Privacy Policy
Last updated: 2 October 2026
- No accounts, no ads, no analytics or tracking cookies.
- Your messages and files go directly between devices, end-to-end encrypted. We never receive or store them.
- Chat history is off by default. If you turn it on for a chat, it is kept encrypted on your device only, and the other person is told.
- Our servers only help devices find each other, and keep as little as possible for as short as possible.
Who we are
SRT Drop (drop.srt.bd) is built and run by Salah (salahuddin.dev), referred to here as "we". You can reach us through that website with any privacy question or request.
Messages and files
Chats, photos, videos and files travel over WebRTC data channels, which are encrypted end to end (DTLS). They go from your device straight to the other device.
When a network blocks a direct connection, the encrypted data passes through our relay server (a TURN server). The relay only forwards packets it cannot decrypt and does not store them. Like any server, it may keep short technical logs (IP addresses, times and the amount of data forwarded) to keep the service running and to stop abuse. Each relayed connection is limited in speed, and relay credentials expire after an hour, so the relay can't be used as a general proxy.
What our servers handle
| Data | Why | How long |
|---|---|---|
| Your IP address | Connecting you, grouping devices on the same network so people on your Wi-Fi can find you (unless you choose Nobody), rate limiting abuse | While you are connected; rate-limit counters for up to 10 minutes |
| A random client ID made by your browser (not linked to your name, contacts or anything else) | Rate limiting per device, so people who share one mobile-network IP address are not blocked together | Rate-limit counters for up to 10 minutes |
| The device name and avatar you show (for example "Teal Otter") and device type | Shown to the devices you connect with, and to verified devices on your local network | While the page is open |
| Session codes and connection details (network addresses needed to connect) | Passing the connection setup between two devices | Until the session ends, at most 12 hours |
| Contacts: a random device ID, a hash of its secret, hashes of pairing tokens, and your browser's push subscription | Letting only your saved contacts send you a "wants to chat with you", "new message from" or "is calling you" notification | Until you remove the contact, or 90 days after it was last used |
| Whether SRT Drop is open on a saved device (online or not) | Showing a green dot to the devices you paired with; only they can ask | Only while the page is open; nothing is logged |
| Group chats: the group creator's public key (not the group name or icon) | Handed to members who join, so their devices can check that only the creator changes the group name and icon. The name and icon themselves go device to device | Until the group room ends, at most 12 hours |
| Your internet provider's network number (AS number), only if you choose My ISP or Everyone under Who can find you | Showing your name, avatar and device type to others on the same provider who chose that too. Your IP address and device ID are not shown to them | While the page is open; nothing is logged |
| An anonymous block ID: a one-way hash of the random ID your browser uses for rate limits | Shown with your name to people who can find you, so they can block you, and to let reports work | While the page is open |
| Reports in Global: the block ID reported, the reporter's block ID and the time. Never any message content, which we cannot see | Keeping people reported by several others out of Global for a day | Up to 24 hours; a resulting ban lasts 24 hours |
| Offline mode | Nothing reaches our servers: the two devices swap connection details as QR codes and connect over your Wi-Fi, for chats, files and calls | Not stored |
Push notifications are delivered by your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser). In the Android app they are delivered by Google's Firebase Cloud Messaging, encrypted with a key that only your phone has. Their content, the sender's device name and the session link, is encrypted so the push service cannot read it. A push only ever says who wants to connect or who wrote; it never contains your messages. Notifications for messages that arrive while SRT Drop is in the background are made on your device from the message that just arrived, and by default say only who wrote. If you turn on Message previews in Settings, they also show the text, still made on your device and never sent through our servers. You can turn notifications off in Settings.
Usage numbers
The homepage shows how many people have SRT Drop open right now and roughly how many browsers have ever used it. To count them, an open page keeps one connection to our server, opened with the same random, anonymous browser ID it already uses for rate limits. "Online now" is simply the number of open connections; nothing is stored about who they are, and a connection is gone when the page closes. The total is kept as a statistical sketch that cannot list or recognise any browser. These numbers include people set to Nobody, but nobody can see who they are.
What stays on your device
These are kept only in your browser, never on our server:
- Your settings: device name, avatar, theme, contacts and a random device ID, so the app works the way you left it.
- Call history: who, when, how long, and whether it was missed. Clear in the Calls tab removes it.
- Safety code data: this device's connection certificate (its fingerprint makes up the safety code), and for each saved contact the fingerprint last seen, so the app can warn you if it changes. The certificate's private key never leaves your browser.
- Relay counters: how many bytes of files went through our relay today (for the 5 GB daily limit) and today's relayed call minutes (for the call limits; calls relayed within Bangladesh are not limited, which your device works out from how quickly the relay answers). They are counted on your device and never sent anywhere.
- Blocked people: listed with the name and avatar they had, so you can unblock them later.
Chats and files
- Chat messages are only held in memory and disappear when the chat ends.
- In the Android app, a message that arrives while the app is closed is fetched straight from the sender's device and kept on your phone only until you open that chat.
- If you turn on Keep chat history for a chat, its messages and the names and sizes of files (not the files themselves) are stored in this browser, encrypted with a key that is created on your device and cannot be exported. The other device is told that you keep the chat.
- You can export a saved chat as a text file or delete it at any time. Either person can use Delete chat for everyone, which removes the chat on both devices, including any saved copy, as soon as the other device can be reached.
- Received files stay in the browser's private storage until you save them. Ending a session deletes them, and anything left over is cleared on your next visit.
Microphone and camera
- The microphone is used only while you record a voice message or are in a call.
- The camera is used only during a video call with it turned on, or in offline mode to read the other device's QR code.
- Voice messages go straight to the other device like any file. Calls go straight between the two devices, encrypted, and are never recorded or stored by us.
Deleting or moving it
- Clearing this site's data in your browser removes everything for good, since there is no copy on our server.
- To keep it when you change devices, use Move to another device in Settings. It goes directly from your old device to the new one over your local network, encrypted with a one-time key from the QR code that our server never sees, and the old device is then cleared.
Service providers
- Cloudflare hosts the website and the connection server. It processes requests (including IP addresses) as described in its own privacy policy.
- STUN servers, our own in Bangladesh and others from Cloudflare and Google, tell your device its public address so a direct connection can be set up. They do not see your content.
- Push services run by your browser's maker deliver notifications from your contacts.
We do not sell or share personal data, and we do not use it for advertising.
Your choices and rights
You don't need to give us your name, email or phone number. You can rename your device at any time, forget paired devices, turn notifications and message previews on or off, keep or delete chat history per chat, and clear stored data. Because we hold almost nothing that identifies you, most requests are handled by these controls. For anything else, contact us through salahuddin.dev.
Children
SRT Drop is not directed at children under 13, and we do not knowingly collect their data.
Changes
If we change how data is handled, we will update this page and the date at the top.