Cookie Policy

Cookies we set

• Session cookie (better-auth): keeps you signed in. Expires when you sign out or after inactivity.
• Viewer cookie (sd_vid): a random identifier so senders see unique views rather than every page reload, and so we can rate-limit abuse. It isn't used across other sites.
• Owner cookies (sd_o_…): let someone who sent a drop without an account manage it from the same browser. Kept for 90 days.
• Access cookies: remember that you unlocked a passcode-protected or private drop. Short-lived and scoped to that drop.

Browser storage

Local storage and IndexedDB keep your theme choice, drops you sent from this device, and the encryption keys for your devices' inbox. Vault keys stay in the link and are never stored by us.

Third parties

We don't load third-party analytics or advertising scripts. Cloudflare may set cookies needed for security and bot protection.

Why there's no cookie banner

The Swedish Electronic Communications Act (lagen om elektronisk kommunikation) lets a service store information on your device without consent only when it's needed to provide a service you asked for. Everything above falls in that group, so we don't ask for consent. If we ever add anything else, we'll ask first. Where cookies involve personal data, our Privacy Policy applies.

Your choices

You can clear cookies and storage in your browser at any time. Blocking the session cookie will sign you out, and blocking the others will limit some features.