PixelDropPrivacy Policy
The short version: we collect only what we need to run your account, we don't run ads or sell your data, and we tell you plainly where your files live and who could reach them.
1. Who is responsible
PixelDrop is responsible for the personal information described here. You can reach us at [email protected].
2. What we collect and why
| Information | Why |
|---|---|
| Account: username, email address, a scrambled (hashed) version of your password, your profile picture if you add one, whether you enabled two-step login (and its secret, if you chose an authenticator app) | To create and secure your account and let you log in. We never store your password itself. |
| Your files' details: names, sizes, types, dates, and who you shared each one with | To show your files, enforce your storage limit and deliver shares. |
| Contacts you add: their names and email addresses | Only to email them a link when you choose to share a file. |
| People you connect with: your PixelDrop ID, the contacts you link to other accounts and whether they accepted, and the files you offer to or receive from them (name, size, status) | To let two people send each other files, only with the other person's agreement. The file itself stays in the sender's own Pixeldrain account until the receiver chooses to copy or download it. |
| Websites you save from: the address of each website you let save a file in your PixelDrop, when you first and last used it, and how many times | So you can see and remove them (Settings → Connected apps). A website never receives a key or access to your account, only the result of each save. When you choose a file for a website, or send one to an app, that site or app receives a download link for that one file (see section 4). |
| Apps you register (developers): the app's name, its site address, a verification code, the receiving address and signing secret if you set them, and whether we approved it | To show your app's name in the save window, check the site is yours, deliver files people send to your app and sign those messages. Remove the app in Settings → For developers to delete them. |
| Payments: which plan you bought, the amount, dates, and PayPal, NIM or stablecoin (USDC/USDT) transaction references | To give you access to the Membre features you paid for, send reminders, and handle billing questions. We never see card numbers. |
| TimeVault: the names of your computers, when they last synced, and counts and schedules (how many folders, how often, how many files, when the next backup is due) — never file or folder names | To show your backups on the TimeVault page. |
| Technical data: a login cookie, ordinary server logs (for example errors), and your IP address, used briefly in memory to limit login, sign-up and link-visit attempts and to block abuse | To keep you logged in and keep the service working and secure. |
| Your Pixeldrain connection: your Pixeldrain API key (kept encrypted on our server), your Pixeldrain username, and whether that account is free or paid | To store, read, share and delete your files in your own Pixeldrain account on your behalf, and to know what Pixeldrain allows for it. You can remove it any time in Settings. |
| Visits to your share links: when a link was opened or downloaded, the type of device and browser, and the approximate country — never the visitor's address | To show you, the owner, who is using your link. |
| Apps and browsers you connect: the name of each connected app or browser extension and when it was last used | So you can see and revoke their access. |
We do not use advertising or analytics trackers.
3. Where your files are, and who can reach them
- Your files are stored in your own Pixeldrain account, not on PixelDrop: PixelDrop reads and writes them there with the key you gave us. Files up to 25 MB sent from the website pass through our server on their way to Pixeldrain; larger files sent with the browser extension or the desktop app go straight from your device to Pixeldrain (we hand the app your key for that one upload; it does not keep it). They are not end-to-end encrypted: Pixeldrain and the operator could technically access them. For a file kept on a free Pixeldrain account, previews and downloads happen on Pixeldrain's own page (or straight from Pixeldrain with the browser extension or the desktop app), not through our server. For an account on a paid Pixeldrain plan, our server may relay a preview and keep a small copy of an image for up to an hour in a private temporary file.
- Share links of a free Pixeldrain plan lead to Pixeldrain. After the link's checks, the visitor is sent to the file's page on pixeldrain.com, which then sees the visitor's address and browser under Pixeldrain's own privacy policy; PixelDrop does not relay that download.
- TimeVault backups are encrypted on your own computer before they are sent, with a key only you hold. Neither Pixeldrain nor the operator can read their names or contents. What we can see is that a backup exists, its approximate size, its time and the name of your computer.
