Privacy Policy for OpenDrop

1. Introduction

   OpenDrop ("we," "us," or "our") is a software product of NFDGames LLC, a South Carolina limited liability company. OpenDrop is a self-hosted, distributed file access and transfer system consisting of a mobile application (iPhone, iPad and Android) and an associated desktop server application (Windows and Linux). A macOS version has not been released.

   This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. It applies to the OpenDrop apps, associated websites (including nfdgames.com pages relating to OpenDrop), and any related services we provide (collectively, the "Service").

   For the purposes of the EU and UK General Data Protection Regulations ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), Quebec's Act respecting the protection of personal information in the private sector ("Law 25"), and other comprehensive privacy laws, NFDGames LLC is the controller of personal information processed in connection with the Service. You can reach us at support@nfdgames.com.

2. Information We Collect

   We collect only the information needed to operate the Service. The categories below match the disclosures in our Apple App Privacy nutrition labels and Google Play Data safety section.

   A. Account & Authentication Information.

   You only need an account to subscribe to OpenDrop Pro. If you use the free tier without signing in, we do not collect the information in this part A.

   • Email address, provided by your chosen sign-in provider (Google, Apple, Microsoft, or direct email/password via Firebase Authentication). Used to identify your account and to link your mobile and desktop devices to the same user.
   • Authentication-provider user ID (for example, your Firebase UID or Google user ID). Used to verify sign-in and to enforce access control between your own devices. We receive this from your authentication provider; we do not receive your password.
   • Truncated, salted hash of your account identifier (a 16-character SHA-256-derived "account hash"). Broadcast on your local network so that the OpenDrop apps on your own devices can recognize one another for LAN discovery. Phones that use Bluetooth transfers (OpenDrop Pro) also include it in Bluetooth Low Energy advertisements so your phones can find each other nearby. The hash cannot be reversed to recover your email or user ID by any practical means.

   B. Device & Connection Information.

   • Device identifier, a randomly generated, per-installation identifier (the "device_id") used to distinguish each device you own from your other devices. It is not an Apple IDFA / IDFV and is not used for advertising.
   • Device name, the human-readable name you give a device (defaulting to the operating-system name, e.g. "Nicholas's iPhone"). Used so you can pick the right destination when transferring files.
   • Platform & app version, for example, "iOS 18.4 / OpenDrop 1.0.0".
   • Relay address, the connection endpoint your devices use to reach each other through the OpenDrop relay when they are on different networks, stored so your mobile device can find your desktop.
   • Local network address & port (LAN IP / port), stored so that when two of your devices are on the same network, the mobile app can connect directly without going through the cloud.
   • HMAC shared secret, a randomly generated secret used to sign requests between your devices and to derive the end-to-end encryption keys used for file contents. On the free tier, the secret is made on your computer and shared with your phone only through the pairing QR code; our servers never receive it. With OpenDrop Pro, we store the secret in our key-value store and send it to each device signed in to your account, so your devices can connect to each other without a QR code. This means our account service holds the secret for Pro accounts.
   • Local network broadcast (mDNS). Within your local network, devices running OpenDrop announce their presence over multicast DNS (_opendrop._tcp.local.), including the device name and account hash. This information is broadcast only on your local network and does not leave that network.

   C. Subscription & Purchase Information.

   • Purchase platform identifier and entitlement state (free vs. OpenDrop Pro, subscription expiry date). Provided through Apple App Store In-App Purchase (iPhone and iPad), Google Play Billing (Android), Stripe Payment Links (Windows and Linux), and RevenueCat. We do not receive or store your payment card number, bank account, or full billing address. We receive only a confirmation of whether your subscription is active and when it expires.

   D. File Contents (End-to-End Encrypted in Transit).

   • When you transfer a file between your own devices, the contents are end-to-end encrypted using ChaCha20-Poly1305 IETF AEAD (RFC 8439) with a 256-bit content key derived via HKDF-SHA256 from the secret your devices share when you pair them (see Section 2(B) for who holds that secret). A fresh random nonce prefix is generated for each transfer. The encryption happens on the sending device before the bytes leave it, and the receiving device decrypts them. The encrypted bytes traverse one of several channels depending on network conditions: (i) direct LAN / Wi-Fi, normally over TLS with a certificate your computer creates for itself, which the OpenDrop mobile apps pin; (ii) a direct peer-to-peer (WebRTC) connection across networks, established using our own STUN servers for NAT traversal; (iii) our own WebSocket relay over TLS (on the free tier, the shared relay, used when a peer-to-peer connection cannot be made; with OpenDrop Pro, the Pro relay, which is tried before peer-to-peer and falls back to the shared relay); or (iv) Bluetooth Low Energy between two phones signed in to the same OpenDrop Pro account, when no network is available. Encryption is applied on every one of these channels. There is no transfer path that moves plaintext bytes. Relay servers carry file contents only in encrypted form. They can see transfer details such as file names, folder names, file sizes and device names, which they need to route transfers. Relay nodes hold encrypted bytes only transiently while routing them and do not persist file contents. The v1.0 client and server refuse to send or accept unencrypted file bodies; pre-1.0 clients must update before they can transfer files.

