Privacy Policy

Last updated: September 6, 2026

DropIMG (“DropIMG,” “we,” “us”) is a temporary image sharing utility. You paste, drop, or choose an image; we give you a short link that expires. Optional accounts add sign-in, history, Drops Pro, and Web Assets. This Policy explains what we collect, why, how long we keep it, and your choices.

By using DropIMG you agree to this Policy and our Terms of Use.

1. What DropIMG is (and is not)

• An account is optional for Drops. Anonymous Drop uploads still work, and expire after 7 days by default (or 1 hour, 24 hours, or 30 days if you choose).
• No public gallery or browseable library of uploads.
• Share pages for Drops are marked noindex so they are not meant for search results.
• Drops are temporary. Free Drop links expire after 1 hour, 24 hours, 7 days, or 30 days, whichever you chose. Drops Pro links expire after at most 180 days. Web Assets at /m/… stay until you replace or delete them and are public to anyone with the URL.
• Anyone who has a working Drop share link can view the image until it expires, is deleted, or (if protected) until they unlock it.

2. Optional accounts

If you sign in, we store the email address you provide so we can send one-time magic links and recognize your account. There is no account password.

3. Authentication

• Sign-in uses a one-time magic link sent to your email.
• The raw magic-link token is not stored. We keep a hash until the link is used or expires (about 15 minutes).
• A signed-in session uses an HttpOnly session cookie. Only a hash of the session token is stored.
• You can sign out of the current device or all devices from your account page.

4. Uploads

4.1 Images

When you upload an image we process and store:

• The image file bytes (after metadata handling described below).
• Technical metadata needed to serve it: MIME type, file size, optional width/height, creation time, expiry time, and a random short URL slug.
• A hashed delete token so you can delete the image early if you still have the delete control.
• If you are signed in, an association between the image and your account so it can appear in My Drops.

We do not store the original filename from your device.

Supported formats for Drops: PNG, JPEG, WebP, and GIF, up to 25 MB. SVG is rejected on Drops. Web Assets also accept AVIF, sanitized SVG, ICO, WOFF, and WOFF2, at 10 MB per file.

4.2 Retention

• Anonymous and Free Drops: 1 hour, 24 hours, 7 days, or 30 days, depending on the expiry you choose at upload, or sooner if you delete the image. Seven days is the default.
• Drops Pro: up to 90 or 180 days, depending on the expiry you choose, and never more than 180 days from the original upload even if the link is extended. Even Drops Pro links expire.
• Web Assets: stay until you replace or delete them. Public /m/… URLs are not confidential storage.
• Expired or deleted images are removed from active hosting. Cleanup is not always instantaneous; background jobs and storage lifecycle rules finish the removal.

4.3 Metadata stripping

For JPEG, PNG, WebP, and GIF we attempt to strip EXIF, XMP, and similar embedded metadata before storage. If stripping fails, the upload is rejected.

4.4 Password-protected links

Pro users can put a password on a share link. The password value is not stored in plaintext. We store a one-way hash used only to check later unlock attempts. Recipients who unlock a link get a short-lived cookie for that image only.

5. Security and abuse controls

To rate-limit uploads and reduce abuse we derive a hashed fingerprint from your IP address using a server secret. We store that hash for quota and abuse controls. We do not store raw IP addresses in our application database for uploads.

Cloudflare (our hosting and security provider) may process IP addresses and request metadata as part of operating the network, CDN, DDoS protection, and logs.

6. Integrations

You can create a personal integration token for the browser extension or ShareX. The raw token is shown once. After that, DropIMG keeps only a hash of the token. Treat the token like a password. Revoking it stops new uploads from that connection. Existing share links are not changed.

7. Billing

Paid Drops Pro and Web Assets checkout is processed by PayPal. DropIMG is the merchant of record. PayPal receives the payment and billing information needed to charge you, and holds it under its own privacy policy. DropIMG stores the subscription and payer identifiers and the status we need to provide Pro (for example whether Pro is active, when the current period ends, and whether cancellation is scheduled). We never see or store your card number or PayPal password.

8. Analytics

We record first-party product events in Cloudflare Analytics Engine (for example: a page view, an upload result, a sign-in request, a checkout step, or a dashboard action). Events use low-cardinality fields such as event name, plan, billing interval, upload surface, and reason codes. We do not put raw integration tokens, passwords, or email addresses in analytics. This is first-party, sets no cookies, and runs for everyone.

