+ VniDrop has no user accounts and does not upload your transfer to a VniDrop file + store. Files travel over an authenticated, end-to-end encrypted connection. + Product diagnostics are opt-in; a bug report is sent only when you submit one. +
+Scope and who “VniDrop” means
++ This policy covers the official VniDrop website, the VniDrop applications for + Android, iOS, macOS, Windows, and Linux, and the diagnostics service configured by + the official project. In this policy, “VniDrop,” “we,” and “us” refer to the + maintainers of the official VniDrop project and the official builds they distribute. +
++ VniDrop is open-source software. A build distributed or operated by someone else + may use different networking infrastructure, diagnostics settings, or website + hosting. That distributor is responsible for explaining its own practices. +
+What happens during a transfer
+File contents
++ The sender chooses files or folders on their device. VniDrop streams those bytes to + an approved receiver and does not first upload them to a VniDrop-hosted storage + bucket. The receiver saves the files to a destination they choose. Relayed traffic + remains end-to-end encrypted. +
+Invitations and transfer metadata
+
+ A QR code, NFC tag, or .vnd file contains a transfer invitation. The
+ invitation includes connection and content identifiers plus transfer metadata such
+ as the transfer name, optional sender name, creation time, file count, and total
+ size. It is a capability: anyone who receives it may be able to request the transfer
+ while the share is active. Treat it like a private access link.
+
What peers and relays can see
++ A receive request can disclose the receiver’s chosen display or device name, + application version, and a technical endpoint identifier to the sender. A direct + connection exposes the peers’ IP addresses to one another. When a public relay is + used, its operator can observe connection metadata such as source and destination IP + addresses, connection time, and the amount of relayed data, but cannot read the + encrypted transfer contents. +
++ Approval is required by default. If the sender selects “Anyone with this transfer,” + anyone holding the invitation may receive the files until sharing stops. +
+Information kept on your device
+VniDrop stores the information needed to operate the app locally, including:
+-
+
- device identity and networking keys used to establish secure connections; +
- active shares, transfer history, receiver requests, progress, and status; +
- app preferences, including access and diagnostics choices; +
- download destinations and locally managed transfer data; and +
- an anonymous installation identifier used only for diagnostics correlation. +
+ This information remains until you remove the relevant history, stop or delete a + share, clear the app’s data, or uninstall the app, subject to operating-system file + behavior. Removing VniDrop history does not delete a file you already downloaded; + delete that file through your operating system if you no longer want it. +
+Optional diagnostics and bug reports
+Automatic product diagnostics
++ When an official build includes diagnostics, automatic usage events and crash + reports are disabled until you enable “Share diagnostics.” If enabled, VniDrop may + send an anonymous installation ID, app version, platform, sparse event names and + properties, crash type and message, a redacted stack trace, timestamps, and recent + in-app breadcrumbs. You can turn this off at any time; doing so also removes pending + local crash reports. +
+User-submitted bug reports
++ A bug report is separate from the diagnostics toggle and is sent only when you press + submit. It can contain what you say happened, what you expected, reproduction steps, + an optional contact email, app and platform versions, an anonymous installation ID, + device name and model, operating system, network and battery information, recent + breadcrumbs, and optional recent logs. You can exclude logs before submitting. +
+Data deliberately excluded
++ Automatic diagnostics are designed to exclude transfer contents, invitations, and + file paths. Before diagnostic text or optional logs are sent, VniDrop applies rules + intended to redact invitation tokens, endpoint identifiers, absolute paths, file and + content URIs, and platform document identifiers. No redaction system is perfect, so + review anything you type into a bug report and avoid including secrets. +
+The VniDrop website
++ This website is a static product site. It does not provide an account, contact form, + advertising, behavioral analytics, marketing pixels, or non-essential cookies. It + does not ask the browser for access to your files, camera, contacts, location, or + nearby devices. +
++ The hosting and security infrastructure may process routine request information—such + as IP address, time, requested page, referrer, and browser user agent—to deliver the + site, maintain reliability, and prevent abuse. The live hosting provider must be + identified in this policy before public deployment if it differs from the providers + described below. +
+Device permissions
+Choose what to send and where received files are saved.
Scan a QR invitation when you choose that receive method.
Read or write an invitation through a compatible NFC tag.
Connect peers and alert you to background receiver requests.
+ VniDrop requests a platform permission only for the related feature. On Android, QR + scanning may be provided through Google Play services Code Scanner. Platform-level + permission prompts and service-provider terms also apply. +
+Infrastructure and external services
+Device discovery, connection establishment, and encrypted relay fallback. Relays process connection metadata but cannot decrypt transfer contents.
The project’s diagnostics design uses Cloudflare Workers, D1, and R2. Cloudflare also processes source IPs for request delivery and abuse controls.
May provide the QR code scanner on supported Android devices when you choose to scan an invitation.
Hosts the source repository, issue tracker, and external pages linked from this site. GitHub’s own privacy terms apply after you follow those links.
+ Provider policies: {" "} + Iroh, {" "} + Cloudflare, {" "} + Google, and {" "} + GitHub. +
+Retention and deletion
++ Operational backups, provider logs, and deletion backlogs may persist briefly beyond + the stated period where necessary for security, integrity, or legal obligations. If + the production diagnostics retention configuration changes, this policy should be + updated to match it. +
+Your choices and rights
+-
+
- Enable or disable “Share diagnostics” in VniDrop settings. +
- Submit a bug report only when you choose, omit contact information, and exclude logs. +
- Approve or refuse each receiver, cancel a transfer, or stop sharing. +
- Delete individual transfer history or clear completed, failed, and cancelled receive history. +
- Delete downloaded files using your operating system, or clear all app data by uninstalling or resetting the app. +
+ Depending on where you live, privacy law may provide rights to access, correct, + delete, restrict, or object to processing of personal information. Because VniDrop + has no account and automatic diagnostics use an anonymous installation ID, we may + not be able to connect a server record to you without additional information. Use + the contact method below and provide only what is needed to locate your submission. +
+Security
++ VniDrop uses authenticated end-to-end encrypted connections, content verification, + deny-by-default share access, bounded diagnostics payloads, redaction, and safe file + publishing that avoids silently replacing an existing file. No system can guarantee + absolute security. Keep invitations private, verify receiver names, keep your device + updated, and stop sharing when a transfer is finished. +
++ Please report a suspected vulnerability through the private process in the {" "} + VniDrop security policy, not in a public issue. +
+Changes to this policy
++ VniDrop is in early development. Features and data practices may change. When this + policy changes, we will update the effective date and version at the top of the page + and publish the revised text with the project. Material changes should be called out + in release notes or the application where practical. +
+Contact
++ VniDrop is currently maintained as an open-source project and does not yet publish a + dedicated privacy email or postal address. For a privacy question or request, open a + request in the project issue tracker. Do not put an invitation, file content, + credentials, or other sensitive information in a public issue. +
+ + Contact the maintainers +