drop

Privacy & limits

Last updated 3 August 2026

drop hosts static files for a short, self-chosen window and then deletes them. It is deliberately small: no accounts, no tracking, no analytics cookies.

What we store

  • The files you upload, exactly as given, until they expire or you delete them.
  • A little metadata: a random site id, the file count, total size, and the expiry time.
  • A short-lived, per-hour counter tied to your IP address, used only to rate-limit uploads. It is not a profile and is discarded automatically.

We do not run analytics, set advertising cookies, or sell data. We keep no server logs of visitors to hosted sites beyond what Cloudflare's network needs to operate.

Expiry & deletion

  • You pick how long a site stays live: 1 hour, 1 day, 7 days, 30 days.
  • When the timer runs out, the metadata and files are removed and the link stops working.
  • You can delete a site early from the link card, or from Your drops on the home page.
  • The time you pick is a maximum, not a guarantee. If the service runs out of room, the oldest drops are deleted early to make space for new ones — see Limits.

Your drops, in your browser

Deleting a site early needs the manage token handed out when you upload it — we only ever keep a hash of it, so it cannot be recovered or reissued. drop stores that token, the link, and its expiry time in your browser's localStorage so the option survives a reload.

  • It never leaves your browser, except as the token in a delete request you make.
  • Entries disappear on their own once a drop expires.
  • Forget clears the list immediately. On a shared computer, use it — the sites themselves stay live until they expire.

Existing links & previous visits

The storage upgrade does not change public links. Existing /s/<id>/ URLs, QR codes, expiry times, and entries in Your drops continue to work exactly where they are.

Before 29 July 2026, hosted-page storage lived only in that tab. If that old tab is still open, reopening or refreshing it imports the current drop's previous data into the new isolated store. There is no server copy, so data from a tab that was already closed cannot be recovered. From this update onward, new local data can be seen again when the same link is reopened.

Limits

  • Uploads up to 25 MB; a ZIP may expand to at most 60 MB across 400 files.
  • Static content only — HTML, CSS, JavaScript, images, fonts, media. Server-side languages (PHP, ASP, and similar) are not executed and are rejected.
  • Uploads are rate-limited to 30 per hour per IP.
  • The service holds at most 1.0 GB of live sites in total. When it fills up, uploads keep working and the oldest drops are deleted early to make room — so a busy week can end a drop before its timer does. Everything here is meant to be temporary; don't use drop as your only copy of anything.

Isolation & storage

Hosted pages are served with a sandbox content-security policy, which puts each one in its own opaque origin. A hosted site cannot read cookies, cannot reach another drop site's data, and cannot touch this app. That boundary is enforced by the browser, not by us.

Real browser storage is switched off inside an opaque origin, so a small trusted outer shell provides a namespaced storage bridge. Hosted code can only ask that shell to read or write keys belonging to its own site id; it never receives access to this app's storage or another drop's namespace.

  • localStorage, sessionStorage and document.cookie behave like their browser counterparts. Local storage and the cookie shim survive closing and reopening the same drop; session storage lasts only for that tab.
  • The data stays in the visitor's browser and never reaches our servers. It is isolated per drop and is not shared between browsers or devices.
  • IndexedDB and the Cache API are unavailable. A site that requires them will not work here.

Enough for demos and prototypes that need modest browser-local state — not a database. Nothing a visitor types into a hosted site ever reaches us.

Acceptable use

Don't host malware, phishing, or illegal content. Hosted pages run in your visitors' browsers, so treat anything you upload as public. We may remove content that abuses the service.

No warranty

drop is provided as-is for ephemeral sharing. Don't use it as your only copy of anything — it is designed to forget.

Back to drop