Privacy policy

Last updated: 7 August 2026

This policy covers snap-drop.net, operated by lilac. It describes this instance specifically. If you are using a self-hosted copy of SnapDrop, this policy does not apply to you — ask whoever runs it.

The short version

Files you send never reach our server. They go directly from one device to the other, encrypted by your browser. We have no copy, no log of what you sent, and no way to recover it. The server exists to introduce two devices to each other, and that introduction is the only thing it handles. How it works explains the mechanics.

This site does show advertising, which does involve third-party cookies. That part is set out in full below.

What the service handles

Your IP address

The server sees the IP address your connection comes from and uses it to group devices that appear to share a network, so they can discover each other. It is held in memory for the duration of your connection and discarded when you disconnect. It is not written to a database — there is no database.

Your browser's User-Agent

Used to label your device in other people's lists — "Android Chrome", "Windows Firefox". Held in memory for the duration of your connection.

A random device identifier

When you connect, the server generates a random identifier for your device and sends it to your browser, which keeps it in session storage for as long as the tab is open. Your display name is derived from it. It is not derived from anything about you or your device. It survives a reload or a dropped connection, so your device keeps the same name within a session, but closing the tab discards it — come back later and you get a new identifier and a new display name. A display name you set yourself is stored on your device and does persist, until you clear site data.

Pairing secrets and room codes

If you pair devices, both hold a shared secret used to find each other. The server keeps a routing entry for it in memory so it can put your devices in the same room. Unpairing removes it. Public room codes work the same way and disappear when the last person leaves.

Nothing in that list is written to persistent storage by the application. Restarting the server discards all of it.

What we never handle

• The contents of files, messages, or links you transfer.
• Filenames, file sizes, or file types.
• A record of who sent what to whom.
• Any account, email address, or profile — there are none.

This instance runs no TURN relay and no WebSocket transfer fallback, so there is no configuration in which transferred data passes through infrastructure we operate. If a direct connection cannot be made, the transfer fails instead.

Storage on your own device

SnapDrop itself sets no cookies. It uses your browser's local storage, session storage, and IndexedDB to hold your device identifier, your preferences, pairing secrets, and files handed to it by the system share sheet. This data stays on your device. Clearing site data for snap-drop.net removes all of it and unpairs your devices.

Third parties

Cloudflare and Fly.io

This site is served through Cloudflare and hosted on Fly.io. Both necessarily process connection metadata, including your IP address, to route and serve requests, under their own privacy policies.

Google STUN

To find a route between two devices, your browser queries Google's public STUN server at stun.l.google.com. This reveals your IP address to Google. It carries no file data and no information about what you are transferring.

Google AdSense

See below.

Advertising

This site uses Google AdSense to fund its running costs. When advertising is active, the AdSense script loads on the application page and the cookies described below may be set.

• Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
• You may opt out of personalised advertising by visiting Google Ads Settings.
• You can opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info/choices or the NAI opt-out page.

Ad units are placed outside the transfer area and file data is never passed to them. We should be precise rather than reassuring here: ad code is a third-party script running in the same page as the application, so it has the access that any script in a page has. What we can say concretely is that files are never uploaded, never written to a server, and never handed to advertising code by the application.

If you are in the EEA, the UK, or Switzerland, personalised advertising requires consent collected through a Google-certified consent management platform. That platform is not yet in place on this site, and until it is, no personalised advertising is served to you.

Children

This service is not directed at children under 13, and we do not knowingly collect information from them. Since there are no accounts, we hold nothing that would identify a user's age.

Your rights and contact

Because we hold no persistent personal data and no accounts, there is generally nothing to export or delete on our side — anything relating to you lives in your own browser, and clearing site data removes it. If you have a question or a request about your data, write to [email protected].

Changes

Material changes to this policy will be reflected in the "last updated" date above. Because this page is served fresh rather than cached offline, you always see the current version.