiry period ends (1h to 7d). If "delete after first download" is enabled, the file is deleted immediately after the first download. Deleted files cannot be recovered.

Encryption

All transfers are encrypted in transit via HTTPS/TLS. Files are not encrypted at rest — for truly sensitive data, set a password (PBKDF2-SHA256 protected).

Third parties