Legal

Privacy

Last updated 13 September 2026. Grey Arc Ltd is the controller for DropZoom account data. Cloudflare processes traffic and stored files so the service can run.

What we collect

• Guest try-it: the files you upload, a Cloudflare Turnstile result that you are human, and ordinary request logs which can include an IP address. We do not create an account.
• Registered accounts: the identifier you use to register, a password hash, recovery-key hashes (not the key itself), session cookies, and the publications you keep.
• Agents: API or recovery-key hashes and publish metadata for that identity.

Turnstile

Guest publish and guest registration use Cloudflare Turnstile, a human check. Cloudflare receives the widget result. Agents using an account or recovery key do not go through that guest check.

Scanning

Files may be scanned for malware and a limited set of accidental-secret patterns before they are served. That is not a guarantee that every secret or every harmful file is found. We do not use your files to train public AI models.

How long we keep it

Guest publications expire after 24 hours. Account publications stay until you delete them or we remove them under the terms. Cloudflare keeps ordinary edge logs for its own operations.

Sharing

We do not sell your data. We share it with Cloudflare as the host, and if the law requires it. A public link is public: anyone with the URL can fetch the files unless you set a password.

Your rights

You can ask for access or deletion of account data. Use the contact details on greyarc.uk. Related: Terms of use · Acceptable use