Privacy policy

Last updated: 13 September 2026

This policy covers snap-drop.net, operated by lilac. It describes this instance specifically. If you are using a self-hosted copy of SnapDrop, this policy does not apply to you — ask whoever runs it.

The short version

Files you send never reach our server. They go directly from one device to the other, encrypted by your browser. We have no copy, no log of what you sent, and no way to recover it. The server handles device discovery and connection signalling while the page is open. How it works explains the mechanics.

The application's ad placements are currently disabled. The application page still loads Google's AdSense library for site verification, which contacts Google even while those placements are disabled. The third-party data handling is described below.

What the service handles

Your IP address: The server sees the IP address your connection comes from and uses it to group devices that appear to share a network, so they can discover each other. It is held in memory for the duration of your connection and discarded when you disconnect. It is not written to a database — there is no database.
Your browser's User-Agent: Used to label your device in other people's lists — "Android Chrome", "Windows Firefox". Held in memory for the duration of your connection.
A random device identifier: When you connect, the server generates a random identifier for your device and sends it to your browser, which keeps it in session storage for as long as the tab is open. Your display name is derived from it. It is not derived from anything about you or your device. It survives a reload or a dropped connection, so your device keeps the same name within a session, but closing the tab discards it — come back later and you get a new identifier and a new display name. A display name you set yourself is stored on your device and does persist, until you clear site data.
Pairing secrets and room codes: If you pair devices, both hold a shared secret used to find each other. The server keeps a routing entry for it in memory so it can put your devices in the same room. Unpairing removes it. Public room codes work the same way and disappear when the last person leaves.

Nothing in that list is written to persistent storage by the application. Restarting the server discards all of it.

What we never handle

The contents of files, messages, or links you transfer.
Filenames, file sizes, or file types.
A record of who sent what to whom.
Any account, email address, or profile — there are none.

This instance runs no TURN relay and no WebSocket transfer fallback, so there is no configuration in which transferred data passes through infrastructure we operate. If a direct connection cannot be made, the transfer fails instead.

Storage on your own device

SnapDrop itself sets no cookies. It uses your browser's local storage, session storage, and IndexedDB to hold your device identifier, your preferences, pairing secrets, and files handed to it by the system share sheet. This data stays on your device. Clearing site data for snap-drop.net removes all of it and unpairs your devices.

Third parties

Cloudflare and Fly.io: This site is served through Cloudflare and hosted on Fly.io. Both necessarily process connection metadata, including your IP address, to route and serve requests, under their own privacy policies.
Google STUN: To find a route between two devices, your browser queries Google's public STUN server at stun.l.google.com. This reveals your IP address to Google. It carries no file data and no information about what you are transferring.
Google AdSense: See below.

Advertising

This site is preparing to use Google AdSense to help fund its running costs. Its ad placements are currently disabled, but the AdSense library loads on the application page for site verification. Loading it sends a request to Google, including your IP address and browser request metadata; third-party cookies or local storage may also be used. Disabling the placements does not prevent that library request. The informational pages, including this privacy policy, do not load the AdSense library.

Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites.
Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
You may opt out of personalised advertising by visiting Google Ads Settings.
You can opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info/choices or the NAI opt-out page.

The application does not pass file data to advertising code. However, the AdSense library is a third-party script running in the same page as the application, so it has the access that any script in a page has. The application sends your files over the peer connection and does not upload them to a server or hand them to advertising code.

If you are in the EEA, the UK, or Switzerland, personalised advertising requires consent collected through a Google-certified consent management platform. That platform is not yet in place on this site, and until it is, no personalised advertising is served to you.

Children

This service is not directed at children under 13, and we do not knowingly collect information from them. Since there are no accounts, we hold nothing that would identify a user's age.

Your rights and contact

Because we hold no persistent personal data and no accounts, there is generally nothing to export or delete on our side — anything relating to you lives in your own browser, and clearing site data removes it. If you have a question or a request about your data, write to contact@snap-drop.net.

Changes

Material changes to this policy will be reflected in the "last updated" date above. Because this page is served fresh rather than cached offline, you always see the current version.