   E. Diagnostic & Analytics Information.

   • In-app usage statistics (our own analytics). The OpenDrop mobile and desktop apps send basic usage statistics to our own server at intervals: whether the app is active, platform (iOS, Android, Windows or Linux), app version, subscription tier (Free or Pro), distribution channel (App Store, Play Store, Microsoft Store, direct, etc.), and an approximate country derived by Cloudflare from your connection IP. Our server also keeps error counts. If you are signed in, these statistics are stored under a shortened SHA-256 hash of your email address, not the email address itself. If you are not signed in, they are stored under the app's random device identifier. Nothing about your files is included. You can turn this off at any time in Settings with Disable basic analytics; when it is off, the app transmits an X-OpenDrop-Analytics-OptOut: 1 header and our infrastructure discards the ping without recording it.
   • Website analytics and conversion measurement tags (third-party). Our public websites (including nfdgames.com and the OpenDrop landing, support, and policy pages) load tags from Google Analytics 4 (Google LLC), Google Firebase (Google LLC), and a Google Ads conversion-measurement tag (Google LLC). These services collect information that may include your IP address, browser and device characteristics, the pages you visit on our site, referring URLs, approximate geolocation derived from your IP, and identifiers stored in cookies or similar storage. The data collected by these tags is sent directly to Google and is processed under Google's own terms and privacy policy.
   • No on-site advertising and no advertising-funded business. NFDGames LLC does not display third-party advertising on nfdgames.com, on any OpenDrop page, or inside the OpenDrop mobile or desktop applications. The Google Ads tag described above is used only to measure download conversions from any marketing we may run on Google's own platforms (for example, Google Search ads pointing to OpenDrop). The OpenDrop business model is paid subscriptions (OpenDrop Pro); we have no ad revenue and do not sell ad inventory.
   • What Google may do with the data. Google may combine the information its tags collect from our sites with information from other Google products and from third parties, and may use, share, transfer, or monetize that information for its own commercial purposes. Depending on your jurisdiction and applicable law, those Google-side uses may be characterized as a "sale" or "share" of personal information under the California Consumer Privacy Act and similar U.S. state laws. NFDGames LLC does not receive payment for, and does not itself sell, this information; the commercial use is performed by Google as the recipient service. See Section 9 below for additional detail and your opt-out options.

   F. Application & Preference Data (Stored on Your Device).

   • Settings such as your selected theme, storage-location preferences, favorited devices, and similar local choices remain on your device in standard application-preferences storage (e.g., SharedPreferences on Android, NSUserDefaults on iOS, JSON files on desktop). We do not transmit these to our servers.
   • iOS App Group container. On iOS, the OpenDrop main app and its Share Extension share a sandboxed container (group.com.nfdgames.opendrop) so that files you send to OpenDrop from another app's share sheet can be handed off to the main app without being copied through any external service. The container lives entirely on your device.

   G. Network Operations Data (Processed but Not Persisted Long-Term).

   • IP address. Cloudflare, Fly.io, and Oracle Cloud see your IP address when your device connects, and may use it for rate limiting, DDoS mitigation, and routing. We do not persist raw IP addresses in our application databases; Cloudflare, Fly.io, and Oracle Cloud retain connection metadata for short periods as described in their own privacy policies (linked in Section 4).

   H. OS-level Permissions and System Capabilities We Request.

   The OpenDrop apps declare the following operating-system permissions and capabilities. Each is used only for the purpose described; we do not repurpose any of them for tracking, profiling, or advertising.

