ChuteDrop
Privacy policy
Last updated 8 September 2026
ChuteDrop moves large files between people. This page describes exactly what we hold, why, for how long, and how you get rid of it.
The short version
- Your files are stored only until the transfer expires or you revoke it. Then they are deleted by the storage layer itself.
- We do not open, scan, index, analyse or sell the contents of your transfers, and we do not use them to train anything.
- We do not run advertising trackers and we do not sell personal data.
- You can delete your account, and everything attached to it, from inside the app and the web dashboard at any time.
What we collect
Account data
An account identifier, your email address, and — if you use Sign in with Apple — the pseudonymous subject identifier Apple gives us. If you use Apple's private relay address, that relay address is all we ever see. We also store your theme preference so the app and the website agree with each other.
Transfer data
For each transfer we store the file names, sizes, content types, a CRC32 checksum per file, the link token, the expiry date, the number of times the link has been downloaded, and the file bytes themselves. The bytes live in Cloudflare R2 object storage.
Payment data
We never see or store your card. Purchases made in the iPhone or iPad app are handled by Apple. Purchases made on the web are handled by Dodo Payments, which acts as the merchant of record and is responsible for billing and tax. We receive only what we need to grant your plan: a subscription identifier, its status and its renewal date.
Operational data
Our servers process the usual request metadata — IP address, user agent, timestamps — to serve requests, apply rate limits and investigate abuse. Download counts are incremented on file and ZIP requests only; preview bots that fetch the link page for an unfurl card are not counted.
How long we keep it
| Data | Retention |
|---|---|
| File bytes | Until the transfer expires (3 to 90 days, set by your plan and your choice) or you revoke it, whichever comes first. Deletion is enforced by storage lifecycle rules on the retention prefix. |
| Transfer records | Deleted with the account, or when the transfer is revoked. |
| Account record | Until you delete your account. |
| Payment records | Held by Apple or Dodo Payments for as long as tax and accounting law requires of them. |
Who we share it with
We use a small number of processors and nothing else: Cloudflare (object storage, the API and the link surface), Vercel (this website), Apple (sign-in and in-app purchases) and Dodo Payments (web purchases). We do not sell personal data, and we do not share it for cross-context behavioural advertising.
We disclose data when we are legally required to, and to act on a valid abuse or copyright complaint.
Security
Links are protected by 128-bit random tokens: they are not guessable and we never publish or index them. Anyone you send a link to can open it, so treat it like a key. Uploads and downloads run over TLS, and files are encrypted at rest by the storage provider. If a link gets away from you, revoke it from your dashboard — the link dies and the objects are removed.
Your rights
Depending on where you live you may have the right to access, correct, export or erase your personal data, and to object to or restrict certain processing. Delete your account from Settings and everything goes: the account, the transfers and the files. For anything else, write to support@mattmade.ai and we will answer within 30 days.
Children
ChuteDrop is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has created an account, tell us and we will remove it.
International transfers
Our processors operate globally, so your data may be processed outside your country. Where required, transfers rely on the appropriate legal mechanisms, such as the European Commission's standard contractual clauses.
Changes
If this policy changes materially we will update the date at the top and notify account holders by email before the change takes effect.
Contact
Privacy questions, data requests and complaints: support@mattmade.ai.