Privacy Policy

Effective date: November 3, 2026 Last updated: November 3, 2026

This Privacy Policy explains what DropMB processes when you visit the site, upload or download files, create an account, comment, use a file-request link, or contact the operator. It applies to https://dropmb.com and does not cover third-party websites.

Summary

We process account data, the files and shares you create, comments, and the technical data needed to operate and secure the service.
Share pages display uploader and recent-visitor information, including approximate location, browser and operating system, referrer domain, and timestamps. Anyone with the link can see it.
Public shares may be indexed by search engines and may appear in public listings and social previews. Protected, recipient-only and private shares are excluded from public discovery.
Guest visitors may see third-party ads on some public and missing-share pages. Signed-in visitors do not see those ads.
We do not sell personal information.

Who is responsible?

The service is operated by the operator of DropMB. Privacy requests and questions can be sent through the contact page.

Information we process

Account information

If you create an account, we process your username, email address, a protected password value (never the plain password), optional display name and profile picture, account preferences, account status, quotas and security settings. If you sign in through an external identity provider, we receive the identifier and profile information that provider releases to us.

Files, shares and comments

When you upload or share content, we process the file content, file names, sizes, types, timestamps, share names and descriptions, custom links, access settings (such as a protected password value, view limit or recipient list), download and visit counters, and comments you post. Comments include your username, display name, profile-picture version, comment text and timestamp.

Uploaded content is visible to anyone who has the share link unless you enable a password, recipient restriction or another access control. Do not upload content you are not allowed to share.

Uploader and visitor information

Share pages show technical information derived from the upload and from visits:

country (city, region and timezone are not stored);
browser name and version;
operating system and device type;
the domain of the external site that referred a visitor;
upload and visit timestamps.

A short list of up to 18 recent visitors is kept with the share. This information is visible to everyone who can open the share. IP addresses are not displayed publicly.

Technical, security and diagnostic data

We process technical data needed to deliver and protect the service, including request information, a short-lived identifier used for rate limiting and abuse prevention, authentication events, error messages and diagnostics. Error reports may include the page path, browser information, an error message and a stack trace; query strings are not included in client error reports.

Communications

If you contact us, submit a report, send a share by email, or use a file-request link, we process the content of the message and the email addresses involved. Where download notifications are enabled, a share owner may receive an email when a recipient downloads a file.

Cookies and local storage

We use cookies and browser storage for essential functionality, security and preferences. The main values are:

Name	Purpose	Lifetime
`access_token`	Keeps you signed in and authorizes requests	Up to 3 months
`refresh_token`	Renews your session; HTTP-only and limited to the token endpoint	Up to the configured session lifetime (currently 1 year)
`share_<id>_token`	Remembers that you unlocked a share	Browser session
`reverse_share_token`	Grants access to a file-request upload	Browser session
`language`	Remembers your language choice	Up to 1 year
`mantine-color-scheme`	Remembers your light, dark or system theme	Browser session
`reverse-share.simplified`	Remembers file-request form preferences	Browser session
`reverse-share.public-access`	Remembers file-request visibility preferences	Browser session

Browser local storage may also keep interface preferences and a marker that a share was unlocked in this browser. These values stay on your device and can be cleared through your browser settings. Clearing cookies may sign you out or require you to enter a share password again.

Guests may see third-party advertising on share and missing-share pages, including some protected or view-limited shares. Advertising partners may set their own cookies or similar identifiers when an ad is displayed. Signed-in visitors and active file-request upload sessions do not load those ads. Where required, consent is requested by the ad provider or the applicable consent mechanism.

Why we process information

We process information to:

provide, operate and secure the service;
upload, store, preview and deliver files;
create and manage shares, file requests, comments and recipient access;
enforce passwords, view limits, recipient restrictions and expiration;
send emails you request, including share links, notifications and security messages;
display uploader information, view counts and recent visitors;
produce aggregate statistics such as trending shares and country rankings;
detect and prevent abuse, fraud, malware and security incidents;
respond to reports, support requests and legal requests;
maintain, troubleshoot and improve the service;
comply with legal obligations.

Legal bases

Where data protection law requires a legal basis, we rely on:

Contract: to provide the file-sharing service you request.
Legitimate interests: to secure the service, prevent abuse, moderate content and improve functionality.
Consent: where we rely on consent for a specific feature, communication or third-party technology.
Legal obligation: to comply with applicable law and valid legal requests.

We do not sell personal information. We may share information with:

Identity providers you choose when signing in through an external account.
Hosting, storage, delivery, security and email providers that operate or support the service.
Automated security and malware-analysis providers that help identify malicious files.
Advertising partners that serve ads to guests on public pages.
Legal authorities when required by law or necessary to protect rights, safety and security.
Professional advisers and successors in connection with a reorganization, transfer or sale of the service.

These providers process information under their own terms or on our behalf, depending on the service. They may process data in countries other than your own; where required, appropriate safeguards are used.

Malware and security checks

Uploaded files may be checked by automated security tools. A file fingerprint may be compared with security intelligence sources, and in some cases a file sample may be submitted to an external malware-analysis provider. Files identified as malicious may be removed, and the uploader or file-request owner may be notified. Security results may be shown as a badge on the share page. Scanning reduces risk but does not guarantee that a file is safe.

Retention

Share files and metadata remain available until the share expires or is deleted. Guest shares expire after 10 days without a visit; account shares after 100 days without a visit. Each visit extends the window.
Expired shares and their files are removed by the automatic cleanup. A short delay is possible while cleanup runs.
Incomplete uploads are removed after about one day.
Comments remain with the share until the comment, share or account is deleted.
Account information remains while the account is active. Deleting the account removes the account, its shares, files uploaded through its file-request links, and its profile picture, subject to backups and legal retention requirements.
Reports and support messages are kept as needed for moderation, security and legal compliance.
Diagnostics and aggregate metrics: error logs are kept for about 7 days; page-view totals for about 24 hours; download counters for about 30 days; the referrer-domain ranking for about 90 days. Operational and security logs are kept for a limited period and may contain IP addresses.
Backups may retain deleted data for a limited period before they are rotated.

Security

We use encrypted connections, access controls, rate limiting, optional two-factor authentication, protected password storage and automated malware checks. Protected shares require a password or access token. Authorized administrators may access shares and account data for operation, security, moderation and legal compliance.

Files are not end-to-end encrypted. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed. Keep your credentials and share links private, and report suspected vulnerabilities or unauthorized access promptly.

Your rights and choices

Depending on your jurisdiction, you may have the right to access, correct or delete personal information, object to or restrict certain processing, request data portability, or withdraw consent where processing is based on consent. You may also lodge a complaint with your local data protection authority.

You can update your username, display name, profile picture, language and theme in your account settings. For other requests, use the contact page and include the account or share involved so the data can be located. Identity verification may be required before a request is completed.

Children

The service is not directed at children below the age required to consent to online services or data processing in their jurisdiction. Do not create an account or upload personal information if you are below that age. If you believe a child has provided personal information, contact us and it will be removed.

International transfers

The service and its providers may process information in countries other than your own. Where required, appropriate safeguards are used for those transfers.

Changes to this policy

This policy may be updated when the service, its features or legal requirements change. The revised version is published on this page with a new effective date. Continued use of the service after an update means you accept the revised policy.

Contact

Questions about this document, the service, a share or an account can be sent through the contact page. Include the affected link or account where possible so the request can be handled quickly.

Reports about illegal or harmful content, copyright complaints and privacy requests are handled through the same channel.

This document is maintained together with the DropMB service and is updated when the service or the data it processes changes.