Who we are
Dragbox ("we", "us") is a file-sharing and screen-recording service available at dragbox.io and through our free Mac and iPhone apps. Dragbox is operated by Ibrahim Elsherbiny. For anything in this policy, contact [email protected].
Data we collect
- Account data. Your email address, name and account identifier, plus a securely hashed password if you sign up with email — or your account identity from Google, GitHub, or Apple if you sign in with one of those providers. We never see those providers' passwords.
- Content you upload. Files, photos, screenshots, videos, screen recordings and audio files you store in Dragbox Cloud (our hosted storage) so we can store and serve them back to you and to people you share links with.
- Share metadata. The links you create, their expiry settings, and view counts.
- Purchase and subscription data. For paid accounts, we retain the purchase email, sale and subscription identifiers, plan status and access dates linked to your Dragbox account. We use these records to verify purchases, enable plan features and prevent fraudulent or duplicate claims.
- Session and technical data. Sign-in sessions retain your IP address and user-agent information, linked to your account, to display active sessions and help you recognize and revoke access. Server logs and request information are also used for security, rate limiting and abuse prevention. We do not use these details to derive your location or for advertising tracking.
- Public-share reports and review records. If someone reports a public link, we store the report reason and any details they provide, the reported link and file identity, timestamps, and hashed request identifiers used to limit abuse. The service owner can review reports and record decisions, reasons and changes to public sharing. Minimal email alerts to the owner identify the report and link to the authenticated review console; they do not include uploaded media or access credentials.
- Optional support messages. If you choose Report a Bug or Send Feedback in the Mac app, it opens an editable email draft containing your app version, operating system and hardware model; bug reports also include recent application log text. You can review, change or discard the draft. Nothing is sent automatically. If you send it, we receive your message, sender information and the diagnostic content you include so we can help with your request.
What we don't do
- We don't sell your data or share it with advertisers. Ever.
- We don't run ads.
- Our Mac and iPhone apps contain no third-party analytics or tracking SDKs.
- We use authentication cookies to keep you signed in, not advertising tracking cookies.
Bring-your-own-bucket storage
If you connect your own storage bucket (S3, R2, B2, or compatible), your files upload directly from your device to your bucket. Your bucket credentials are encrypted on your device before synchronization; the credential vault is separate from file storage. When you share a file, your device gives the service a time-limited access link, stored encrypted, so recipients can open the shared content. Share delivery and previews may process that access link and the shared content through our service. Closing your Dragbox account or letting a plan lapse does not delete files from your own bucket. You can still explicitly delete bucket files through supported file-management actions.
Reviewing public-share reports
The service owner reviews reports about publicly shared content. We may revoke a link, prevent an exact reported storage object from being shared again, or restrict an account's public sharing. These controls do not delete files or remove the account owner's private file access. We do not automatically inspect new uploads with an external media-scanning service. A hold identifies an exact object or provider path; it does not identify every renamed or reuploaded copy of the same content.
Report review does not require access to your private vault or a password-protected share. A provider URL already disclosed for a file in your own bucket retains its provider-controlled lifetime. Lifting a sharing restriction does not reactivate old links.
Where your data lives
Dragbox uses Cloudflare for its website, APIs, account database and delivery services. Dragbox Cloud file content is stored in Backblaze B2 through our hosted-storage service. Cloudflare services also handle related metadata and caches. Transactional email, including verification, password reset and account recovery, is delivered through our email provider. We do not send marketing email.
Connections use HTTPS. Credential-vault encryption does not make Dragbox Cloud file content end-to-end encrypted: our hosted-storage service must be able to store and serve the content you upload and share.
Payments
Paid plans are purchased on the web through Gumroad. Gumroad processes the payment — we never see or store your card details. We receive and store the purchase and subscription information described above. Our native apps contain no purchases.
Retention and deletion
Session records are removed by sign-out or session revocation, password reset and account deletion. A session's expiry prevents its continued use but does not by itself guarantee removal of the expired record. We do not promise a fixed automatic deletion period for expired-session records or security logs. Support messages and diagnostics you send are retained to handle the request and related follow-up, subject to your deletion rights and any required legal retention.
You can delete your account at any time from Settings in the web, Mac, or iPhone app. A deletion request immediately stops ordinary account access and revokes public share links. A recovery email lets you restore the account within 30 days. Recovery does not reactivate previously revoked links; create new links if needed. An independent public-sharing restriction or exact-object hold remains in place unless the service owner explicitly lifts it after review.
After the recovery period, we permanently delete account-associated Dragbox Cloud files and account data. Failed storage deletions are retried before their cleanup records are removed. Reports, object holds and identifying moderation notes associated with the deleted account are removed at that same purge stage. An operator's identity can be removed from another account's review history without deleting that other account's case. Files in your own bucket are untouched by this process. Limited records required for security or legal obligations may be retained for those purposes.
Your rights
You can request a copy of your data, correction, or deletion at any time by emailing [email protected]. If you are in the EU/EEA, UK, or a jurisdiction with similar data-protection law, these rights are guaranteed to you by law and we honor them regardless of where you live.
Children
Dragbox is not directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their data.
Changes
If we make material changes to this policy, we'll update this page and the date above. Continued use of Dragbox after a change means you accept the updated policy.
Contact
Questions about privacy: [email protected]