   • Local Network access (iOS) and Wi-Fi state / multicast (Android). Required to discover your other OpenDrop devices on the same Wi-Fi via multicast DNS (Bonjour service type _opendrop._tcp.local.), and to open a direct LAN connection between them.
   • Bluetooth (always available) on iOS, and BLUETOOTH_SCAN / _CONNECT / _ADVERTISE on Android 12+. Required for Bluetooth Low Energy transfers between two phones signed in to the same OpenDrop Pro account when no network is available, and for finding those phones nearby. iOS additionally requests the Bluetooth-Peripheral permission for backward compatibility with iOS < 13.
   • Approximate-location entitlement on Android (ACCESS_FINE_LOCATION, maxSdkVersion="30"). Android 6 through 11 require this entitlement solely to enable Bluetooth Low Energy scanning. We do not read your latitude or longitude, do not enable GPS, and do not log, transmit, or store any location coordinate. On Android 12+ the BLE scanner is granted without this entitlement and we no longer request it. (Google Play's Data Safety form treats this declaration as "Location: Not collected" because the entitlement is BLE-scoped.)
   • Camera. Used only when you open the QR-code scanner screen to pair your phone with your desktop. We do not record video, do not capture photos, and do not retain camera frames.
   • Photo Library (read and add) on iOS, and READ_MEDIA_IMAGES / _VIDEO on Android 13+. Used so you can pick photos and videos to send and so that incoming photos and videos can be saved into the system photo library. We never upload photos to our servers. Photos are encrypted on-device and sent only to your other devices.
   • Background app refresh and background processing tasks. Implemented on iOS via UIBackgroundModes: fetch, processing and the BGTaskScheduler identifier com.bbflight.background_downloader.refreshtask, and on Android via a foreground service with WAKE_LOCK. Used to let long-running file uploads continue when the app is backgrounded or the screen is off. No personal data is collected from these background runs; they exist solely to complete in-flight transfers you started.
   • Share-extension and share-target intent handling. Implemented on iOS via the share-extension URL scheme ShareMedia-com.nfdgames.opendrop, and on Android via SEND / SEND_MULTIPLE intent filters. Used so you can pick OpenDrop from the system "Share to..." sheet in any other app and have those files handed to the OpenDrop send queue. Files shared this way stay on your device until you tap "Send."
   • Local notifications. Implemented via Apple UNUserNotifications on iOS and the equivalent OS API on Android. The OpenDrop apps may show local OS notifications about transfer state, sign-in events, or background-upload completion. These notifications are generated on your device and do not leave it. We do not currently send any remote push notifications, and we do not register your device with Apple Push Notification service (APNs) or Firebase Cloud Messaging for marketing.
   • Universal-link and app-link domain opendrop.n-fantinodyer.workers.dev. Registered as an iOS associated domain and an Android App Link so that links our Cloudflare Worker generates (for example, account verification or pairing URLs) open directly in the OpenDrop app instead of a browser. The domain is the same Cloudflare Worker disclosed in Section 4.

   What We Do Not Collect.

   • We do not collect precise GPS or device location.
   • We do not collect contacts, photos library metadata, calendar, microphone, or camera data, except that the in-app QR scanner accesses the camera only when you open the QR scan screen, and only to read the on-screen QR code.
   • We do not collect file contents or thumbnails on our servers. We do not collect file names or folder names either, except that relay servers see file names, folder names, file sizes and device names while they route a transfer (see Section 2(D)).
   • We do not display advertising, anywhere. The OpenDrop mobile and desktop applications do not embed third-party advertising SDKs and do not display advertising in-app. Our public websites do not show display advertising either. Our sites do load Google Analytics, Firebase, and a Google Ads conversion-measurement tag (used only to count downloads from marketing we may run on Google's own platforms), all as described in Section 2(E) and Section 4.
   • We do not knowingly collect any information from children under 13. See Section 10.

3. How We Use Your Information and Legal Bases (GDPR / UK GDPR)

   We use each category of information only for the purposes listed below. Where the GDPR or UK GDPR applies, we identify the legal basis under Article 6(1) for each purpose.

   • Operating the Service (device pairing, file transfer, presence). Account, device, and connection information. Legal basis: performance of a contract (Article 6(1)(b)). This is what lets us provide the Service you signed up for.
   • Authentication and account security. Account identifier, HMAC shared secret, session tokens. Legal basis: performance of a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) in keeping accounts secure.
   • Subscription management. Purchase platform identifier and entitlement state. Legal basis: performance of a contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)) such as tax records.
   • Service abuse prevention, rate limiting, and infrastructure security. Connection IP (at the Cloudflare, Fly.io, and Oracle Cloud edge), request rate. Legal basis: legitimate interests (Article 6(1)(f)) in protecting the Service.
   • Analytics: understanding how OpenDrop is used in aggregate. Basic usage statistics (platform, country, tier, app version, distribution channel, error counts, and a hashed email address or random device identifier). Legal basis: legitimate interests (Article 6(1)(f)) in improving the Service. You may opt out at any time in Settings; opt-out is also accepted as withdrawal of consent under Article 7(3).
   • Customer support and communications about the Service. Email address and messages you send us. Legal basis: performance of a contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).
   • Legal compliance, dispute resolution, and enforcement of terms. Legal basis: compliance with legal obligations (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)).

   We do not engage in automated decision-making, including profiling, that produces legal or similarly significant effects on you under GDPR Article 22 or Quebec Law 25 Section 12.1.

   AI-assisted development; no AI training on your data. The OpenDrop applications, our websites, and our documentation (including this Privacy Policy) were developed with the assistance of artificial-intelligence ("AI") tools, working under human direction and review. That assistance occurred during development only. The Service itself does not currently include AI features: no AI system processes your personal information or your file contents as part of operating the Service, and we do not use your personal information or your file contents to train any AI or machine-learning model, whether our own or a third party's. (File contents are encrypted on your device before they are sent, and relay servers carry them only in encrypted form; see Section 5.) If a future release adds an AI-powered feature, we will update this Privacy Policy as described in Section 13 before that feature processes any personal information.

