Privacy policy

Who we are

WiFiDrop, Winnipeg, Manitoba, Canada

Privacy contact

Privacy Officer, filedrop.support@gmail.com

Summary

WiFiDrop runs on your own Windows computer. Your files, user accounts and settings are stored on that computer, not with us. The app does not send us your files, file names or usage data. We collect only the limited information needed to run this website, answer you and, once Pro launches, sell and support licences.

We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Where they apply, we also respect Quebec's Act respecting the protection of personal information in the private sector (Law 25), the EU and UK General Data Protection Regulation (GDPR), and US state privacy laws such as the California Consumer Privacy Act (CCPA).

Information in the WiFiDrop app

• Files: stored in the folder the administrator chooses on their PC. Other people reach them over the local network. Files are never sent to us.
• Accounts: usernames, display names and passwords (stored only as Argon2id hashes) are kept in a database on the PC, in %ProgramData%\WiFiDrop.
• Activity and logs: sign-ins, admin actions and device network addresses are recorded on the PC so the administrator can manage it. They stay on the PC.
• Update check: about once a day, WiFiDrop downloads a small version file from our website to see whether a newer version exists. Like any web request, this shows our web host your IP address and the app version. Nothing else is sent.
• Pro licence check (Pro only): when you add a Pro licence, and about once a week after that, WiFiDrop sends our licence service the licence (which includes the email address it was issued to), a random ID for that installation and the app version. This lets us limit a licence to three PCs and apply refunds. If the check can't connect, Pro keeps working. WiFiDrop Free never contacts the licence service.
• Send feedback: if the administrator clicks Send feedback, WiFiDrop opens our feedback page with the app version and Windows version filled in. Nothing is sent until they submit the form.
• No telemetry: the app does not send analytics, crash reports, file names, file contents or usage data.

The person who runs WiFiDrop on their PC decides how it's used and is responsible for the information of the people they add. We have no access to it.

Information on this website

• Hosting: this website is hosted by GitHub Pages (GitHub, Inc.). GitHub processes basic request information, such as your IP address and browser, to deliver and protect the site, under the GitHub Privacy Statement. We don't receive these logs.
• Cookies: we don't use advertising, analytics or tracking cookies. The site stores your light or dark theme choice in your own browser, which is never sent to us. If you open the checkout to buy Pro, our payment provider Paddle loads its own checkout, which may use cookies and similar technology needed for payments and fraud prevention, under Paddle's privacy policy.
• Pro waitlist: if you sign up, we keep your email address and the date you gave consent, and use them only to tell you when Pro launches. Every email includes our contact details and an unsubscribe link, as Canada's Anti-Spam Legislation (CASL) requires. We delete your address when you unsubscribe or 12 months after launch, whichever comes first.
• Feedback, contact and beta forms: we receive what you type and any screenshot or log you attach. We use it only to answer you, fix problems and plan WiFiDrop. Your email is optional on the feedback form. We delete form submissions after 24 months, sooner if you ask.
• Abuse protection: to stop spam, our form and licence servers keep a one-way scrambled version (a salted hash) of your IP address with each submission, and count requests per hashed address for up to a day to enforce rate limits. We can't turn the hash back into your IP address.
• Emails to us: if you email us, we keep your message and address to reply, for up to 24 months.

Purchases and licences

• Payments: purchases are handled by Paddle (Paddle.com Market Ltd), acting as merchant of record. Paddle processes your name, email, billing address and payment details under its own privacy policy, and sends us your email address and order ID so we can issue your licence. We never see your card details.
• Licences: our licence service stores the licence ID, the email address it was issued to, the Paddle order ID, the update period, whether it was refunded, and up to three random installation IDs with the app version and the last time each checked in. This lets licences be activated, recovered and refunded. It never receives file names or contents.
• Licence emails: we send your licence, and re-send it if you ask on the licence page, through our email provider Resend, which processes your email address to deliver the message.
• We keep purchase records for as long as tax law requires (in Canada, generally six years).

Why we use information (legal bases)

We use information only for the purposes above. For visitors in the EU and UK, our legal bases are: consent (waitlist emails), contract (selling and supporting licences), legal obligation (tax records) and legitimate interests (keeping the website secure and answering messages). We don't sell or rent personal information, and we don't use it for targeted advertising.

Where information is stored

This website is hosted by GitHub Pages, on servers outside Canada (mainly in the United States). Form submissions, attachments, the waitlist and licence records are stored by our database provider, Supabase, in its Canada (Central) region. Paddle (United Kingdom, with processing in other countries) and Resend (United States) process information in other countries, where it may be accessible to local authorities under local law. When information leaves Canada or the European Economic Area, we rely on contracts with appropriate safeguards, such as the EU Standard Contractual Clauses.

Security

We collect as little as possible, use encrypted connections (HTTPS), limit access to the few people who need it and use reputable providers. If a breach creates a real risk of significant harm, we'll notify affected people and the Office of the Privacy Commissioner of Canada as the law requires.

Your rights

Wherever you live, you can ask us to tell you what information we hold about you, correct it, delete it, or stop using it for emails. Depending on where you live, you may also have the right to data portability, to object to or restrict processing, and to withdraw consent at any time. We answer within 30 days.

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or your local data protection authority in the EU or UK.

Children

This website is not directed at children under 13, and we don't knowingly collect their information. Parents and guardians who run WiFiDrop at home decide who uses it on their own network.

Changes to this policy

If we change this policy, we'll update the date at the top. For important changes, we'll also post a notice on this website.

Contact

Questions or requests: email our Privacy Officer at filedrop.support@gmail.com. We answer within 30 days.