Who this covers

HyperDrop is operated by Dmitry Eroshenko ("we", "us"). This policy covers this website, the HyperDrop account at gethyperdrop.com/account/, the free name registry that issues <name>.hyperdrop.link addresses, and the push relay that carries notifications from your HyperDrop server to the HyperDrop app on your iPhone or Android phone.

It does not cover the HyperDrop server you install on your own VPS or NAS. That machine is yours: it holds your files, its own user accounts and its own logs, and we have no access to it. If you share a link with someone, what happens between them and your server is between them and your server. A server you install counts the visitors to your links with a first-party cookie it sets itself and keeps that count beside the share; disclosing it to the people you share links with is yours to decide.

That means whatever your server holds, serves or logs is yours to answer for under data-protection law, not ours. We answer only for the account, name and push records described below.

What we never receive

Files you share, their names, their contents, the links you generate, the passwords you set on a share, and who downloads them. All of that lives on your server and is served by your server. The app on your Mac talks to your server directly.

What a notification says. Your server encrypts it to a key that never leaves your phone, so the relay passes on a block of bytes it cannot open.

What we collect, and why

When you sign in

You sign in with Google or Apple. We never see your password. From the provider we receive a stable identifier for you, your email address if the provider tells us it is verified, and your display name if it provides one. We store those, plus the time you created the account and the time you last signed in.

One address gets one account. If you sign in with one provider using an email address that already has an account created with the other, we refuse that sign-in and tell you which provider to use, instead of creating a second account you would not be able to see from the first. If you already have two accounts and ask us to join them, an administrator can move the identities, names, recovery codes and history of one onto the other; the account that is absorbed is then deleted, and its sign-in sessions end.

If you turn on two-factor authentication we store the authenticator secret encrypted, and your recovery codes hashed, so that neither can be read back out of the database.

While you are signed in, your browser holds a session cookie. We store only a hash of it, with its creation and expiry time. At most 10 browser sessions are kept per account; older ones are dropped.

When you register a name

We store the name, the identifier of the server you connect it to, the IP address that server reports, and a dated line in your account history for each registration, publication and release, and for any change an administrator makes to your account.

Your server's IP address becomes public. That is what a domain name is for: we publish it as a DNS record for your name, and DNS is readable by anyone. If you would rather not publish the address of a machine, do not point a name at it.

While a name is published we check its HTTPS certificate from outside, and keep the serial number, issue time and expiry time of each certificate it serves. That record is kept 90 days and is how we notice a certificate that was not renewed in time.

When you write to us

Messages you send us through the account page: your account's email address and display name at that moment, the subject and the text. We keep them so we can answer you.

When you turn on notifications

The HyperDrop app on your iPhone asks Apple for a device address and registers it with our push relay, which answers with a random handle that the app gives to your HyperDrop server. We store the device address encrypted under a key derived from that handle, a one-way hash of the handle, whether the app uses Apple's development or production push service, and when the handle was made and last used. Without the handle, which only your phone and your server hold, the stored address cannot be read. No account is needed and none is linked.

The HyperDrop app on an Android phone asks Google's Firebase Cloud Messaging for a registration token and registers it with our push relay the same way; we store it sealed under the handle, in a separate table, and pass the encrypted notification to Google with no text at all: the app writes the words once it has decrypted it.

When your server has something to tell you, it encrypts the notification to your phone and sends it to the relay with the handle. We pass it to Apple with the words "New activity on your HyperDrop server", and your phone replaces them with what happened once it has decrypted the notification. We see your server's IP address, the handle, the time and the size, and the short label (a collapse identifier) your server may attach so that a newer notification replaces an older one, never what the notification says. To limit how many notifications one server sends or one phone receives, we count requests in memory by IP address and by a hash of the handle; those counts are forgotten when the relay restarts.

A registration unused for 90 days is deleted, and so is one Apple or Google reports no longer reaches the app.

Cookies

__Host-hyperdrop_account

Keeps you signed in. Expires after 30 days, or immediately when you sign out.

__Host-hyperdrop_oauth

Ties one sign-in attempt to one browser. Lives 10 minutes and is deleted as soon as you come back from the provider.

Both are strictly necessary to sign in, so we do not ask for consent to set them. There are no other cookies, and none of them track you anywhere.

Logs

The name registry, and the push relay that runs beside it, record each request they answer: the time, the method and the requested address (including its query, which can name your server's own domain), the source IP address, the result, and the headers and body. Credentials, tokens, cookies and passwords are replaced with a redaction marker before anything is written. These records are what lets us answer "why did my name stop working". They are deleted after 30 days, and only the newest 100,000 are kept. For a notification or a push registration the record is the same as any other, except that the handle, the device address, the notification and its collapse identifier are replaced with the redaction marker.