4. Sub-Processors and Service Providers

   We use the following service providers ("sub-processors") to operate the Service. Each is bound by its own privacy commitments and a data-processing relationship with us. We share with each sub-processor only the information necessary to perform its function.

   • Cloudflare, Inc. (United States), Workers, KV, and Cache services. Runs our control-plane Worker for device pairing, presence, and key exchange, and stores ephemeral device records, relay addresses, and HMAC secrets for OpenDrop Pro accounts in its key-value store. Processes IP addresses for security and DDoS protection. Privacy policy: cloudflare.com/privacypolicy.
   • Fly.io, Inc. (United States). Hosts the OpenDrop Pro relay (used by Pro subscribers). Carries file contents only in end-to-end-encrypted form and does not persist them. Sees the file names, folder names, file sizes and device names needed to route transfers. Privacy policy: fly.io/legal/privacy-policy.
   • Oracle Corporation (Oracle Cloud Infrastructure) (United States). Hosts the shared OpenDrop relay used by the free tier and as automatic backup for Pro. Carries file contents only in end-to-end-encrypted form and does not persist them. Sees the file names, folder names, file sizes and device names needed to route transfers. Privacy policy: oracle.com/legal/privacy.
   • Google LLC / Firebase (United States), Firebase Authentication and Cloud Identity Platform for email/password, Google, and federated sign-in; Firebase analytics and remote configuration on the websites. Privacy policies: firebase.google.com/support/privacy and policies.google.com/privacy.
   • Google LLC (Google Analytics 4) (United States). Website traffic and engagement analytics on nfdgames.com and the OpenDrop landing, support, blog, and policy pages. Collects IP address, browser and device characteristics, referring URL, pages viewed, and identifiers stored in cookies. Google acts as an independent business in its own right with respect to the data it collects and may use that data for its own purposes (including, where applicable, activity that may be characterized as a "sale" or "share" of personal information under the CCPA/CPRA and similar state laws). Privacy policy: policies.google.com/privacy. How Google uses data from sites that use its services: policies.google.com/technologies/partner-sites. You may opt out of Google Analytics across the web by installing Google's browser add-on: tools.google.com/dlpage/gaoptout.
   • Google LLC (Google Ads conversion measurement tag only) (United States), a single conversion-measurement tag on our OpenDrop landing page that fires when a visitor clicks a download button, so that any marketing we run on Google's own platforms (for example, Google Search ads pointing to OpenDrop) can attribute a download to a click. We do not display Google ads on our websites, and we do not currently operate Google Ads remarketing or audience-building campaigns. The tag may read or write cookies (including _gcl_*) and may send your IP address and click event to Google. Independently of our use, Google may use the data the tag collects for Google's own purposes; depending on jurisdiction and applicable law, those uses may be characterized as a "sale" or "share" of personal information for cross-context behavioral advertising under the CCPA/CPRA and similar state laws (see Section 9). Manage Google ad personalization at adssettings.google.com; manage industry-wide advertising preferences at optout.aboutads.info (U.S.) and youronlinechoices.eu (EU).
   • Apple Inc. (United States), Sign in with Apple and App Store In-App Purchase processing on iPhone and iPad. Privacy policy: apple.com/legal/privacy.
   • Microsoft Corporation (United States), Microsoft Account sign-in (when selected by you) and Microsoft Store distribution. Privacy policy: privacy.microsoft.com.
   • RevenueCat, Inc. (United States). Subscription state management and cross-platform entitlement sync. Privacy policy: revenuecat.com/privacy.
   • Stripe, Inc. (United States), Payment Links for OpenDrop Pro purchases made from the Windows and Linux desktop apps. Stripe processes your payment card details directly; we do not see or store them. Privacy policy: stripe.com/privacy.
   • Grafana Labs (United States), Grafana Cloud for aggregate, anonymous analytics dashboards. Privacy policy: grafana.com/legal/privacy-policy.
   • Formspree (United States). Receives the support ticket form on our website and forwards messages to our support inbox. Privacy policy: formspree.io/legal/privacy-policy.

   Some of these providers are located in the United States and other countries that may not offer the same level of data-protection law as your country of residence. Where required, we rely on the EU-US Data Privacy Framework, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or equivalent transfer mechanisms for cross-border transfers of personal data.

   NFDGames LLC does not itself sell your personal information for money, and we do not receive any direct or indirect monetary consideration for the personal information collected through the Service. We do not provide your personal information to independent data brokers. Apart from sub-processors that act on our instructions, we disclose personal information to third parties only (a) with your direction or consent, (b) to comply with valid legal process, or (c) where necessary to protect the rights, property, or safety of NFDGames LLC, our users, or the public.

