Privacy Policy

Who is responsible and how to contact us

AptivEdge Infotech operates Keydrop. Our contact address is 67/24, Devar Street, Villivakam, Chennai 600049, Tamil Nadu, India. For privacy questions or requests, email support@aptivedge.in.

Information we handle

• Account and authentication information: email address, password submission to the authentication service, verification and recovery events, account settings, and plan information.
• Secret links: encrypted secret text, file data when the file feature is used, and related metadata such as labels, expiry, view limits, status, and access events. The decryption key is placed in the URL fragment, which browsers do not send in ordinary HTTP requests. If you set a passphrase, the passphrase itself is not sent; the service receives verification material needed to enforce it.
• Recipient and request information: recipient email addresses when you enable email verification, encrypted responses to secret requests, public keys needed to encrypt those responses, and abuse reports or support messages you submit.
• Request recovery data on your device: a private key and its passphrase-encrypted recovery file may be stored in first-party IndexedDB in your browser so you can decrypt a response. The private key is not sent to Keydrop. If you clear browser storage or lose the recovery file, you may not be able to decrypt the response.
• Security and usage information: IP address or derived network information, device and browser details, request timestamps, rate-limit records, authentication events, and audit events needed to secure and operate the service.
• Billing information, if you purchase a plan: subscription, payment, invoice, refund, amount, currency, and transaction references. The payment provider processes payment credentials; Keydrop does not ask you to send us full card numbers or security codes.

Do not send passwords, secret contents, decryption keys, or verification codes to support.

How we use information

We use information as needed to:

• create and secure accounts and authenticate users;
• create, deliver, expire, revoke, and manage secret links;
• send verification, recovery, recipient-access, and service emails;
• provide account, team, request, audit, and plan features;
• process subscriptions, payments, invoices, and refunds if enabled;
• detect abuse, enforce rate limits, investigate security incidents, and respond to reports;
• provide support, comply with law, and establish or defend legal claims.

Depending on the law that applies, we rely on providing the service you request, our legitimate interests in security and service operation, your consent where required, and legal obligations. We do not use secret plaintext or decryption keys for advertising.

Encryption and sharing

Secret text is encrypted in your browser before upload. The URL fragment containing the key is not included in normal requests to our server, but the recipient needs a complete working link to decrypt the secret. Anyone who obtains that link may be able to read it. Share links carefully and send any passphrase over a separate channel. We cannot recover a lost key or decrypt a secret on your behalf.

We handle encrypted content and link metadata to provide the service. Encryption reduces what we can access; it does not remove the need to protect your account, device, browser, and links.

When information is shared

We share information with service providers that help us operate Keydrop, including authentication and database, hosting and storage, transactional email, and payment services when paid checkout is available. These providers process information for the service purposes described here and under their applicable terms. A payment provider may collect payment details directly from you. We may also disclose information when required by law, to protect people or the service from abuse or security threats, or as part of a business transfer subject to applicable law.

Depending on the deployment and feature you use, these providers include Supabase for authentication and database services, Cloudflare R2 for object storage, Resend for transactional email, and Razorpay for payments if paid checkout is enabled. Hosting or infrastructure providers may also process service data to run Keydrop. We will update this notice if the providers or their roles materially change.

We do not sell secret content or personal information, and do not share it for third-party behavioral advertising. Service providers may process information in countries other than yours. Where required, we use legally recognized safeguards for international transfers.

Retention and deletion

A secret link is intended to become unavailable after its configured expiry, view limit, or revocation. Account deletion removes account access and triggers deletion of associated secret data and files. Deletion from active storage may take time, and copies in backups, security records, audit trails, billing records, or legal records may be retained for the period needed for recovery, security, accounting, dispute handling, or legal compliance. Audit entries associated with a deleted account may be retained with identifying actor information removed. We retain other information only as long as reasonably needed for the purposes above or as law requires.

International use and your rights

Keydrop may be accessed from countries where it is available. Information may be processed in India and in the countries where our providers operate. Depending on your location and applicable law, you may have rights to request access, correction, deletion, portability, restriction, or objection; withdraw consent; or complain to a regulator. These rights may have limits and exceptions.

Send a request to support@aptivedge.in from the email associated with your account where possible. We may need to verify your identity before responding. You must be at least 18 to use Keydrop; contact us if you believe a person under 18 has provided personal information so we can investigate and take appropriate action.

Cookies and policy updates

Keydrop uses essential cookies and browser storage for sign-in, request protection, and secret-request recovery. The Cookie Policy describes these technologies. We may update this notice when the service or law changes and will post the revised date here.