The short version
- No cookies, and no analytics, advertising, tracking or third-party scripts — anywhere.
- This website remembers only your light/dark choice, in your own browser.
- The app keeps its settings, its device key, your sign-in and a local history of your transfers on your device. None of that is used to track you, and the history and keys never leave your device.
- Clear it any time by signing out, clearing site data or uninstalling.
1. What these technologies are
Cookies are small files a website asks your browser to store and send back with later requests. Local storage and IndexedDB let a website keep data on your device without sending it automatically to a server. Cache Storage and a service worker let a web app load and work offline. Desktop and mobile apps use similar storage, including the operating system’s secure credential store (such as Windows DPAPI, the macOS Keychain, the iOS Keychain or the Android Keystore).
Privacy rules such as the EU ePrivacy Directive (Art. 5(3)) and the UK PECR apply to all of these, not only cookies, so this page covers all of them.
2. Our approach
Dragy stores something on your device only when it is strictly necessary for a feature you use — remembering your settings, keeping you signed in, holding your device’s encryption key, or saving received files where you asked. Everything is first-party (set by Dragy itself).
We do not use cookies, analytics, advertising identifiers, social-media pixels, fingerprinting or any third-party scripts, on this website or in the apps. The site and app load no external scripts or fonts and run under a strict Content Security Policy.
3. This website (dragy.nexlla.com)
| Name / type | Purpose | Duration |
|---|---|---|
dragy-site-theme (local storage) | Remembers if you chose light or dark appearance. Never sent to us. | Until you change it back to automatic or clear site data |
4. The web app (dragy.nexlla.com/app/)
| Name / type | Purpose | Duration |
|---|---|---|
dragy.prefs (local storage) | Your settings on this device: theme, reduced motion, the name shown on Nearby when signed out, Nearby visibility, sounds, notifications, and whether you’ve seen the introduction. Never sent to us, except that the Nearby name is shown to devices you connect with. | Until you clear site data |
dragy.theme, dragy.reduceMotion (local storage) | Copies of the appearance settings, so the app opens in the right theme without a flash. | Until you clear site data |
dragy.secure.session (local storage) | Your session token, which keeps this browser signed in. Sent only to our API, in a request header (not a cookie). Our server stores only a hash of it. | Until you sign out, the device is removed, or it expires 90 days after last use |
dragy → keys (IndexedDB) | This device’s encryption key pair (the private key is created as non-extractable and never leaves the browser) and the pinned public keys of your other devices. | Until you sign out, remove the device or clear site data |
dragy → history (IndexedDB) | Your recent transfers on this device — file names, sizes, devices and times — so you can see what you sent and received. Only on this device; never sent to us. Up to 300 entries. | Until you clear the history or site data |
dragy → outbox (IndexedDB) | Transfers you’ve queued that haven’t finished sending yet. | Until they are sent or cancelled |
dragy → handles (IndexedDB) | In browsers that support it, a permission handle to the folder you chose for received files, so Dragy can save there next time. It is not a copy of the folder. | Until you choose another folder or clear site data |
Received files are saved where you choose — your Downloads folder or a folder you picked — and are yours to keep or delete. A file you’re previewing may be held in the browser’s memory until you close the tab.
5. The service worker
The web app installs a service worker (sw.js) so it can be installed like an app and load when you’re offline. It keeps:
- App shell caches (
dragy-v1-assets,dragy-v1-pages) — copies of the app’s own code, styles and pages. No personal data. - Shared files (
dragy-share) — if you share files to the installed app from another app, they wait here until Dragy picks them up to send. - Streamed downloads — large received files are passed through the service worker to your Downloads folder in pieces, so they never have to fit in memory. Nothing is kept afterwards.
The desktop and mobile apps don’t use a service worker.
6. Desktop and mobile apps
| Where | What and why | Duration |
|---|---|---|
| Desktop (Windows, Linux; macOS when released) | Session token, encrypted with the operating system’s credential protection (Electron safeStorage). The same settings, keys, history and outbox as the web app, in the app’s own storage. A small settings file (the location of your Dragy folder and one-time hints) and a local diagnostic log (capped at about 2 MB), kept in the app’s data folder and never sent to us automatically. | Until you sign out or uninstall |
| Android (iPhone and iPad when released) | Session token in the Android Keystore-backed secure storage (iOS Keychain on Apple devices). Settings, keys, history and outbox in the app’s own storage. Received files in Documents/Dragy, or the app’s own folder where Android doesn’t allow that. | Until you sign out or uninstall |
7. Why there’s no cookie banner
Consent is required before storing information on your device except where the storage is strictly necessary to provide a service you asked for. Everything listed above falls within that exemption. Since we use nothing optional, there is nothing to accept or reject. If we ever add non-essential storage, we will ask for your consent first and update this page.
8. How to clear it
- Sign out in the app to end the session on our server and remove the session token; remove a device from Settings → Your devices to delete its keys from our records.
- Clear the history of transfers from the app.
- Clear site data for dragy.nexlla.com in your browser’s settings (in Chrome: Settings → Privacy and security → Site settings → View permissions and data stored across sites; in Safari: Settings → Advanced → Website Data; in Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data). This removes everything in sections 3 to 5, including the service worker.
- Uninstall the desktop or mobile app to remove its storage; for an installed web app, also clear site data.
If you clear the device key without signing out, the device can no longer open files waiting for it; remove it from your account from another device.
9. Do Not Track and Global Privacy Control
We don’t track you across sites and don’t sell or share personal data for advertising, so Do Not Track and Global Privacy Control preferences are respected by default. Where the law treats GPC as an opt-out request, we treat it as one — there is simply nothing further to opt out of.
10. Changes
We update this page whenever we change what Dragy stores. If a change introduces anything that is not strictly necessary, we will ask for consent before using it.
11. Contact
Questions? Write to [email protected]. Your rights over personal data are explained in our Privacy Policy.
Questions about this page? Write to [email protected].