   However, you should be aware that some U.S. state privacy laws (most notably the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and similar laws in Colorado, Connecticut, and other states) define "sale" and "share" broadly enough that the operation of common third-party analytics tags can fall within those definitions, even when no money changes hands and no display advertising is shown. Our websites use Google Analytics 4, Firebase, and a single Google Ads conversion-measurement tag, all operated by Google LLC. Google collects information from those tags directly, processes it under its own terms, and may use, share, transfer, combine with information from other sources, or monetize that information for Google's own commercial purposes. To the extent those Google activities constitute a "sale" or "share" of personal information under your state's law, that sale or share is performed by Google, not by NFDGames LLC. See Section 9 for the opt-out mechanisms we make available.

   A current list of sub-processors is maintained on this page. We will update this list as new sub-processors are engaged.

5. Data Security

   • End-to-end encryption of file contents. File bytes are encrypted on the sending device using ChaCha20-Poly1305 IETF AEAD (RFC 8439, an authenticated cipher) with a 256-bit content key derived via HKDF-SHA256 from the secret your devices share when you pair them. A fresh random nonce prefix is generated per transfer. Encryption is applied on every file-content transfer path: chunked uploads, streaming uploads, downloads (including range-sliced chunks), thumbnails, device-to-device relays, local Wi-Fi / LAN, and Bluetooth Low Energy (between phones, with OpenDrop Pro). The encryption runs on Apple CryptoKit (iPhone and iPad) or Android's BoringSSL (API 28+) where available, with a pure-Dart fallback elsewhere; the wire format is identical across implementations. Relay servers carry file contents only in encrypted form. On the free tier, our servers never receive the shared secret; with OpenDrop Pro, our account service stores it so your signed-in devices can connect to each other (see Section 2(B)).
   • No plaintext fallback. The v1.0 app release (mobile and desktop) advertises and enforces protocol version 2 of the OpenDrop wire format, which makes end-to-end encryption mandatory on every file-content path. The v1.0 client and server refuse to send or receive unencrypted file bodies. Pre-1.0 clients running protocol version 0 or 1 (which predate end-to-end encryption) are rejected with an "Upgrade Required" response and must update to a v1.0+ build before they can transfer files. This removes the downgrade-attack surface where an attacker could otherwise strip the encryption header and force an unencrypted body.
   • Filename privacy is out of scope. End-to-end encryption protects file contents. File names, folder names, paths, sizes, modification timestamps, and device names remain visible to the metadata layer (Cloudflare worker, KV records, the connecting relay) so the service can route requests and present folder listings. If filename privacy is a requirement for your use case, encrypt the filename into the file contents yourself before transferring.
   • Transport-layer encryption. Beyond end-to-end encryption of file contents, connections from your devices to our account service and relay servers use TLS, including the WebSocket relay connections your devices open to us. On your local network, your computer serves the apps over TLS with a certificate it creates for itself, and the OpenDrop mobile apps pin that certificate so they only talk to the computer you paired with. If your computer cannot set up its certificate, local connections fall back to plain HTTP; file contents are still encrypted as described above. Peer-to-peer connections use DTLS. Bluetooth transfers do not use TLS and rely on the file-content encryption.
   • Authenticated requests. Requests between your devices are authenticated with HMAC-SHA256 using the secret your devices share. Each signature covers the method, path, query, device ID and a timestamp, and expires after 5 minutes.
   • Authentication. Sign-in is performed by Firebase Authentication using industry-standard OAuth 2.0 / OpenID Connect flows. Passwords (where you choose email/password sign-in) are handled by Firebase and never visible to us.
   • Storage of secrets. Tokens and the HMAC shared secret are stored on your device in OS-provided secure storage where available (iOS Keychain, Android Keystore, flutter_secure_storage) or in a permission-restricted local file otherwise.
   • Limits of security. No system can guarantee absolute security. You are responsible for keeping your sign-in credentials and shared secret confidential and for securing your own devices (screen lock, OS updates, etc.).

6. Analytics & Usage Data

   A. In-app analytics (operated by NFDGames).

   OpenDrop collects basic usage data to help us understand how the app is being used and to improve the product. Our analytics dashboards show only aggregated counts and never show individual users.

   What we collect:

   • Active user counts (whether your device is online or offline)
   • Platform type (desktop, iOS, or Android) and app version
   • Country (determined by Cloudflare from your connection, not from GPS or location services)
   • Subscription tier (Pro or Free)
   • Distribution channel (e.g., App Store, Microsoft Store)
   • Error counts
   • A shortened SHA-256 hash of your email address if you are signed in, or the app's random device identifier if you are not, so each user is counted once

   What we do NOT collect in our in-app analytics:

   • File names, file contents, or file metadata
   • IP addresses (only country-level geolocation from Cloudflare)
   • Browsing activity or app usage patterns
   • Personal data beyond what is listed above

   Only aggregated counts are sent to our analytics provider (Grafana Labs / Grafana Cloud). Email addresses are never stored in this in-app analytics data; signed-in users are counted under the shortened hash described above.

