Privacy Policy

Last updated: 24 September 2026

1. Who we are

Thawdrop is a free, open-source app and website for sharing files peer to peer. It is developed and operated by Muh. Syafiudin. In this policy, "Thawdrop", "we" and "us" refer to that project. You can reach us at the address in the Contact section.

2. Your files

• Your files are never uploaded to a Thawdrop server. They stay on the sender's device and are sent directly to the receiver over an encrypted WebRTC connection.
• We cannot see, access, copy or recover your files or their names.
• If you protect a share with a password, the files are encrypted on the sender's device before sharing (AES-GCM, with a key derived from the password). The password is never sent to us or stored anywhere.
• Because no server holds the file, sharing stops when the sender closes the share, quits the app, or the share expires.

3. The share link

A Thawdrop link contains a magnet link in the part after the #. Browsers do not send that part to the website's server, so we never receive it. Anyone who has the link (or its QR code) can download the shared files, so treat it like a secret, or add a password.

4. Network information that others can see

To connect two devices directly, Thawdrop relies on public infrastructure. This is how peer-to-peer connections work, and it means some technical information is visible to the following parties, but never the contents of your files:

• The other person in the transfer (sender or receiver) can see your IP address.
• STUN servers operated by Google (stun.l.google.com) and Twilio (global.stun.twilio.com) see your IP address when devices work out how to reach each other.
• Public WebTorrent tracker servers (tracker.openwebtorrent.com, tracker.webtorrent.dev and tracker.btorrent.xyz) help the two devices find each other. They see your IP address and the identifier of the share.
• Where a direct connection is not possible, a relay (TURN) server may be used as a fallback in some builds. It forwards encrypted traffic and cannot read file contents.

These third parties operate independently and have their own privacy policies.

5. The website (thawdrop.com)

• The site is served through Cloudflare, which processes standard request data such as IP address and browser type to deliver and protect the site, under Cloudflare's own privacy policy.
• We use no cookies, no analytics, no advertising or tracking scripts, and we do not store anything about you in your browser.
• When an installer is downloaded, we increase an aggregate counter (total and per day). It contains no personal information and is publicly visible at /api/stats.

6. App updates

The version of the desktop app that you download from thawdrop.com checks https://thawdrop.com/updates/latest.json when it starts, to see whether a newer version exists. This is an ordinary web request (your IP address is visible to the site and Cloudflare, as with any website). No account or device identifier is sent. Versions distributed through an app store are updated by that store instead.

7. What we collect and keep

We do not run a user database, and we do not ask for or store your name, email, contacts, location, files or usage history. The only data we keep is the aggregate download counter described above. If you email us, we keep your message and address only as long as needed to reply.

8. Children

Thawdrop is not directed at children under 13, and we do not knowingly collect personal information from anyone.

9. Your choices

Because we hold no personal data about you, there is nothing for us to delete or export. You control what you share, and you can stop sharing at any time. If you have a question or a request about your data, contact us.

10. Open source

Thawdrop's source code is public under the MIT license at github.com/papateo/thawdrop, so you can check for yourself how it works.

11. Changes to this policy

If this policy changes, the new version will be posted on this page with an updated date.

12. Contact

Questions about privacy: muhsyafi [at] gmail [dot] com