Frequently asked questions

Dragy is a drag-and-drop way to move files, folders, text and links between your devices — phones, tablets, computers and any browser. Pick the device (or devices) you want, drop your files, and they arrive, end-to-end encrypted. It’s made by Nexlla Creative Agency.

Link to this answer

Available now:

• Web app at dragy.nexlla.com/app/ — any modern browser, nothing to install, and it can be installed like an app;
• Windows — installer with the Dragy folder, Explorer’s “Send to” and a tray app;
• Linux — AppImage or .deb;
• Android — an APK you install directly (a Google Play listing comes later).

Coming soon: the macOS app and the iPhone and iPad app. Until then, use the web app in Safari or Chrome — on iPhone and iPad you can add it to your Home Screen.

Every version works with every other, so a Linux laptop can send to an iPhone browser and an Android phone to a Mac.

Link to this answer

No. Dragy and the account are free, with no ads and no tracking. If we ever add optional paid features, you’ll see the price before you buy, and nothing you already use will start costing money without notice (see our Terms).

Link to this answer

No. Without an account you can send to devices on the same network (Nearby), or to any device anywhere using a code or QR. A free account adds:

• all of your own devices, wherever they are, ready to receive;
• automatic acceptance of files you send to yourself (a setting you can change);
• delivery to devices that are offline — files wait encrypted in the cloud;
• encrypted share links for people who don’t use Dragy;
• optional two-step verification.

You must be at least 16 to create an account.

Link to this answer

1. Open Dragy on both devices — the web app works fine.
2. On the same Wi-Fi, the other device appears under Nearby. On different networks, choose Connect with a code on one device and type the code (or scan the QR) on the other.
3. Drop files onto the device, or choose them with the file picker.
4. Accept on the receiving device. Done.

Link to this answer

Devices running Dragy on the same network see each other automatically, each under its name — or, if you’re not signed in, a random friendly name like “Swift Otter”. To do this, our server groups devices that connect from the same public network address (the same IPv4 address, or the same IPv6 /64). It holds that grouping in memory only while you’re connected.

Anyone else on the same network who runs Dragy can see your device’s name and ask to send you files, so turn Nearby off in Settings → Privacy & Nearby on public Wi-Fi if you don’t need it. Because anonymous Nearby devices haven’t met before, both screens show five verification emoji — if they match, you’re connected to the right device.

Link to this answer

To connect two devices on different networks without an account, one device shows a 12-character code and a QR code; type the code or scan the QR on the other. The code finds the other device and is also the secret the encryption is built from. Our server only ever sees a hash of it, so it can’t read what you send.

Treat a code like a temporary password — share it only with the device or person you mean to connect with.

Link to this answer

Transfers from devices that aren’t yours always ask first — nothing lands on your device unless you accept it. Transfers between your own signed-in devices are accepted automatically by default; you can change that with Accept from my devices automatically in Settings.

Link to this answer

• Desktop app: Dragy/Received inside your Dragy folder (on your Desktop unless you chose another place).
• Android: Documents/Dragy — see Android save location.
• Browser: your Downloads folder, or — in Chrome and Edge — a folder you choose once.

Link to this answer

Usually not. Dragy tries routes in this order:

1. Local network — on the same Wi-Fi or LAN, files go straight from device to device and never leave your network.
2. Direct — on different networks, devices connect peer-to-peer over the internet.
3. Encrypted relay — only if a direct connection is impossible, our server forwards the encrypted data. It sees only ciphertext and stores nothing.
4. Cloud, for offline devices — if you send to one of your own devices while it’s offline, the encrypted files wait until it comes back, then are deleted.

To find a direct path, Dragy uses Cloudflare’s STUN service (stun.cloudflare.com), which sees the network addresses involved, never your files.

Link to this answer

If it’s one of your own signed-in devices, the files are encrypted on your device and wait in the cloud. When the device comes back online they’re delivered and deleted from the cloud. Anything not collected within 7 days is deleted automatically.

For Nearby and code connections, both devices need to be online at the same time.

Link to this answer

When you’re signed in (with a confirmed email), you can turn files into an encrypted link for someone who doesn’t use Dragy. The decryption key sits after the # in the link — the part browsers never send to a server — so we store only ciphertext.

