Who we are
Dragbox ("we", "us") is a file-sharing and screen-recording service available at dragbox.io and through our free Mac and iPhone apps. Dragbox is operated by Ibrahim Elsherbiny. For anything in this policy, contact [email protected].
Data we collect
- Account data. Your email address and name, plus a securely hashed password if you sign up with email — or your account identity from Google, GitHub, or Apple if you sign in with one of those providers. We never see those providers' passwords.
- Content you upload. Files, screenshots, and screen recordings you store in Dragbox Cloud (our hosted storage) so we can store and serve them back to you and to people you share links with.
- Share metadata. The links you create, their expiry settings, and view counts.
- Technical data. Standard server logs (including IP addresses) used only for security, rate limiting, and abuse prevention, retained briefly.
What we don't do
- We don't sell your data or share it with advertisers. Ever.
- We don't run ads.
- Our Mac and iPhone apps contain no third-party analytics or tracking SDKs.
- We use only a session cookie to keep you signed in — no tracking cookies.
Bring-your-own-bucket storage
If you connect your own storage bucket (S3, R2, B2, or compatible), your files upload directly from your device to your bucket — they never pass through our servers. Your bucket credentials are encrypted on your device before they reach us, and we cannot decrypt or use them. When you share a file from your bucket, your device sends us a time-limited access link, which we store encrypted and serve only to people who open your share link. We never delete files from your own bucket — even if your account lapses or is closed.
Where your data lives
Dragbox runs on Cloudflare's global network. Account data lives in Cloudflare D1 and hosted files in Cloudflare R2. Transactional email (verification, password reset) is delivered through our email provider; we send no marketing email.
Payments
Paid plans are purchased on the web through Gumroad. Gumroad processes the payment — we never see or store your card details. Our apps contain no purchases.
Retention and deletion
You can delete your account at any time from Settings in the web, Mac, or iPhone app. Deletion removes your account data, revokes your share links, and permanently purges files stored in Dragbox Cloud. Files in your own bucket are untouched — they're yours.
Your rights
You can request a copy of your data, correction, or deletion at any time by emailing [email protected]. If you are in the EU/EEA, UK, or a jurisdiction with similar data-protection law, these rights are guaranteed to you by law and we honor them regardless of where you live.
Children
Dragbox is not directed at children under 13 (or the minimum age in your country), and we don't knowingly collect their data.
Changes
If we make material changes to this policy, we'll update this page and the date above. Continued use of Dragbox after a change means you accept the updated policy.
Contact
Questions about privacy: [email protected]