   In-app opt-out: You can turn off in-app analytics at any time with Disable basic analytics in Settings, in both the desktop and mobile apps. When it is off, our server does not record usage statistics from that app (see Section 2(E)).

   B. Website analytics and conversion measurement (operated by Google).

   Our public websites, including nfdgames.com, the OpenDrop landing page, the support form, blog articles, and these policy pages, load scripts from Google Analytics 4, Google Firebase, and a single Google Ads conversion-measurement tag. Unlike our in-app analytics, these services collect data such as your IP address, browser and device characteristics, the pages you view, referring URLs, and identifiers stored in cookies or similar storage, and they collect that data directly from your browser. The data is sent to and processed by Google under its own terms.

   We do not show display advertising on our websites or in our apps. The Google Ads conversion-measurement tag is used only to count download-button clicks so that, if we run marketing on Google's own platforms (for example, a Google Search ad that points to OpenDrop), Google can attribute a download to that ad. We do not currently operate Google Ads remarketing campaigns or build advertising audiences from our visitors. We use Google Analytics 4 for aggregate website traffic measurement and to understand which content drives interest in OpenDrop. Independently of our use, Google may also use the data its tags collect for its own commercial purposes, including building advertising audiences and serving advertising across the web. Those Google-side uses may constitute a "sale" or "share" of personal information under the CCPA/CPRA and similar U.S. state laws (see Section 9).

   Website opt-out options:

   • Install the official Google Analytics Opt-out Browser Add-on to prevent Google Analytics from collecting your data across all sites.
   • Manage Google ad personalization at adssettings.google.com.
   • Manage industry-wide advertising preferences at optout.aboutads.info (United States) or youronlinechoices.eu (European Union).
   • Use your browser's built-in privacy tools to block third-party cookies or send a Global Privacy Control (GPC) signal, we honor GPC where required by law (see Section 8(F)).

7. Data Retention

   We retain personal information only for as long as needed for the purpose for which it was collected, or as required by law.

   • Account record. Retained while your account is active. Deleted within 30 days of an account-deletion request (see Section 11), except where we must keep limited records for tax, accounting, fraud prevention, or legal-defense purposes (typically up to seven years for purchase records).
   • Device records in the key-value store. A device record is automatically pruned 30 minutes after it last reported a heartbeat (the "stale device" cutoff). When you sign out or remove a device, its record is removed immediately.
   • Relay addresses, LAN address, and HMAC secrets. Stored only as part of the active device record; removed when the device record is pruned or you sign out.
   • File contents. Not retained. Encrypted file chunks pass through the relay only for the duration of a transfer (typically seconds to minutes) and are discarded immediately afterward. Files at rest live only on your own devices.
   • In-app usage statistics. Individual heartbeat pings are retained for 15 minutes. Daily aggregate counts are retained for 48 hours, weekly for 8 days, and monthly for 35 days. All analytics data is subject to automatic expiration.
   • Support correspondence. Retained for up to 24 months after the conversation closes, unless you ask us to delete it sooner.
   • Edge logs (Cloudflare, Fly.io, Oracle Cloud). Connection and request logs are managed by those providers under their own retention schedules. We do not import or retain their raw access logs.

8. Your Privacy Rights

   A. Rights Available to All Users.

   • Access. Request a copy of the personal information we hold about you.
   • Correction. Ask us to fix information that is inaccurate or incomplete.
   • Deletion. Request that we delete your account and associated personal information.
   • Portability. Request a copy of your information in a structured, commonly used, machine-readable format.
   • Opt-out of analytics. Turn off in-app usage statistics at any time with Disable basic analytics in Settings.
   • Withdraw consent. Where we rely on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before the withdrawal.

   To exercise any of these rights, email support@nfdgames.com from the email address on your account, or use the in-app account-deletion option (see Section 11). We will respond within the timeframes required by applicable law (generally 30 days under the GDPR and Quebec Law 25; 45 days under the CCPA, extendable once by another 45 days). We do not charge a fee for processing requests unless they are manifestly unfounded or excessive. We will not discriminate against you for exercising your rights.

   B. European Economic Area, United Kingdom, and Switzerland.

   If you are located in the EEA, the UK, or Switzerland, you have the rights described above under Articles 15-22 of the GDPR (and the UK and Swiss equivalents), including the right to object to processing based on legitimate interests, the right to restrict processing, and the right not to be subject to a decision based solely on automated processing (we do not engage in such decision-making). You also have the right to lodge a complaint with the data protection authority where you live or work (for example, the Irish Data Protection Commission, dataprotection.ie, or the UK Information Commissioner's Office, ico.org.uk).

