We collect only what we need to run the service. We do not sell your data. We do not serve ads. Your uploaded files are stored to serve them to people you share the link with — that's the whole point. You can delete your account and all your data at any time.
Drop Site is a free HTML app hosting platform. When this policy says "we", "us", or "Drop Site", it means the operators of the Drop Site service running at dropsite.pages.dev (or equivalent domain).
For questions about this policy, contact: privacy@dropsite.pages.dev
Here is a precise breakdown of what we store and why:
We do not collect: real names, phone numbers, location data, payment information (the service is free), browser fingerprints, or any tracking beyond what is listed above.
Drop Site uses session cookies only — these are set by Supabase Auth to keep you logged in. No advertising cookies, no cross-site tracking cookies.
We use Umami for anonymous, privacy-friendly analytics (page views, referrers). Umami does not use cookies and does not track individual users. No personal data is collected by our analytics.
We do not use Google Analytics, Meta Pixel, or any advertising network tracking.
Drop Site uses the following third-party infrastructure. Your data may pass through or be stored by these providers:
We use your data exclusively to:
We do not use your data for advertising, profiling, or selling to third parties.
When you publish an app as "public", anyone with the URL can view it. Public apps may also appear in the Drop Site gallery. This is the intended behaviour of the platform — it is a hosting service.
If you set an app to "unlisted", it is not shown in the gallery but is still accessible to anyone with the direct link.
Your email address is never publicly displayed anywhere on the platform.
We keep your data for as long as your account is active. When you delete your account, we delete:
We may retain anonymised aggregate statistics (e.g. total upload count for the platform) after deletion. These contain no personally identifiable information.
Admin audit logs referencing your account may be retained for up to 90 days after deletion for security and abuse prevention purposes.
You have the following rights regarding your data:
To exercise any of these rights, contact us at privacy@dropsite.pages.dev. We will respond within 30 days.
Your data is stored on Cloudflare and Supabase infrastructure. Passwords are hashed using bcrypt via Supabase Auth and never stored in plaintext. All connections use HTTPS/TLS.
Access to the admin panel is role-restricted. Admin actions are logged. Sensitive operations require superadmin role.
No system is perfectly secure. If you discover a security vulnerability, please report it to security@dropsite.pages.dev rather than disclosing it publicly.
We may update this policy as the service evolves. We will update the "last updated" date at the top of this page. For significant changes, we will notify registered users by email.
Continued use of Drop Site after a policy update constitutes acceptance of the revised policy.
Privacy questions or data requests?
privacy@dropsite.pages.dev