Who operates this service
This SyncDrop deployment is controlled by The operator of this SyncDrop deployment.
A public privacy contact has not been configured yet.
Data SyncDrop processes
- Room content: messages, uploaded files and photos, filenames, file sizes, MIME types, and timestamps.
- File safety: filenames, declared MIME types, and the initial bytes of uploaded files are inspected for blocked executable, script, macro-enabled, and binary signatures before a file becomes available.
- Room records: room code, creation and expiry times, lifecycle settings, joins, closures, and moderation events.
- Connection data: anonymous visitor ID, IP address, country inferred from IP, User-Agent, device information, and activity times.
- Site analytics: landing path, visit time, anonymous visitor ID, IP address, country, and User-Agent. Repeated page loads are grouped into a 30-minute visit window.
- Security events: successful and failed password checks, temporary lockouts, file-safety results, administrative actions, and reports.
Why the data is used
- To create rooms, synchronise messages, transfer files, and let invited participants enter.
- To enforce room lifetimes, password protection, upload limits, and abuse controls.
- To investigate reports, preserve an accountable moderation record, and protect the service.
- To measure visits and room creation using first-party, pseudonymous analytics.
Data is not collected for advertising, sold, or used for behavioural advertising by SyncDrop.
Passwords and access tokens
Room and administrator passwords are never stored or written to logs in readable form. SyncDrop stores an Argon2id hash with a unique salt and a separate server-side pepper. Logs may record that a password existed and whether a check succeeded or failed, but never the password itself.
Room and administrator access cookies contain signed or random tokens, not passwords. They are marked HttpOnly and Secure on the public HTTPS site.
Retention and anonymity
SyncDrop does not require a personal account, name, or email address. Participants use randomly generated pseudonymous identifiers.
During this laboratory project, room content, file records, IP address, country, User-Agent, and timestamps may be processed to operate, secure, and evaluate the system. This information is pseudonymous, not fully anonymous.
Stored files are removed when a room closes. Protected technical and moderation records may be retained for up to 120 days. Before any public launch, the data collection, retention settings, participant notice, and operator details will be reviewed and updated.
Cookies and browser storage
SyncDrop uses first-party access data to keep a browser inside a room, maintain a protected administrator session, recognise an anonymous browser, and avoid counting repeated page loads as new visits. It does not use advertising cookies or third-party tracking pixels.
Room access cookies expire with the room. The analytics visit window lasts 30 minutes; the anonymous visitor cookie lasts up to 120 days from the time it is set.
Service providers and transfers
SyncDrop uses Supabase for authentication, database, realtime delivery, and private file storage. The hosting provider also processes requests needed to deliver the site. The deployment operator must publish the final provider locations and any applicable international-transfer safeguards before launch.
Your choices and rights
Depending on the law that applies to you, you may be able to request access, correction, deletion, restriction, portability, or to object to certain processing. A request may require enough information to locate the relevant room or visitor record and to verify that it belongs to you.
You may also have the right to complain to your local data-protection authority. Deleting browser data removes local access tokens but does not automatically erase the protected moderation archive.
Security and sensitive content
Transport is encrypted with HTTPS on the public deployment, storage is private, and administrative access is separately protected and audited. No online service can guarantee absolute security. Do not upload content unless you are authorised to share it, and do not treat a room link as a substitute for the room password.
Changes
This notice is effective from 20 August 2026. Material changes to the categories, purposes, or retention of data should be reflected here before they take effect.