You choose how long the link lives (1 hour to 7 days) and how many times it can be downloaded (once, 10 times or unlimited). Anyone who has the full link can download the files until it expires, so share it carefully. You can delete a link any time in Settings → Cloud & links.

Link to this answer

The desktop app creates a folder called Dragy — on your Desktop by default. Inside it there’s a “Send to <device>” folder for each of your devices: drop files into one and they’re sent to that device. Files you receive land in Dragy/Received. On Windows you can also right-click files and choose Send to → Dragy. The app lives in the system tray and can start when you log in.

Link to this answer

Sign in with your email and password, or — easier — scan a QR code shown on the new device from one that’s already signed in, and approve it. Each device then creates its own encryption key pair, and its private key never leaves it. Only approve devices that are yours and in your hands.

Link to this answer

From any other signed-in device, open Settings → Your devices and remove it. Its sessions end immediately, its key stops being accepted, and files waiting for it are discarded. Then change your password, and turn on two-step verification if you haven’t.

Link to this answer

Files waiting in the cloud are encrypted to the receiving device’s own key, which exists only on that device. If the app was reinstalled, its data was cleared, or it was signed out and back in, the old key is gone and those files can’t be opened — by anyone, including us. Send them again. This is the price of real end-to-end encryption: we can’t recover keys or files.

Link to this answer

Choose Forgot password? on the sign-in screen and we’ll email you a reset link. For security, resetting your password signs out all your devices — sign in again on each one. If you no longer have access to your email address, contact [email protected].

Link to this answer

Yes. Turn it on in Settings → Security and use any authenticator app (TOTP) for a second code when you sign in. You can also see recent sign-ins and security changes under Recent activity.

Link to this answer

No. Files are encrypted on your device with AES-256-GCM, using fresh keys for every transfer, before they go anywhere. Our server never has file names, contents or keys. Every chunk is authenticated, so nothing can be altered, reordered or cut short without the receiving device noticing. Details are on our Security page.

Link to this answer

With an account: your email address, a scrypt hash of your password, the name you entered, your devices’ names, types, public keys and app versions, a short log of sign-ins and security changes (kept 180 days), and the size, time and recipients of transfers waiting in the cloud. Like any server, it also sees IP addresses — to group Nearby devices, apply rate limits and relay quotas — and they appear in our server and proxy logs for [30 — confirm] days. Without an account, it knows even less. Full details are in our Privacy Policy.

Link to this answer

Yes, usually. To connect directly, the two devices exchange network addresses, so the device you connect with — and whoever controls it — can learn your IP address. Connect only with devices you trust, or use a VPN if that matters to you. See Direct connections and your IP address.

Link to this answer

When two devices that haven’t met before connect (for example on Nearby), both screens show five emoji derived from the encryption keys. If they match, nobody is in the middle. If they don’t, cancel the transfer.

Link to this answer

No. There are no ads, no analytics, no tracking and no cookies — in the apps or on this website. The app keeps its own settings, keys and your transfer history in your browser’s or device’s storage, and this site stores only your light/dark preference. See Cookies & Local Storage.

Link to this answer

Thank you! Email [email protected] and see how to report a vulnerability. We reply within 3 business days.

Link to this answer

Live transfers (local, direct or relayed) have no size or format limit from Dragy — any file, any size, whole folders included. Your device’s storage and browser can impose their own limits (see large files in a browser).

Files that wait in the cloud for an offline device, or behind a share link, are limited to 5 GB per transfer and 5 GB per account in total.

Link to this answer

Your account can keep up to 5 GB waiting in the cloud at once. Space frees up as your devices collect their files and as links expire. To free it now, delete waiting transfers or share links in Settings → Cloud & links. Live transfers between online devices don’t use this space.

Link to this answer

No. Dragy moves files; it doesn’t keep them. Everything in the cloud is deleted once it’s delivered, when a link expires, or after 7 days at most, and can’t be recovered. Always keep your own copies of anything important.

