Legal

Privacy

Last updated 10 October 2026. Grey Arc Ltd is the controller for DropZoom account data. Cloudflare processes traffic and stored files so the service can run.

What we collect

• Guest try-it: the files you upload, a Cloudflare Turnstile result that you are human, and ordinary request logs which can include an IP address. We do not create an account.
• Teams interest form: your name, work email, company, team size, what you would use DropZoom for and whether you want to be a design partner. See “Teams interest form” below.
• Contact form: the category you choose, the DropZoom URL you give, your message and, if you add one, a reply email. See “Contact and report form” below.
• Registered accounts: you sign up with a username and a passphrase. We do not collect an email address. We store the username, a one-way hash of the passphrase (not the passphrase itself), hashes of any recovery key we issue (not the key itself), the time each key was last used (to within an hour), which you can see and use to remove a key from your account, session cookies, and the publications you keep.
• Passkeys: if you add a passkey to your account, we store its public key, its credential ID, a usage counter, any hints your browser gives about how the passkey connects, whether it is on a single device or several, whether it is synced, the name you give it, when it was added and last used, and the IP address and approximate place it was added from. We also give your account a random identifier the first time you add a passkey. The private key never leaves your device or password manager. When you add or remove a passkey or sign out everywhere else, or when a passkey looks cloned and is refused, we also record that in a security log, with the IP address, approximate place and the name of the network or organisation the request came from. The log entry for a passkey includes its ID and the name you gave it, and for a passkey that looks cloned, the usage counter values. We keep the log for 90 days. Removing a passkey deletes its record and the identifier stays with your account. Its log entry stays for those 90 days.
• Agent registration: when an agent registers itself, we record the time, the IP address it came from, an approximate location and network name from Cloudflare, and the name the agent gave itself. We keep the security log entries for 90 days. We keep the registration record, including the address it registered from and the network of its most recent renewal, while the agent is connected and for 90 days after it ends. The key record for an approved agent, with its name, the approval date and the approximate place it registered from, is kept after the agent is removed, as all key records are; the address is not kept beyond those 90 days. When a person approves, declines or removes an agent, or an approval is refused, we record the same details for that person’s request in the security log, and the person sees recent events for their own account, without the address, under Security activity. Codes, links and access tokens are stored only as one-way hashes, and access tokens are deleted an hour after they expire.
• ChatGPT connection: when you connect ChatGPT to your account we store a record of the connection: the client name (ChatGPT), what you allowed it to do, the ID of the passkey you approved it with, when it was connected and last renewed, a note of when it was linked and the approximate place you approved from, and one-way hashes of its tokens and of the connection request, never the tokens themselves. This record is kept after you remove the connection, as all key records are, and nothing deletes it automatically. While you approve a connection we also hold the request, with the account and passkey you identified yourself with and the approximate place and network name you approved from, for up to two hours. When you approve, decline or remove a connection, when an approval fails, and when ChatGPT publishes a link, we record the event in the security log with the IP address, city, region, country and network name it came from; for a published link the entry also has the link’s address, how many files it has and up to 20 of their names. We keep the security log for 90 days. The six-digit pairing code is worked out when it is needed and is not stored. To check a connection request DropZoom fetches ChatGPT’s published client document from chatgpt.com; that request carries nothing about you. DropZoom receives only the requests ChatGPT makes to it, such as the text, titles and file names it publishes.
• Feedback on a link: when a publisher turns feedback on, we store the display name and feedback text a reviewer enters, the page and version it refers to, the time, and a one-way hash of a per-browser token so a reviewer can see their own items on that device — never the token itself. We also receive a Cloudflare Turnstile result that you are human, which is not stored. We do not store a reviewer's IP address or email address for this. Feedback is kept until the publication is deleted. Display names are not verified.
• Agents and invited publishers: an agent installs https://dropzoom.link/dropzoom.mjs and connects with a recovery key, or redeems a private invitation directly from the command line; a publisher can instead accept the same kind of invitation in the browser. We store a hash of that key, publishing metadata for that identity, and the time it was last used (to within an hour). A self-registered account owner can see and remove their own keys; an account set up by invitation must ask the operator to add or remove one. The command-line tool does not accept passphrases. Invitations still work; they are for first-time setup only.

Cookies and storage

DropZoom does not use analytics, advertising or marketing cookies or storage. DropZoom application code sets only the strictly necessary cookies and storage below. Each exists only to provide something you asked for, which UK guidance treats as exempt from consent.

• Signed-in session: when you sign in to the publishing dashboard, a secure, HttpOnly, same-site cookie keeps you signed in for about seven days, or until you sign out.
• Password-protected publications: when you enter the password for a protected link, a secure, HttpOnly, same-site cookie remembers that for about twelve hours, so you do not have to type it on every page.
• Feedback on a link: when you open a link’s review page, a secure, HttpOnly, same-site cookie lets you see your own feedback on that device for up to a year. It contains no personal data.
• Theme choice: if you pick Light or Dark, your browser remembers that choice in its own local storage on that device. It is not sent to us, and choosing System removes it.
• Private operator sign-in: Cloudflare Access protects DropZoom’s restricted operator area and sets its necessary CF_Authorization cookie when an authorised operator signs in. It lasts until that configured Access session expires or the operator signs out.