This website's web server keeps ordinary access logs (IP address, time, path, browser) for 14 days. Every download from it appears there: HyperDrop Desktop, Server Management, the server (including the copy Server Management fetches when it installs one) and the extensions. So do the update checks that HyperDrop Desktop, Server Management and a NAS's Package Center make, and the check every HyperDrop server makes for its own updates shortly after it starts, then once a day, and whenever an admin turns its automatic updates on (the server's address, the time, the manifest it reads and the server version it runs). A server that updates itself also downloads the new server binary and its signature from this website, and those downloads appear there too.

Why we are allowed to hold it

We hold your account, name and push records to provide the service you asked for. We keep logs and rate-limit records because a free DNS service that keeps none is abused within days, and because we need to be able to investigate faults and misuse. Where you are in a place with data-protection law, those are performance of a contract with you and our legitimate interest in running the service safely.

Who else is involved

Google, Apple

Only if you choose that sign-in button. They tell us who you are; they learn that you signed in to HyperDrop. We request only your identifier, email address and name.

Apple (notifications)

Only if you turn on notifications in the HyperDrop app on an iPhone. Apple's push service receives your phone's device address, the fixed text "New activity on your HyperDrop server", the encrypted notification and the label your server may attach to it, and delivers them to your phone.

Google (notifications)

Only if you turn on notifications in the HyperDrop app on an Android phone. Firebase Cloud Messaging receives your phone's registration token, the encrypted notification and the label your server may attach to it, and delivers them to your phone.

Cloudflare

Runs the DNS for hyperdrop.link. The records we create there carry your name and your server's IP address.

Telegram

Delivers our operators' alerts and a daily summary. When a name is registered, the alert carries the name, your account's internal identifier and how many names it holds. When a name's certificate is not renewed in time, it carries the name, the certificate's serial number and its expiry time. The daily summary lists the names registered, connected, first published or released that day. When you send us a message, the alert carries its subject and text. Never your email address, display name or your server's IP address.

crt.sh

We look up how many HTTPS certificates have been issued for your name, so the service stays inside its certificate budget. This reads public Certificate Transparency data.

That is the whole list. We do not sell your data, we do not share it for advertising, and nobody buys a profile of you from us.

If HyperDrop is sold or moved into a company, the account, name and push records described here move with it and stay under this policy until this page says otherwise.

How long we keep things

Your account

Until you ask us to delete it.

A released name

Its DNS records are removed and the name returns to the pool. The dated history line stays on your account, because it is what stops one account churning through the free pool.

Registry logs

30 days.

Certificate readings for a name

90 days.

Push registrations

Deleted when unused for 90 days, or as soon as Apple or Google reports the app is gone from the phone.

Messages you send us

They are deleted after 365 days, or sooner once we have answered and removed them.

Backups

The registry's database, which holds everything listed here except the website access logs, is backed up once a day and before each update, and only the newest 30 backups are kept, so a deleted record can remain in a backup for about 30 days more.

Website access logs

14 days.

Sign-in attempts in flight

10 minutes, then deleted whether they completed or not.

Your choices

Email privacy@gethyperdrop.com to get a copy of what we hold about you, to correct it, or to have your account and its names deleted. We aim to answer within 30 days. You can also release a name yourself at any time from your account page, and sign out to end a session. Turn off notifications in the app, or delete the app, and your server stops using its handle; the registration is then deleted on the schedule above.

Deleting your account removes the account, its identities, its sessions and its names' DNS records. Log entries age out on the schedule above rather than being hunted down individually.

Security

Sign-in runs over HTTPS only. Session cookies are host-scoped, HTTP-only and unreadable by scripts. Authenticator secrets are encrypted at rest with a key held outside the database. Two-factor authentication is available on every account and we recommend turning it on.

No service is perfectly safe. If you find a weakness, please tell us at abuse@gethyperdrop.com before telling anyone else.

Children

HyperDrop is not directed at children and we do not knowingly create accounts for anyone under 16. If you believe a child has an account here, write to us and we will remove it.

Changes

If this policy changes we will update this page and the date at the top, so it is worth looking again from time to time. Continuing to use the service after a change means you accept it.

Contact

Privacy and data requests: privacy@gethyperdrop.com
Abuse and security reports: abuse@gethyperdrop.com

See also the Terms of Service.