Privacy Policy

• The contents of your files — they're encrypted (AES-256-GCM) in your browser before upload.
• Your decryption key — it lives only in the link fragment (after #) and is never sent to us.
• Your file's real name — it is stored encrypted.
• Any password you set — only a one-way hash (PBKDF2) is stored, never the password itself.

To run the service, we keep the minimum metadata needed for a drop to work:

• The encrypted file blob (until it expires or is deleted).
• Technical metadata: file size, content type, your chosen expiry and download limit, download count, the encrypted filename, an integrity hash, and timestamps.
• A hashed (not raw) IP address, used only to rate-limit abuse.
• A hash of your private management token, so we can verify you own a drop.

Every drop has an expiry and a download limit that you choose. When a drop expires, is revoked, or hits its download limit, both the encrypted blob and its metadata are deleted by an automated cleanup process. We don't keep copies.

Marsdrop does not use advertising or analytics tracking cookies, and we don't build profiles of you. Our bot-protection check (Cloudflare Turnstile) may set a short-lived token to confirm you're human; it is not used to track you.

We rely on a few infrastructure providers who process data on our behalf:

• Cloudflare R2 — stores the encrypted file blobs (ciphertext only).
• Cloudflare Turnstile — bot protection on uploads.
• Supabase — stores the technical metadata described above.

None of these providers receive your decryption keys or plaintext files.

You control each drop directly: set a short expiry, limit downloads, add a password, or revoke it instantly with your management link. For any questions about your data, contact us at hello@marsdrop.in.

We may update this policy as the product evolves. Material changes will be reflected by the "last updated" date above.