   NFDGames LLC is established in the United States. We currently rely on the occasional processing position under GDPR Article 27(2)(a) because OpenDrop's processing of EEA-resident data is occasional, does not involve large-scale processing of special categories of data, and is unlikely to result in risk to the rights and freedoms of natural persons. If we appoint a representative under Article 27, we will list their contact details here.

   C. California Residents (CCPA / CPRA).

   If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

   • Right to know the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purpose, and the categories of third parties to whom we disclose it.
   • Right to delete personal information we have collected from you, subject to statutory exceptions.
   • Right to correct inaccurate personal information.
   • Right to opt out of the sale or sharing of your personal information. We do not sell personal information or share it for cross-context behavioral advertising. See "Do Not Sell or Share My Personal Information" in Section 9 below.
   • Right to limit the use or disclosure of sensitive personal information. We do not use sensitive personal information except to perform the Service and as otherwise permitted under CCPA regulations.
   • Right to non-discrimination for exercising your rights.
   • Right to designate an authorized agent to make a request on your behalf.

   Categories of personal information collected in the past 12 months under CCPA Section 1798.140(v): Identifiers (email, account identifier, device identifier, IP address at the edge and via Google Analytics / Firebase, online and cookie identifiers from Google Analytics and Google Ads tags on our websites); Internet or other electronic network activity information (basic usage statistics from the apps; pages viewed, referring URLs, and interaction events on our websites); Commercial information (subscription status; conversion events on our websites); Geolocation (approximate country only, not precise); Inferences (we do not draw inferences for profiling; Google may build advertising audiences from the website tags it operates). NFDGames LLC has not sold any of these categories for monetary consideration. To the extent that the operation of Google Analytics, Google Ads, and Firebase tags on our websites constitutes a "sale" or "share" under broader statutory definitions, the recipient of that disclosure is Google LLC, and the opt-out options described in Section 9 apply. We retain each category only for the periods described in Section 7.

   D. Quebec Residents (Law 25).

   If you live in Quebec, you have the rights described in Sections 27 to 41 of the Act respecting the protection of personal information in the private sector, including access, correction, withdrawal of consent, deletion / de-indexation, and data portability. You may also lodge a complaint with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca). We are not subject to a duty to inform you about automated decision-making because we do not make decisions about you based exclusively on automated processing.

   E. Other U.S. State Residents.

   If you reside in a U.S. state that has enacted a comprehensive consumer-privacy statute (for example, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Florida, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, Minnesota, Maryland, or Rhode Island), you have rights similar to those described above, which may include the right to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale, and certain profiling. Because we do not engage in targeted advertising, sale of personal information, sharing for cross-context behavioral advertising, or profiling with legal or similarly significant effects, those opt-out rights do not have a practical effect for OpenDrop users, but we will honor any such request you submit. To exercise any state right, contact support@nfdgames.com. If we deny a request, you may appeal by replying to our response email; we will respond to your appeal within the time permitted by your state's law (typically 45 to 60 days).

   F. Universal Opt-Out Signals.

   Where required by law (for example, under the CCPA, Colorado CPA, and Connecticut CTDPA), we honor browser-level opt-out signals such as the Global Privacy Control (GPC). Because OpenDrop does not engage in the sale or sharing of personal information for targeted advertising, these signals are noted but do not alter our existing practice of not selling or sharing.

9. Do Not Sell or Share My Personal Information

   NFDGames LLC does not itself sell your personal information for money, and we do not directly share your personal information with third parties for cross-context behavioral advertising in exchange for monetary or other valuable consideration. We have not received payment from any third party for personal information collected through the Service in the preceding 12 months and have no plans to do so. We do not knowingly sell or share the personal information of consumers under 16 years of age.

   Third-party services we use may, however, engage in activity that is treated as a "sale" or "share" of personal information under certain U.S. state laws. In particular, our use of Google Analytics 4, Firebase, and a Google Ads conversion-measurement tag (all operated by Google LLC) on our websites results in personal information, including IP address, cookie and device identifiers, pages viewed, and approximate geolocation, being collected directly by Google and used by Google for its own purposes, which include serving and measuring advertising across Google's own properties and its partner network. The California Privacy Rights Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and several other state laws define "sale" and "share" broadly enough that these activities can fall within those definitions, even though NFDGames itself displays no advertising on its sites or in its apps and operates no remarketing campaigns. Where the broad definitions apply, the activity is performed by Google as an independent controller of that data, not by NFDGames LLC.

   The categories of personal information potentially "sold" or "shared" under those broad definitions are: identifiers (IP address, online identifiers stored in cookies, device identifiers); internet or other electronic network activity information (pages viewed, referring URLs, interaction events); commercial information (entries into our purchase funnels and conversion events); and approximate geolocation derived from IP address. The categories of recipients are: Google LLC and its affiliates, acting as an analytics and advertising technology provider on our sites; and Google's advertising partners insofar as Google shares audience signals with them.

