Privacy Policy

Last updated: June 6, 2026

1. Introduction

Undercover Drop ("we", "us", or "our"), operated by IASK Solutions LLC, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and protect your information when you use our website located at undercoverdrop.com (the "Service").

2. What We Collect and How We Use It

Our core design principle is **Zero-Knowledge**. Here is exactly how we handle your data depending on how you use the Service:

A. Local Encryption & Decryption

If you use Undercover Drop to encrypt or decrypt files locally (without uploading them to our cloud sharing service), **no file data is transmitted to our servers**. All processing occurs completely inside your browser's local sandbox memory.

B. File Sharing (Cloud Uploads)

When you choose to generate a shareable link:

  • Encrypted Blob: We store the encrypted file payload (ciphertext) on our secure object storage. We cannot read or decrypt this content because the decryption key remains client-side.
  • Metadata: We store minimal metadata to service the download request, including the creation time, expiry settings, and maximum allowed download count. We do not store the unencrypted filename unless you explicitly type it as an override.
  • Never your passphrase or keys: Your passphrase and the encryption key are never sent to us or stored by us — all encryption and decryption happen in your browser. Because of this, we cannot recover your file if you lose the passphrase, and the protection of your file depends on the strength of the passphrase you choose.

C. User Accounts & Security Logs

If you register an account to manage your uploads:

  • Account Details: We store your email address, cryptographically salted password hash (using bcrypt), and Multi-Factor Authentication (MFA) secrets if enabled. These are used strictly to authenticate your access.
  • Active Sessions: We store user session records to maintain secure authentication state.
  • Security Audit Logs: To protect your account security and monitor for unauthorized access, we log security events (e.g., login attempts, password changes, MFA setup, data exports) along with your **IP address**, **user agent**, and event timestamp.

3. Data Protection and Security

We employ robust technical and organizational measures to safeguard your information:

  • All server communications are encrypted in transit via SSL/TLS.
  • We enforce secure, client-side encryption using native Web Crypto API standards (AES-256-GCM).
  • We generate deterministic blind hashes of passphrases using Argon2 or PBKDF2 to identify/allow downloads, ensuring we never receive or store your raw passphrase.

4. Data Retention

Shared files are retained only until their scheduled expiration time (ranging from 1 hour to 30 days, or "never" if configured) or until their maximum download limit is reached. Expired and deleted files are permanently purged from our primary storage systems and are not recoverable.

Account details and associated Security Audit Logs are retained for as long as your account remains active. If you delete your account, all account metadata and audit logs are immediately and permanently purged from our active database.

5. Cookies

We use cookies strictly for essential security and operational functionality:

  • Session Cookie: To maintain your signed-in state.
  • CSRF Protection Cookie: To prevent cross-site request forgery attacks.

We do not use tracking cookies, third-party analytics cookies, or advertising scripts.

6. Third-Party Sub-Processors

We do not sell, trade, or lease user data to third parties. To operate the Service, we partner with trusted infrastructure and service providers ("Sub-processors") who are bound by strict data processing agreements:

  • Railway: Application hosting and servers.
  • Cloudflare / Amazon Web Services (S3): Encrypted blob storage.
  • PostgreSQL / Supabase: Core relational metadata database.
  • Stripe: Payment and billing processing (we do not store or process your raw credit card details).
  • Sentry: Server-side error monitoring and diagnostics.
  • SendGrid / Mailgun: Email delivery services.

7. Children's Privacy

The Service is not intended for or directed to children. We do not knowingly collect, maintain, or use personal information from children under the age of 13. If you learn that a child has provided us with personal information in violation of this policy, please contact us immediately.

8. Your Rights (GDPR & CCPA Compliance)

Depending on your location, you may have specific statutory rights regarding your personal data under regulations such as the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). These rights include:

  • Right of Access & Portability: You can export a copy of your account data and sharing history directly from your account dashboard.
  • Right to Rectification: You can update your account information at any time.
  • Right to Deletion: You can delete your account and all associated metadata at any time through your dashboard.
  • Right to Object/Restrict Processing: You have the right to request that we limit or stop the processing of your metadata.

To exercise any of these rights, or for questions regarding this Privacy Policy, please contact us at privacy@undercoverdrop.com.