Privacy Policy

Last updated: November 15, 2026

This policy covers PaperSafeAI Drop (drop.papersafeai.com), operated by PAPERSAFEAI LABS PRIVATE LIMITED. Other apps from PAPERSAFEAI LABS PRIVATE LIMITED, including PaperSafeAI, have their own privacy policies.

In short: we keep what you add to a drop only for 14 days, only so the host can see and download it, and then delete it. We use no cookies, trackers or ads, and never store your IP address itself.

1. What we store, and why

• Files you add (photos and videos, with their original file names), so the host can see and download them.
• A small preview of each photo or video, made on your own phone when you add it, so the host's gallery does not have to load full-size files.
• The name you type when adding files (optional), so the host knows who sent them.
• The drop's name and album names, and an optional PIN, which we store only in hashed form.
• Sent documents (if sending is available): only encrypted. The key is in the link the sender shares and never reaches us, so we cannot read the files or their names. We store their size, when they were sent, how many times they were downloaded, and the id of the PaperSafeAI licence that sent them (never the licence key itself).
• The host's email address, only if the host gives one: to send a confirmation, a new host link when asked for, and reminders before the drop is deleted. Nothing but the confirmation is sent until the host confirms the address, and every reminder has a link to stop them.
• A hash of your IP address when you create a drop or report one, to limit abuse (for example, how many drops one person can create in a day). We never store the IP address itself.
• Abuse reports: what you write when you report a drop.

2. What stays in your browser

Your browser keeps the name you typed, so you don't have to type it again, and any upload that has not finished yet, so you can resume it after closing the page. Both stay on your device and are removed when the upload finishes; you can also clear them with your browser's site data settings.

3. Who can see your files

• The host of the drop, through their private host link.
• Guests cannot see each other's files.
• We do not look at files, except when we review a drop that was reported or that we must check by law.

4. How long we keep it

Everything in a drop (files, previews, names, the host's email, PIN hash and the drop record) is deleted 14 days after the drop is created, or sooner if the host deletes a file or we take the drop down. Abuse reports are deleted with the drop they refer to. Our database keeps automatic recovery points for up to 30 days, used only to recover from failures; drops deleted from the service are not restored from them.

5. Who handles it

The service runs on Cloudflare (Workers, R2 storage and D1 database), which processes the data for us. Some of this processing happens outside India, in Cloudflare data centres in other countries. Emails are sent through Resend, which receives the host's email address and the message for that purpose only. Creating a drop uses Cloudflare Turnstile to check you are human; Turnstile processes information about your browser to do this, under Cloudflare's privacy policy. Everything travels over HTTPS.

6. Your rights and choices

• Delete: the host can delete any file at once from the host page. If you added files, the quickest way to have them removed is to ask the host. Everything is deleted after 14 days in any case.
• Download: the host can download every file at any time before the drop expires.

If you are in India

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• get a summary of the personal data we process about you, what we do with it, and who we have shared it with;
• have it corrected, completed or updated;
• have it erased, unless we must keep it to comply with the law;
• withdraw your consent at any time, as easily as you gave it; this stops processing based on that consent, but does not undo processing already done;
• have a grievance about how we handle your personal data heard and answered by us; and
• nominate another person to exercise these rights for you if you die or become unable to act.

If you are not satisfied with our answer to a grievance, you may complain to the Data Protection Board of India.

If you are in the United States

Depending on the state you live in, you may have the right to know what personal information we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale or its use for targeted advertising. We do not sell personal information, do not share it for targeted (cross-context behavioural) advertising, and do not use it to profile you. We will not treat you differently for using any of these rights.

How to use these rights

Email support@papersafeai.com. Tell us which drop your request is about (the drop's link or name), because we hold no accounts and cannot look you up by name or email. We may ask you to confirm that the request comes from you. We will reply as soon as we can.

7. Children

Creating a drop is for adults (18 and over). Hosts are responsible for any photos of children they collect.

8. Changes to this policy

If this policy changes, we will update the "Last updated" date above.

9. Contact us

Questions about this policy or your data? Email support@papersafeai.com. Grievances about how we handle your personal data, including under India's Digital Personal Data Protection Act, 2023, go to the same address. PaperSafeAI Drop is operated by PAPERSAFEAI LABS PRIVATE LIMITED.