Privacy Policy

Last updated: October 25, 2026 · Applies to the AnyDrop web app at anydrop.space-z.ai, the AnyDrop Chrome extension, and the realtime service that powers them.

1. What AnyDrop is

AnyDrop is a tool for moving text, links, files, and photos between your own devices — typically a phone and a Chrome desktop browser — the way Edge Drop does, but open and cross-platform. Devices meet in a “room” identified by a 6-character code (typed manually, or shared via QR code), and anything dropped into the room appears on the other paired devices in real time. This policy explains exactly what data touches the server, how long it stays there, and what never leaves your devices.

2. What is stored on the server, and for how long

To move something from device A to device B, the content has to exist somewhere both can reach. That somewhere is the AnyDrop server, and it keeps three kinds of data:

• Drops — the text, links, and uploaded files or images you send (files up to 25 MB). These are stored in a plain database on the server purely so your other device can fetch them. Every drop is deleted automatically 24 hours after it is created, and deleting a drop in the UI removes it immediately for everyone in the room.
• Room codes — the 6-character identifiers of created rooms. A room code exists only so your devices can find each other; it is not connected to any name, email, device fingerprint, or account.
• Nothing else. There are no user profiles, no logs tied to identity, no email addresses, and no analytics events on the server.

QR codes you see in the interface are generated on the fly from the server address and/or room code by a rendering endpoint. The endpoint draws an image from the text you ask it to encode and keeps no record of it.

3. What we never collect

AnyDrop has no sign-up, so there is nothing to sign up with: we never ask for or store names, email addresses, phone numbers, or payment details. The site embeds no analytics scripts, no advertising networks, no social-media widgets, and no third-party fonts or trackers of any kind. We do not build profiles, we do not fingerprint devices, and there is no data to sell because none of this is collected in the first place.

4. Data kept on your own devices

A small amount of pairing state lives locally, so you don't have to re-type the room code every time:

• Web app (browser): your room code is kept in the browser's local storage and in a first-party cookie, both scoped to the AnyDrop site only. They hold nothing but the code and your server address. Clearing the site's data — or using the Leave room button — erases them completely.
• Chrome extension: the server URL, room code, and a counter of unseen drops are stored in the extension's own local storage. Removing the extension removes all of it.
• Clipboard: the “copy image” action writes a dropped image to your clipboard using standard browser APIs. That is a local operation between the page and your clipboard; the image is not sent anywhere new.

5. Camera use (Scan to connect)

The “Scan to connect” feature asks for camera permission only when you open the scanner, and only to read a QR code. Decoding happens entirely on your device — the video frames are processed in the browser or extension itself and are never recorded, uploaded, or stored anywhere. When you close the scanner the camera is released immediately. AnyDrop never sees what your camera sees.

6. The Chrome extension

The extension talks to the same server as the web app and to your browser only. Its right-click “Drop selection to AnyDrop” action sends the text you explicitly selected to your paired room — exactly as if you had pasted it into the popup yourself. It does not read pages in the background, does not watch your browsing, and requests only the minimal permissions it needs (storage, context menus, and opening its own scanner tab).

7. Who can see a room — honest security notes

A room is protected by its code alone: anyone who has the 6-character code can open the room and read what is in it from any device. There is no second factor. So treat a room code like the key to a shared mailbox between your own devices:

• Share codes and QRs only over channels you trust, and create a fresh room when in doubt.
• Don't drop passwords, recovery codes, or anything you wouldn't hand to a stranger holding the code.
• Prefer the HTTPS address (https://anydrop.space-z.ai) so pairing traffic is encrypted.
• Deleted drops are gone from the server, but a device may still show content it already received — deleting also helps there, since the room view refreshes.

8. Self-hosting: the strongest privacy option

The entire project — web app, Chrome extension, and realtime service — is open source on GitHub. You can run your own copy on your own machine or server, at which point every drop, room code, and byte flows only through infrastructure you control and this policy simply describes software you can audit line by line. The published instance at anydrop.space-z.ai runs exactly that same public code.

9. Your controls

• Delete a drop instantly — the trash icon removes it for the whole room, not just for you.
• Let it expire — do nothing and every drop is erased automatically after 24 hours.
• Leave a room — the Leave room button clears your pairing state in the web app.
• Wipe local state — clear the site's data in your browser, or uninstall the extension, and nothing pairing-related remains on that device.

10. Children's privacy

AnyDrop is a general-purpose utility and is not directed at children. Because there are no accounts, we collect no age information and hold no personal data that could identify anyone, of any age. Parents who prefer their children not use the service can simply not share a room code with them.

11. Changes to this policy

If the service changes in ways that affect this policy, the updated version will be posted on this page with a new “last updated” date. Material changes — anything beyond clarifications — will also be announced in the project's GitHub repository, so self-hosters and privacy-minded readers can review the relevant commits rather than take our word for it.

12. Contact

Questions, data concerns, or a bug report about privacy behavior? Open an issue at github.com/darwintjoe/anydrop/issues — it's the fastest way to reach the maintainer, and the discussion stays public and auditable.