Link to this answer

Download installers only from this site. We publish SHA-256 checksums for every file in SHA256SUMS.txt. Compare it with your file’s checksum — for example certutil -hashfile file SHA256 on Windows, or shasum -a 256 file on macOS and Linux.

Link to this answer

Our Windows installer is not yet signed with a code-signing certificate, so Microsoft Defender SmartScreen may warn you because it doesn’t recognise it yet. First check the file’s checksum against SHA256SUMS.txt. If it matches, choose More info → Run anyway. If it doesn’t match, don’t run it — delete it and download again from dragy.nexlla.com.

Link to this answer

Download the APK from our download section and open it. Android will ask you to allow your browser or file manager to install apps — allow it for this install. Google Play Protect may show a warning because the app isn’t from Google Play yet; check the checksum first. The app updates when you install a newer APK over it.

Link to this answer

It’s coming soon to the App Store. Until then, open dragy.nexlla.com/app/ in Safari and choose Share → Add to Home Screen — it works like an app. Very large files are best received on a computer (see large files in a browser).

Link to this answer

The Mac app — a universal app for Apple silicon and Intel Macs that lives in the menu bar — is coming soon, once it’s signed and notarized. Until then, use the web app in Safari or Chrome; in Chrome you can install it as an app.

Link to this answer

The Windows app and the Linux AppImage check for updates automatically and install them when you quit or restart. The Linux .deb is updated through your package manager, the Android APK by installing the newer version, and the web app whenever you reload it.

Link to this answer

Nearby only shows devices that reach our server from the same public network address. Check:

• Same network? Both devices must be on the same Wi-Fi — not one on Wi-Fi and one on mobile data, and not on a separate guest network.
• VPN or private relay? A VPN, iCloud Private Relay or a proxy on one device gives it a different public address. Turn it off, or use a code instead.
• IPv4 vs IPv6. If one device connects over IPv6 and the other over IPv4, they can look like different networks. Use a code, or sign both in to your account.
• Visibility. Make sure Nearby is turned on in Settings → Privacy & Nearby on both devices, and that both apps are open.

Whatever the cause, Connect with a code always works, and signed-in devices always see each other.

Link to this answer

The fastest route is direct. If devices can’t connect directly — common on strict corporate, school, hotel or mobile networks — Dragy uses its encrypted relay, which is slower. Being on the same Wi-Fi usually gives the best speed. The relay also has a daily allowance (10 GB per network without an account, 100 GB per account); once it’s used up, relayed transfers pause until the next day.

Link to this answer

Usually yes. Dragy needs HTTPS (port 443) to our server. Direct connections use WebRTC over UDP; if a firewall blocks that, Dragy falls back to the relay over the same HTTPS connection. On a managed network, ask your administrator to allow dragy.nexlla.com and stun.cloudflare.com.

Link to this answer

Chrome, Edge and Firefox stream large files straight to disk. Safari — including every browser on iPhone and iPad — has to hold a received file in memory before saving it, so very large files can fail there. For big transfers, receive on a computer with Chrome, Edge, Firefox or the desktop app. In Chrome and Edge, choosing a folder for received files works best.

Link to this answer

In Documents/Dragy — open your Files app and look for Documents › Dragy. On some Android versions that folder isn’t available to apps, and Dragy saves inside its own storage instead; you can open or share the file from the transfer in Dragy.

Link to this answer

Dragy is free today, and the features you use now are free. We may add optional paid features in the future; if we do, we’ll give at least 30 days’ notice and you’ll see the price before paying for anything.

Link to this answer

Open Settings → Security → Delete account and confirm. This signs out every device, deletes their keys from our records and permanently erases files waiting in the cloud and your share links. It can’t be undone. Our Privacy Policy explains what happens to the little that’s left.

Link to this answer

Email [email protected] with the full share link (or the account or device involved) and what’s wrong. We disable abusive links and act against the accounts behind them. See Report abuse, and for copyright, our Copyright Policy.

Link to this answer

We can’t — we never have them. Your files are encrypted with keys only your devices hold, and anything waiting in the cloud is deleted once delivered. In response to valid legal process we can only provide limited account metadata and short-lived logs. Our Law Enforcement Guidelines explain what exists and what doesn’t.

Link to this answer