Privacy policy
Last updated: 25 October 2026
1. Who we are
Ferndrop is operated by Idleforest Unipessoal, LDA, Lisbon, Portugal (“we”). We are the controller of the personal data described here. Contact for anything about your data: hello@idleforest.com.
2. The short version
- No accounts. No cookies. No analytics. No advertising or tracking scripts.
- Files shared by link are deleted automatically 48 hours after the upload finishes.
- Files sent directly never reach our servers.
- We don’t use your files to train AI models, and we don’t sell or rent them to anyone.
- We don’t open your files unless they are reported to us, we have specific reason to think they are illegal, or the law requires it.
3. What we process, why, and for how long
| Data | Why | How long |
|---|---|---|
| Files shared by link (the content) | To let the people you give the link to download it. | Deleted automatically 48 hours after the upload finishes. Unfinished uploads are discarded within about 3 hours. A file removed after a report is deleted immediately. |
| File name and size | To show them on the download page and apply limits. | With the file, then a small record for up to 7 days after expiry so the page can say the file has expired. For removed files, the record is kept for up to 90 days as proof of the removal. |
| Direct transfers: the file | It travels between the two browsers. We never receive it. If a direct connection is impossible and a relay is used, encrypted packets pass through relay servers run by Cloudflare without being stored. | Not stored by us. |
| Direct transfers: connection set-up messages (these contain network addresses, including your IP address) | To connect the two browsers. | Passed on immediately; the room is deleted after 30 minutes at most. |
| IP address | To limit abuse (for example how many uploads one person can start per hour). We convert it into a one-way code using a secret salt that changes every day, and store only that code, not the address itself. | With the file record (see above), and in counters for up to about two days. |
| Totals: how many download pages were opened, files downloaded, files uploaded and direct transfers started, per day | To run the service and to report real numbers to sponsors. These are plain counts with no link to any person. | Up to about a year. |
| Reports (what you write, the file link, and your email if you give it) | To review the report, act on it, and reply if you asked us to. | Up to 12 months after the report is resolved. |
| Human check | When you start an upload, a direct transfer or a report, Cloudflare Turnstile checks that you are not a bot. Cloudflare receives information about your browser to do that, under its own privacy policy. | As set by Cloudflare. |
Our hosting provider also sees ordinary technical data such as your IP address when your browser contacts the site. We don’t keep request logs ourselves.
4. Direct transfers show your IP address to the other person
In a direct (peer-to-peer) transfer the two browsers connect to each other, so each side can learn the other’s IP address. This is how the technology works. If you don’t want that, use a link instead.
5. What we don’t do
We don’t set cookies and don’t use analytics. We don’t load advertising or tracking scripts. If we show a sponsor, it is a plain, clearly labelled link that we host ourselves. Before adding any third-party advertising, we will update this policy and, where the law requires it, ask for your consent first.
6. Legal bases (GDPR)
- Providing the service you asked for (Article 6(1)(b)): handling your files and transfers.
- Our legitimate interest in keeping the service safe (Article 6(1)(f)): rate limits, human check, handling reports and abuse.
- Legal obligations (Article 6(1)(c)): for example removing illegal content and answering lawful requests from authorities.
7. Who receives data
- Cloudflare, Inc. and its group companies provide our hosting, storage, connection relay and bot protection as our processor. Data may be processed outside the European Economic Area under Cloudflare’s data processing terms and EU-approved safeguards.
- Authorities, where the law requires or a valid request is made.
- The people you share a link with, who can download the file.
We don’t sell personal data.
8. Security
Traffic uses HTTPS. Files stored for links are encrypted at rest by our storage provider. They are not end-to-end encrypted, so we and our provider could technically access them. Direct transfers are encrypted between the two browsers. If a file is highly sensitive, protect it with a password-protected archive before sending.
9. Your rights
You can ask us for access to, correction or deletion of your personal data, to restrict or object to its use, and for portability where it applies. Because we don’t know who uploaded a file, we may need the link and some proof that the request concerns you. Write to hello@idleforest.com. You can also complain to the Portuguese data protection authority, the CNPD, or to the authority in your own country.
10. Children
Ferndrop is not meant for children under 16.
11. Changes
If we change this policy in a way that matters, we will change the date above and say so on the home page.