4. Other companies involved
| Who | What for |
|---|---|
| Pixeldrain | Storing your files and TimeVault backups (the latter encrypted) in your own Pixeldrain account. Pixeldrain's own policy applies to that account. |
| MailerSend | Sending emails: confirmation codes, sharing invitations to your contacts, storage and expiry reminders. |
| PayPal | Card and PayPal payments. PayPal handles your payment details under its own policy. |
| The Nimiq, Polygon and Ethereum networks | NIM and stablecoin (USDC/USDT) payments. Blockchains are public: a payment, its amount and the wallet that sent it are visible on the network by nature. To confirm a stablecoin payment we read the public chain through public node providers (for example 1rpc.io, publicnode, dRPC, Cloudflare); they only see the receiving address and the block range we ask about, not who you are. |
| Cloudflare | Carrying traffic between your browser and our server. It terminates the secure connection, so it can see ordinary requests and your IP address, under its own policy. |
| Oracle Cloud | Hosting the PixelDrop server. |
| Google Fonts and jsDelivr | Loading the site's typeface and the Nimiq payment library. Their servers see your IP address when you visit the site. |
| Apps you connect (for example an email program) | Only what you approve for each app, such as listing your files or saving an email into them. You can revoke it in Settings → Connected apps. |
| Apps you send a file to | When you pick “Send to” an app, our server posts a message to the receiving address that app registered, with the file's name, size, fingerprint and a download link that works for 24 hours and 3 downloads. It contains no name, email or account information about you. What the app does with the file afterwards is under its own policy. |
We don't sell your personal information or share it with anyone else, except where the law requires it. Several of these companies (Pixeldrain, Oracle, MailerSend, PayPal, Cloudflare) operate outside Québec and may process data in other countries, under their own policies and the laws there.
5. Cookies
We use one login (session) cookie that JavaScript can't read, and a small cookie remembering your language on these information pages. We don't use advertising or tracking cookies.
6. How long we keep things, and deleting your data
We keep your information while your account exists. You can delete any file yourself at any time (we remove it from your Pixeldrain account too). You can close your account yourself in Settings → Delete my account: we then remove your account, contacts, stored Pixeldrain key and the files stored through PixelDrop (also from your Pixeldrain account) straight away. If you can't sign in, contact us from your account's email address. Copies of our data are kept in daily backups for up to 14 days, so deleted data can remain there until they are overwritten, and we may keep what the law requires us to keep, such as payment records.
7. Your rights
You can ask to see the personal information we hold about you, to correct it, to have it deleted, or to withdraw your consent, in line with the privacy laws that apply to you. Write to us at [email protected]; we'll answer within a reasonable time. You may also complain to your local privacy authority (in Québec, the Commission d'accès à l'information). If a confidentiality incident presents a risk of serious harm, we will notify the people concerned and the Commission d'accès à l'information. The person responsible for the protection of personal information is the operator, reachable at the address above.
8. Security
We protect your information with measures such as hashed passwords, secure connections, optional two-step login and end-to-end encryption for TimeVault. No system is perfectly secure, so please use a strong, unique password.
9. Children
PixelDrop is not meant for children under 16. If you think a child has given us information, tell us and we'll delete it.
10. Browser extension
The optional PixelDrop browser extension (Chrome, Edge, Brave, Firefox, Opera) sends files from your browser straight to your own Pixeldrain account, adds a right-click “Send to PixelDrop” entry, and downloads and shows thumbnails of files kept on a free Pixeldrain account.
- What it keeps in your browser: a random device token (PixelDrop only keeps a fingerprint of it), your username, and your choice to copy a share link after an upload. You can remove it at any time with Disconnect this browser in the extension or in Settings → Connected apps.
- Where data goes: only between your browser, pixeldrop.ca and pixeldrain.com. For each upload PixelDrop hands the extension your Pixeldrain key for that one upload; the extension keeps it in memory only and never stores it. The file goes straight to Pixeldrain, not through our servers, and PixelDrop is then told its identifier, size, type and fingerprint so it appears in your files. About every half minute it also asks PixelDrop whether you sent it a file from your own account (right-click → Send to…), and if so downloads that file straight from Pixeldrain into your Downloads folder. When you download a file with it, PixelDrop likewise hands it your key for that one file, kept in memory only, and the file goes straight from Pixeldrain to your computer.
- The pages you visit: the extension does not read your pages, tabs or browsing history. When you right-click an image or a link and choose to send it, your browser asks your permission for that one website so the extension can read the file you picked.
- No advertising, no analytics, no code loaded from elsewhere, and nothing sold or shared. The data is used only to provide the features above.
11. Changes
If we change this policy, we'll update the date above and, for important changes, tell you by email or in the service.