Privacy policy

Who we are

Zapdrop is made by Workaholic Developers ("we", "us"). If you have a question about this policy or your privacy, email info@workaholicdevelopers.com.

What Zapdrop does not collect

Zapdrop has no account system and no servers of its own. We do not collect, receive, store, sell or share any personal data from the app: not your files, photos, contacts, messages, location, device identifiers, usage data or crash data. The app contains no analytics, advertising, tracking or crash-reporting SDKs, and it makes no connections to Workaholic Developers or to any third party.

If you have chosen in your phone's settings to share diagnostics with app developers, Apple or Google may give us anonymous crash reports and statistics. That sharing is controlled by your phone's settings and by Apple or Google, not by Zapdrop.

How your files travel

When you send something, it goes directly from your device to the device you chose, over the local network you are both on: your WiFi, or one phone's hotspot. It does not pass through our servers, any cloud service or the internet.

Between two Zapdrop apps

The connection is encrypted with TLS. Each installation of Zapdrop creates its own certificate on the device, and the sending app checks that it is talking to that exact device. Both screens show a 4-digit code for every transfer, and for QR pairing, so you can confirm who is on the other end. The receiver has to accept every transfer, unless they chose to always accept from a device they trust. Every file is checked with SHA-256 when it arrives.

A pairing QR code contains your phone's address on the local network, its device ID and a one-time key. The key works once and expires after 5 minutes.

Between your phone and a computer

When you open To computer and tap Start, your phone serves a small web page on your local network. That page uses plain HTTP, not HTTPS, so that computers don't show certificate warnings. It is protected instead by a 6-digit PIN that only your phone shows. After 5 wrong PINs a browser has to wait before it can try again, and after many wrong tries the phone makes a new PIN. The session ends after 10 minutes without activity (you can choose 5, 10 or 30 minutes) or when you tap Stop.

Because this page is not encrypted, someone else on the same network could in principle see what passes over it. The app warns you when you are on public WiFi, and we recommend your own home network or a phone hotspot for anything private.

The computer page keeps you signed in with a session cookie set by your phone, only for that session. It is not set by us and is not used for tracking.

What other devices on your network can see

So that nearby devices can find each other, Zapdrop announces itself on your local network (using Bonjour, also called mDNS) while it is open and able to receive. Other devices running Zapdrop on the same network can see the device name you chose, your avatar (generated from the device ID), the kind of device (for example iPhone or Android) and its model, and a random device ID. You can change the device name at any time in Settings. Nothing is announced outside your local network.

Where your data is stored

Files you receive

• iPhone: in Zapdrop's own folder, which you can see in the Files app under On My iPhone > Zapdrop. Photos and videos go to your Photos library only if you choose to save them there.
• Android: files in Download/Zapdrop, photos in Pictures/Zapdrop and videos in Movies/Zapdrop.
• Computer: your browser's download folder.

App data

Zapdrop keeps a few things on your device so that it works: your device name and avatar, your device's certificate and key (in the iPhone Keychain or Android's encrypted storage), the devices you trust and their keys, your transfer history (file names, sizes, dates and the other device) and your settings. They are stored only on your device and never sent to us.

If you back up your iPhone to iCloud or a computer, that backup may include Zapdrop's data and received files, as it does for other apps. On Android, Zapdrop's own app data is left out of Google backups; files saved to the shared Download, Pictures and Movies folders are backed up only if you use a backup app for them.

You can delete received items and history in the app at any time. Removing the app removes its data from the device, except files you saved to Photos, or to the shared Download, Pictures and Movies folders on Android, which stay until you delete them.

Permissions and why Zapdrop asks for them

Zapdrop asks for each permission only when you first use the feature that needs it, after explaining why. You can say no, or change your mind later in your phone's settings, and the rest of the app keeps working.

Local network

To find nearby devices and to send and receive over your WiFi or hotspot. iPhone: Local Network, Bonjour service _zapdrop._tcp. Android: network access, WiFi state and WiFi multicast.

Photos and videos

To show your photos and videos so you can choose what to send. Zapdrop reads the original files only of the items you send. Limited access ("selected photos only") is supported. iPhone: Photos. Android: photos and videos (or selected photos and videos only); storage on Android 12 and older.

Save to Photos

To save photos and videos you receive to your gallery, when you choose to. Zapdrop explains this before asking. iPhone: add-only Photos access. Android 9 and older: storage.

Photo location (Android)

Android removes location data from photos unless an app has this permission. Zapdrop uses it only so the originals you send keep their location. Zapdrop does not read, use or store your location.

Camera

Only to scan a pairing QR code. No photos or videos are taken or saved.

Contacts

To send the contacts you pick as contact cards (vCard), and to add contacts you receive when you tap Add. Zapdrop never uploads your address book anywhere.

Notifications and background transfers

To show the progress of long transfers and keep them going if you switch apps or the screen turns off. Android: notifications, a data sync foreground service and a wake lock. iPhone: a short background task that lets a transfer finish after you leave the app.

This website

zapdrop.wdlab.app is a static website. It sets no cookies, runs no analytics or tracking, and loads no third-party scripts, fonts or other content. Like most web servers, ours keeps standard access logs (IP address, browser user agent, time and the page requested) for security and troubleshooting. These logs are deleted automatically after 14 days and are not used to identify or track you.

Children

Zapdrop is suitable for everyone and does not collect personal data from anyone, including children under 13 (or the minimum age in your country). Parents may want to remind children to accept transfers only from people they know.

Your choices and rights

Because we receive no personal data from the app, we hold nothing about you that we could show, correct or delete. Everything Zapdrop stores is on your devices and under your control. For questions about the website logs, or any other privacy question, email us.

Changes to this policy

If the way Zapdrop handles data changes, we will update this policy and the date at the top before the change reaches the app, and describe significant changes in the app's update notes.

Contact

Workaholic Developers
info@workaholicdevelopers.com
workaholicdevelopers.com