We also use Google Analytics 4, provided by Google Ireland Limited, to understand which pages are worth keeping. This is a third-party service, it sets cookies, and it is off until you agree to it. Until you accept, no request is made to Google at all — the tag is never loaded, so Google does not receive your IP address or know that you visited. If you accept, Google receives the usual measurement data for the pages you view: IP address (which Google truncates), device and browser, approximate location, page addresses and referrer.

Your choice is remembered in your browser. You can change it at any time below, and declining costs you no functionality.

Analytics is never loaded on share pages (dropimg.io/i/…), so viewing an image someone sent you is not measured by Google whatever your choice. We also honour the Global Privacy Control signal: if your browser sends it, we treat it as a decline and never ask.

9. Account deletion

When you delete your account we:

• cancel an active Pro subscription first, if we can reach PayPal;
• remove your active DropIMG images;
• revoke connected integration tokens;
• sign you out everywhere;
• anonymize the local account record (the email is replaced with a tombstone address and the account is marked deleted).

If billing cancellation fails, the account is not deleted so we do not leave an unpaid or uncanceled subscription behind. Deleted-account cleanup is not always instantaneous for every stored object or log.

10. Browser extension and device data

The official Chrome / Edge extension can capture the visible tab or a region you draw. That image is website content. It is uploaded over HTTPS to dropimg.io solely to create a temporary share link, using the same upload rules as the website. Nothing is captured until you click Capture or press the keyboard shortcut, after a one-time notice in the extension. Recent links, your last capture mode, and — if you connect an account — your personal token and chosen link lifetime stay on your device. The token is stored only on that device (not in synced storage). Capture mode may follow your browser profile to other devices via synced settings. All of it stays until you clear it or disconnect.

The use of information received from Chrome APIs and uploaded to DropIMG will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not sell that data, do not use it for advertising, and do not transfer it except to operate the share-link service (or as required by law or to investigate abuse).

11. Cookies

Signed-in use needs a session cookie. A language cookie remembers your locale choice. Unlocking a protected image sets a short-lived cookie for that image. Cloudflare may set essential security cookies. These are needed to run the service and are always on.

If — and only if — you accept analytics, Google Analytics sets its own cookies (_ga and _ga_*) to recognise repeat visits. Declining, or never answering, means they are never set. Your answer itself is stored in your browser's local storage rather than in a cookie, so refusing costs you nothing and leaves nothing behind.

We do not use third-party advertising cookies on the product described here.

12. How we use information

• To provide temporary image hosting, share pages, and optional accounts.
• To send magic-link emails and keep you signed in.
• To enforce size, format, rate, quota, and plan limits.
• To provide Pro features and talk to PayPal about your subscription.
• To delete expired, user-deleted, or moderated images.
• To investigate abuse, security incidents, and legal requests.
• To understand aggregate reliability and usage of the service.

13. Who can see your images

Share URLs are randomly generated and not listed publicly, but they are not a login. Anyone with the link can open an unprotected image while it is live. A password only helps if you keep that password and the link private.

14. Processors

We use infrastructure providers to run DropIMG, including Cloudflare (Workers, DNS/CDN, object storage, database, email sending, analytics, and security) and PayPal for paid subscriptions. They process data to provide those services to us.

If you accept analytics cookies, Google (Google Ireland Limited, with onward transfer to Google LLC in the United States) also processes measurement data as described in section 8. This is the only provider that depends on your consent, and the only one that receives nothing at all if you decline.

We do not sell your personal information. We may disclose information if required by law, to protect rights and safety, or to address abuse.

15. International processing

DropIMG is delivered over Cloudflare’s global network. Uploads and requests may be processed in data centers outside your country.

16. Children

DropIMG is not directed at children under 13 (or the equivalent minimum age where you live). Do not upload content that exploits or endangers minors.

17. Your choices

• Use DropIMG without an account.
• Delete an image from the success screen or My Drops while you still can.
• Revoke integration tokens and sign out of all devices.
• Cancel a paid plan from Manage in PayPal (access continues until the paid period ends if you cancel renewal).
• Delete your account from the account page.
• Clear site data in your browser to remove local recent-drop history.
• Accept or decline analytics cookies, and change that answer whenever you like from section 8.

18. Contact

Privacy and abuse: abuse@dropimg.io

19. Changes

We may update this Policy as the product changes. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised Policy.