Effective October 21, 2026. Last updated October 21, 2026

Privacy

DropYourFiles carries a studio's work to their client. That means we hold files that belong to somebody else, and a small amount of information about the people who open them. This page says exactly what, and why.

Who we are

DropYourFiles is operated by Ownthelight Inc. You can reach a person at support@dropyourfiles.com.

There are two kinds of people on this service and it matters which one you are. A studio has an account with us. A client opens a link a studio sent them and never makes an account. For anything a studio uploads, the studio decides what happens to it and we act on their instructions.

What we collect

If you have a studio account

• Your email address, and your name and studio name if you give them.
• How you sign in: an email address and password, or Google. If you sign in with Google we receive your name, email address and profile picture, and use them only to create your studio account and sign you in. We never receive your Google password.
• Your plan, and (if you pay us) a billing record held by Stripe. You enter card details on Stripe’s own pages; they never reach our servers.
• The files you upload, the settings you choose for each project, and the settings you choose for each client, such as which reminder emails they get.

If a studio sent you a link

• The name you type when you leave a note or approve something, and your email address if you provide one so the studio can reply.
• The notes you write, with the timecode or the spot on the frame they point to, and the files you mark as favorites.
• When a delivery is approved we record who approved it, the time, and the IP address it came from, because an approval is a decision the studio may need to evidence later.

Automatically

• When a link is opened, a file played or a file downloaded, we record the event, the time and the IP address, and show it to the studio. This is what lets a studio see whether their client has opened the link.
• A session cookie, if you sign in. We do not use advertising cookies and there is no third-party tracking on the pages your clients see.
• On our own pages (the front page, sign-in, checkout, the sample delivery) we count visits with Vercel Web Analytics, in aggregate and without cookies. It does not run on any link a studio sends a client.
• On those same pages, one cookie of our own, dyf_attr, remembers for 90 days how you first found us: the page you landed on, the site or search that sent you, and any campaign tag in the link. If you sign up, we keep that with your studio, along with your answer to “How did you hear about us?” if you gave one, so we can tell which of our pages and posts bring studios. It is never set on a link a studio sends a client, and it is not shared with anyone.

If you join the Mac app list

We keep your email address and the date you added it, and nothing else. We use it once, to tell you when the Mac app is out, and then we delete it. To come off the list sooner, reply to that email or write to support@dropyourfiles.com.

If you use the Mac app

The Mac app is optional. It uploads the files you choose to your projects, and nothing else on your Mac. It checks for updates to itself using Sparkle.

If you import from Dropbox or Google Drive

You pick files in Dropbox’s or Google’s own chooser. We receive a temporary link, or a limited access token, for only the files you picked. We copy those files into your project and do not keep access to the rest of your Dropbox or Drive.

Emails we send

Emails are sent through Resend.

• To studios: when a client leaves notes, when a client approves, and the emails an account needs, such as signing in.
• To clients, on the studio’s behalf: sent with the studio’s name as the sender. The link to the gallery, and only if the studio turns them on for that client: a reminder to save the files when approved work has not been downloaded after about 30 days, and a check-in email after 3 months, 6 months or a year, whichever the studio picks, or never.
• After approving, a client may be asked on the gallery page for a short testimonial. Giving one is optional.

The studio controls these. If you are a client and want them to stop, ask the studio, or write to us.

Why we hold it

• To run the service: store and deliver files, carry notes back, gate downloads on approval.
• To tell a studio what happened: opens, plays, downloads, notes and approvals.
• To bill, if you are on a paid plan.
• To keep it working and safe: diagnosing faults, preventing abuse.

We do not use anyone’s files or notes to train machine-learning models, and we do not sell or rent personal information to anybody.

Who else processes it

We use a small number of companies to run the service. Each one only receives what it needs.

• Vercel: hosting the website.
• Supabase: the database, accounts and sign-in.
• Cloudflare: file storage (R2), and processing and delivering video.
• Resend: the emails the service sends.
• Stripe: payments, through Stripe Checkout and Stripe’s customer portal. Card details go to Stripe and never reach us, and Stripe’s own privacy policy covers what Stripe collects.
• Google: only if you choose to sign in with Google.
• Dropbox or Google: only if you choose to import files from them.

How long we keep it

• Your files are never deleted for being old, and nothing is moved away or archived. A delivered project stays online at full size, and its link keeps working, for as long as the studio keeps it. Apart from old versions (below), files are permanently deleted only when the studio deletes them.
• Old versions of a replaced file: the newest twenty are kept. Seven days after the client approves, the earlier ones are deleted, unless the studio chooses to keep them.
• Notes, favorites and approvals stay with the project they belong to. An approval keeps the IP address it came from for as long as the project exists.
• Access records (opens, plays and downloads, each with its time and IP address) are kept for six months, so a studio can see who opened their link. After that we keep only the totals, how many opens and downloads and by which reviewers, and delete the individual records and their IP addresses.
• The Mac app list: your address is deleted once the launch email has gone, or sooner if you ask.
• When you close your account we delete your files and your account data. Ask us and we will confirm in writing when a deletion is done.

Your choices

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@dropyourfiles.com and we will act on it.

If a studio sent you a link and you want your note or your name removed, you can ask us or ask the studio. It is their gallery, and either route works.

Depending on where you live you may also have the right to object to processing, to ask for your data in a portable form, or to complain to a data protection regulator. We will not treat you differently for asking.

Do Not Track

Some browsers send a “Do Not Track” signal. There is nothing here for it to turn off: we do not track you across other websites, we run no advertising network, and we do not sell or share your personal information with anyone for advertising. What we measure is our own pages: which ones get opened, and whether they worked. We do not use it to follow you anywhere else.

If you live in California

DropYourFiles is run from California and the rights above apply to you: ask us what we hold, ask us to correct it, ask us to delete it. We do not sell or share personal information, and we have not in the twelve months before this page was last updated. We will not treat you differently for asking.

Security

Files are stored in Cloudflare R2 and are never publicly listable. A download link is signed at the moment you click it and stops working after twelve hours, so a large file can finish on a slow connection. A studio can give a project link a password and an expiry date. More on how files are protected is on our security page.

No service can promise perfect security. If we ever discover a breach affecting your data we will tell you.

Where your data is held

Files are stored in the United States. Our providers operate globally, so some processing (delivering a file to a client abroad, for example) may happen outside the country you live in.

Children

This is a tool for professionals. It is not directed at children under 13 and we do not knowingly collect information from them.

Changes

If we change this page we will change the date at the top. If a change materially affects studios with accounts, we will email them.

Questions about this page? Write to support@dropyourfiles.com and a person will answer.