There is no cookie banner because there are no optional cookies to accept. The Cloudflare Turnstile human check runs in its default mode; DropZoom does not switch on its pre-clearance cookie option. If we ever introduce optional cookies or storage, they will stay off until you have been offered a choice.

Turnstile

Guest publish, guest registration, leaving feedback on a link, the contact form and the Teams interest form use Cloudflare Turnstile, a human check. Cloudflare receives the widget result. Agents using an account or recovery key do not go through that guest check.

Scanning

Files may be scanned for malware and a limited set of accidental-secret patterns before they are served. That is not a guarantee that every secret or every harmful file is found. Every file published through the ChatGPT connection is scanned for malware and for those secret patterns before its link goes live. The text ChatGPT sends is kept only as the published link; if the publish is refused or never finished, the staged copy is deleted during clean-up, within two days. A preview stores no file content. A publish plan is kept for 24 hours, without any file content: it holds a fingerprint of the plan, the new link’s address, the outcome and the hashes of files already scanned clean. We do not use your files, account data or logs to train AI models, whether those models are public or private.

How long we keep it

Guest publications expire after 24 hours. A ChatGPT connection lasts until you remove it, and removing it ends its access at once, but the record of the connection is kept (see above); if it is not used it ends after 30 days, and after 180 days whether used or not, and one you never confirm is removed after 7 days. The hashes of its tokens are deleted a day after the tokens expire, and the short-lived records made while you approve a connection are deleted within two hours. Teams interest form details are kept for up to 12 months after our last contact with you, then deleted (see “Teams interest form”). Account publications stay until you delete them or we remove them under the terms. Cloudflare keeps ordinary edge logs for its own operations. A signed-in session cookie lasts about seven days, or until you sign out. The private operator cookie lasts until its configured Cloudflare Access session expires or the operator signs out.

Cloudflare

Cloudflare is our processor and host. Traffic, files and account data are processed on Cloudflare’s network, which can include servers outside the United Kingdom. We rely on Cloudflare’s transfer safeguards for that.

Lawful basis

We process guest uploads and logs so we can run the service you asked for. We process account data on the same basis. We process abuse reports and legal requests because we have a legitimate interest in running a lawful service, or because the law requires it. We process Teams interest form details because you asked us to contact you about DropZoom for teams, and we have a legitimate interest in replying to your enquiry and planning the service.

Children

DropZoom is not aimed at children under 18. Do not create an account or publish if you are under 18.

Sharing

We do not sell your data. We share it with Cloudflare as the host, and if the law requires it. A public link is public: anyone with the URL can fetch the files unless you set a password.

Teams interest form

The Teams interest form at publish.dropzoom.link/teams-interest is how a business tells us it is interested in DropZoom for teams. When you send it we process your name, your work email, your company, your team size, what you tell us you would use DropZoom for, and whether you ticked the box to be a design partner. We also receive a Cloudflare Turnstile result that you are human, and ordinary request logs which can include an IP address; the IP address is not copied into the message. We use this to reply to you and to decide what to build and who to invite as a design partner. The message is delivered by email to Grey Arc Ltd through Cloudflare, which processes it as our host. It is not stored in the DropZoom database and the form accepts no attachments. We keep your details for up to 12 months after our last contact with you, then delete them, or sooner if you ask us to with a privacy request through the contact form. We won’t add you to a mailing list.

Contact and report form

The contact form at publish.dropzoom.link/contact is how you report a publication or ask us a question. When you send it we process the category you choose, the DropZoom URL you give, your message, and a reply email if you add one. We also receive a Cloudflare Turnstile result that you are human, and ordinary request logs which can include an IP address; the IP address is not copied into the message. We use this to handle the report or request, to act on the publication if needed, and to reply to you if you gave an address. The message is delivered to Grey Arc Ltd through Cloudflare, which processes it as our host. The form accepts no attachments. We keep a message for as long as we need it to deal with the matter and to keep a record of how we dealt with it. A reply email is used only to answer you; we do not add it to any list.

Your rights

You can ask for access to, correction of, or deletion of account data, and you can object to or restrict some processing. Use the contact form and choose Privacy request. You can also complain to the Information Commissioner’s Office (ico.org.uk).

Contact

Grey Arc Ltd is a company registered in England and Wales (company number 17231697). Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. Site: greyarc.uk.

For abuse reports, privacy requests or other questions about DropZoom, use the contact form. It is protected by a human check, accepts no attachments, and reaches the people who run DropZoom. There is no public mailbox.

Related: Terms of use · Privacy · Acceptable use