Privacy Policy
Effective: March 16, 2026
ClawDrop is operated by ClawDrop ("we," "us," "our"). This policy describes what data we collect, why, and how we handle it.
1. Data We Collect
When you upload a file
| Data | Storage | Retention | Purpose |
|---|---|---|---|
| Your uploaded file | Cloudflare R2 | Until expiry (1–90 days, default 7) | Core service — hosting and serving your file |
| File metadata (filename, size, type, SHA-256 hash) | Cloudflare KV | Same as file | Serving, preview pages, content integrity |
| Country of origin | Cloudflare KV | Same as file | Derived from Cloudflare's CF-IPCountry header. Used for aggregate analytics only. No city, region, or precise location. |
| User agent string | Cloudflare KV | Same as file | Truncated to 120 characters. Used to classify upload source (curl, Python, browser, etc.) for internal analytics. |
| IP address | Cloudflare KV | 1 hour maximum | Rate limiting only. Stored as a counter key, not logged. Automatically expires. |
When you create an API key
| Data | Storage | Retention | Purpose |
|---|---|---|---|
| API key hash (SHA-256) | Cloudflare KV | Indefinite | Authentication. The plaintext key is shown once and never stored. |
| Upload count, bytes stored/served | Cloudflare KV | While key exists | Usage tracking for your key |
When you visit the website
The ClawDrop website (void.clawdrop.io) is static HTML served by Cloudflare Pages. We do not use:
- Cookies (zero — none)
- Analytics scripts (no Google Analytics, Plausible, or similar)
- Tracking pixels or third-party tags
- Advertising networks
- Fingerprinting or device identification
Cloudflare may collect standard web server logs (IP, user agent, timestamp) as part of operating its CDN. This is governed by Cloudflare's privacy policy.
2. Data We Do Not Collect
- Email addresses
- Names or personal identifiers
- Passwords or account credentials (there are no accounts)
- Payment information (no paid tiers are currently active)
- Browsing history or referrer data
- Device fingerprints
- Location data beyond country code
3. How We Use Data
Data is used solely to:
- Provide the file hosting and sharing service
- Enforce rate limits and prevent abuse
- Generate aggregate internal analytics (upload counts by country, source, file type)
- Comply with legal obligations
We do not use your data for advertising, profiling, or any purpose unrelated to operating the Service.
4. Data Sharing
We do not sell, rent, or trade your data to any third party.
Data may be shared with:
- Cloudflare — our infrastructure provider. All data is processed through Cloudflare Workers, R2 (storage), and KV (metadata). See Cloudflare's privacy policy.
- Law enforcement — if required by valid legal process (subpoena, court order, or equivalent).
5. Data Deletion
When a file expires or is deleted by its owner:
- The file is permanently removed from Cloudflare R2
- All associated metadata (filename, hash, country, user agent) is removed from Cloudflare KV
- We do not keep backups of expired or deleted files
- Deletion is irreversible
Rate limit data (IP-based counters) expires automatically after 1 hour.
6. Data Location
All data is processed and stored on Cloudflare's global network. Cloudflare operates data centers worldwide. By using the Service, you consent to your data being processed in any location where Cloudflare operates.
7. Children's Privacy
The Service is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has used the Service, contact us and we will delete the associated data.
8. Your Rights
Because we collect minimal data and do not maintain user accounts:
- Access: You can inspect your API key's metadata via
GET /keys/me. - Deletion: You can delete your uploaded files via
DELETE /:slugwith your API key. Files also auto-delete on expiry. - Portability: You can download your files at any time before they expire.
For GDPR, CCPA, or other data rights requests, contact: [email protected]
9. Changes to This Policy
We may update this policy at any time. Changes take effect when posted to this page. We do not collect email addresses, so we cannot notify you directly. Check this page periodically.
10. Contact
Privacy questions: [email protected]