The short version
- We cannot provide the contents of any file, file names, text or links, or any decryption key — we never have them.
- We may hold limited account and device metadata, and short-lived logs with IP addresses.
- We disclose data only in response to valid legal process under applicable law, or in a genuine emergency.
- Where the law allows, we tell users before disclosing their data.
1. About Dragy
Dragy is a file-transfer service operated by [Nexlla Creative Agency — registered legal name], trading as Nexlla Creative Agency, established in United Arab Emirates. It moves files between devices — directly where possible — and keeps encrypted files on its servers only briefly for offline devices and share links. Accounts are optional; many transfers involve no account at all. Content is encrypted on the sender’s device with keys that exist only on the sending and receiving devices. See our Security page and Privacy Policy for details.
2. Data that may exist
| Category | What it contains | Available for |
|---|---|---|
| Account | Email address and whether it was confirmed; optional name; account creation date; whether two-step verification is on. No phone number, address, payment details or identity verification. | While the account exists |
| Devices | Names, kinds, platforms, public keys, app versions, dates added and last seen, of devices signed in to the account. | Until removed or the account is deleted |
| Security activity | Times of sign-ins, password and two-step changes, and devices added or removed, with device names. No IP addresses. | 180 days |
| Stored transfers and share links | Metadata only: total size, number of files, times, sending and receiving device identifiers, expiry, download limit and count. The content itself is ciphertext we cannot decrypt. | Until delivered or expired — at most 7 days |
| Logs | Server and reverse-proxy request logs, including IP addresses and times; mail-server delivery logs. | [30 — confirm] days To confirm |
| Correspondence | Messages the user sent to our support, abuse or legal addresses. | [24 months — confirm] To confirm |
Users without an account are generally identifiable only by IP address in logs, if at all. IP addresses used to group Nearby devices or apply rate limits are held in memory only and are not recorded.
3. Data that does not exist
We cannot provide what we do not have. Dragy never receives the contents of files, file or folder names, text snippets or links users send, or any encryption key, device private key, connection code or share-link key. Files sent directly between devices never reach our servers. Stored files are deleted on delivery or expiry and cannot be recovered. We have no ability to decrypt content, no “backdoor”, and no means to intercept future transfers in readable form, and we will not build one.
We also do not hold: phone numbers, real names (unless a user typed one), location data, contacts, payment records, browsing history, or a record of who sent what to whom beyond the device identifiers in section 2 for stored transfers.
4. Legal process required
- UAE authorities: we respond to requests made under valid legal process issued under UAE law by a competent authority — for example a court order or a request from the Public Prosecution — that identifies the requesting authority and the legal basis. [Counsel to confirm the specific instruments required for each data category.]
- Authorities outside the UAE: we are established in the UAE and generally require foreign requests to come through a mutual legal assistance treaty, letters rogatory or another process recognised under UAE law. We may voluntarily respond to an emergency request (section 6).
- Civil litigants: we disclose user data in civil matters only under a court order binding on us. Informal requests from lawyers will not be answered with user data.
Every request must be in writing, on official letterhead or from an official email domain, and include: the requesting authority and officer, with verifiable contact details; the legal basis; the specific account email address, full share link or link ID, or IP address and time window concerned; the data categories requested; and the reason, at least in general terms. We review each request for legal validity and scope, may push back on requests that are overly broad, unclear or unlawful, and disclose only the minimum data required.
5. How to submit a request
Email [email protected], or serve formal process on [Nexlla Creative Agency — registered legal name], [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates. Requests sent to other addresses may be delayed. This address is for public authorities only; we will not respond to other enquiries sent to it. We respond in English or Arabic.
6. Emergency requests
If you believe in good faith that there is an imminent risk of death or serious physical injury, and that information we hold may help prevent it, we may disclose limited data without legal process, as the law allows. Mark the email “EMERGENCY”, describe the emergency and how the information requested will help, and state that it cannot wait for legal process. Emergency requests must come from an official of a recognised authority. We may ask for legal process to follow.
7. Preservation requests
Because our retention periods are short, if you need data preserved while you obtain legal process, send a preservation request identifying the account, link or IP address and time window. We will take a one-time snapshot of the relevant available data and keep it for [90 days], extendable once on a further written request. Preservation cannot recover data already deleted, and encrypted content cannot be decrypted however long it is kept. To confirm
8. User notification
Our policy is to notify users before disclosing their data, so they can seek legal advice or challenge the request — unless we are legally prohibited from doing so (for example by a court order), or notice would create a risk of death or serious harm, or of destroying evidence in cases involving child exploitation. Where notice was delayed, we may notify the user once the restriction ends.
9. Disabling share links
Authorities can ask us to disable a share link that distributes unlawful content. Send the full link or its ID and the legal basis. Disabling a link deletes its encrypted data, which cannot then be recovered — if you need the link’s metadata preserved first, say so in the same request.
10. Transparency
We keep a record of the requests we receive and how we respond. We intend to publish aggregate statistics about government requests where the law allows. [Owner to decide whether and how often to publish a transparency report.]
11. Contact
- Law enforcement and government requests: [email protected]
- Abuse reports from the public: [email protected] — see Report abuse
- Formal service: [Nexlla Creative Agency — registered legal name], [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates
Nothing in these guidelines creates rights for any person or limits our right to object to or challenge any request.
Requests from authorities: [email protected].