   How to opt out:

   • Manage your cookie preferences for this site. Manage cookie preferences
   • Honor a Global Privacy Control (GPC) signal. We honor a GPC signal sent by your browser as a valid opt-out of "sale" and "share" where required by applicable law (see Section 8(F)). If your browser sends GPC, our consent banner records an opt-out automatically and the Google Analytics, Google Ads, and Firebase tags will not collect data on subsequent page loads.
   • Install the Google Analytics Opt-out Browser Add-on to prevent Google Analytics from collecting your data on our sites and across the web.
   • Turn off Google ad personalization at adssettings.google.com; manage industry-wide advertising preferences at optout.aboutads.info (U.S.) or youronlinechoices.eu (EU).
   • Email us at support@nfdgames.com with the subject line "Do Not Sell or Share." We will record your preference, and on future visits we will suppress the Google Analytics, Google Ads, and Firebase tags for your session to the extent technically feasible.
   • Block third-party cookies in your browser, which prevents most of the tags listed above from associating your browsing with persistent identifiers.

   The OpenDrop mobile and desktop apps themselves do not contain Google Analytics, Google Ads, or any other third-party advertising or analytics SDK that would constitute a "sale" or "share" of personal information. The in-app usage statistics described in Section 2(E) go only to our own infrastructure and to Grafana Labs (acting as our service provider, not as an independent controller), and you can turn them off in Settings.

10. Children's Privacy

    OpenDrop is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 in jurisdictions where that higher threshold applies under Article 8 of the GDPR). We comply with the U.S. Children's Online Privacy Protection Act ("COPPA"). If you believe a child has provided us with personal information, please contact us at support@nfdgames.com and we will promptly delete the information and terminate any associated account.

    Apple App Store and Google Play Data Safety: OpenDrop's intended audience is users 13 years of age or older. The OpenDrop app does not contain advertising, in-app purchases for consumables targeted to children, or content intended for children, and is not enrolled in Designed for Families or Kids Category programs.

11. How to Delete Your Account and Your Data

    You can delete your account and associated personal information in any of the following ways:

    • In the mobile app. Open Settings, tap Delete account, and confirm the prompt. Your account record, all device records, relay addresses, HMAC secret, and analytics counters linked to your account are removed within 30 days. Local files on your devices are not affected and remain under your control.
    • On the account deletion page. Open opendrop.n-fantinodyer.workers.dev/delete-account, sign in with the account you want to delete, and confirm, with the same effect. The desktop app opens this page from the Delete Account link in its sign-in window.
    • By email. Email support@nfdgames.com from the address on your account with the subject line "Delete My Account." We may verify the request by sending a confirmation link to that email.

    Cancelling a paid subscription is handled by the platform on which you purchased it (Apple App Store, Google Play, or Stripe) and is separate from deleting your account. See our Terms of Service for cancellation details.

12. Security Incident Response and Breach Notification

    If we become aware of a security incident affecting personal information that creates a risk of harm to you, we will notify the appropriate supervisory authority and affected individuals as required by law:

    • Under the GDPR, the relevant supervisory authority within 72 hours of becoming aware of a breach where required by Article 33, and affected data subjects without undue delay where required by Article 34.
    • Under Quebec Law 25, the Commission d'accès à l'information and affected individuals promptly where a "confidentiality incident" presents a risk of serious injury.
    • Under U.S. state breach-notification laws (including California Civil Code Section 1798.82), affected residents and any required state regulators within the timeframes mandated by those laws.

    Notifications will describe the nature of the incident, the categories of personal information affected, the steps we have taken or are taking to address it, and steps you can take to protect yourself.

13. Changes to This Privacy Policy

    We may update this Privacy Policy from time to time. When we do, we will update the "Effective Date" at the top of this page and the "Last updated" date at the bottom.

    For material changes (for example, the addition of a new category of data collection, a new sub-processor that processes a new category of personal information, or a change to your rights), we will provide at least 30 days' advance notice before the change takes effect by (i) posting a prominent in-app notice the next time you open OpenDrop, and (ii) where feasible, sending an email to the address associated with your account. Your continued use of the Service after the new effective date constitutes acceptance of the updated policy. If you do not agree to the changes, you can delete your account before they take effect.

    Prior versions of this Privacy Policy are available on request from support@nfdgames.com.

14. Contact Us; Privacy Officer

    For any question, concern, or request relating to this Privacy Policy or our handling of your personal information, please contact:

    NFDGames LLC
    Attn: Privacy Officer
    United States
    Privacy: support@nfdgames.com
    Support: support@nfdgames.com

    Under Quebec Law 25, our designated Privacy Officer (the person responsible for the protection of personal information) is the principal officer of NFDGames LLC, and can be reached at the email above.

    Under the GDPR, you may also lodge a complaint with your local supervisory authority. A list is published by the European Data Protection Board at edpb.europa.eu.

Last updated: October 10, 2026