Privacy Policy

1. Who we are

Dragy is provided by [Nexlla Creative Agency — registered legal name], a [Legal form] trading as Nexlla Creative Agency, registered under licence number [Trade licence number] with [Licence issuing authority], with its registered address at [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates (“we”, “us” or “our”).

Controller

We are the controller of the personal data described in this policy under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the GDPR and UK GDPR. Where an organisation lets its people use Dragy, our Data Processing Addendum explains when we act as its processor instead. The content of your transfers is end-to-end encrypted: we handle it only as unreadable ciphertext, at your direction.

Privacy contacts

• Privacy requests and questions: [email protected]
• Data protection officer / privacy lead: [Data protection officer or privacy lead — name, if appointed], [email protected] To confirm
• Post: [Nexlla Creative Agency — registered legal name], Attn: Privacy, [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates
• EU representative (GDPR Art. 27): [EU representative under GDPR Art. 27 — name and address, if appointed]
• UK representative (UK GDPR Art. 27): [UK representative under UK GDPR Art. 27 — name and address, if appointed]

2. Scope

This policy covers personal data we process when you use the Dragy web app (including the installable version at https://dragy.nexlla.com/app/), the Windows and Linux desktop apps, the Android app, and — once released — the macOS app and the iPhone and iPad app; when you send or receive files with or without an account; when you create or open a share link; when you visit https://dragy.nexlla.com; and when you contact us. It does not cover services we don’t control, such as your browser, operating system, app store or internet provider, or what the people you send files to do with them.

3. End-to-end encryption

Before anything leaves your device, Dragy encrypts it with AES-256-GCM using fresh keys for each transfer, agreed between devices with ECDH (P-256) and HKDF. File and folder names, contents, sizes of individual files, text snippets and links are inside this encryption. Our servers never receive the keys.

• Same network: files go directly from device to device and do not pass through our servers.
• Different networks: devices connect directly over the internet where they can; otherwise our relay forwards encrypted data without storing it.
• Offline devices and share links: we store encrypted data until it is collected or expires. A share link’s key sits in the part of the link after #, which browsers never send to us.

Because we cannot read this content, we cannot scan, index, analyse, moderate, recover or disclose it in readable form, and the only information we hold about a transfer is the limited metadata in section 4.5. Full details are on our Security page.

4. What we collect

Each table shows what we hold, why, our legal basis under the GDPR / UK GDPR (Article 6(1)) and UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), and how long we keep it. Without an account, only sections 4.6 to 4.8 apply to you.

4.1 Account data

4.2 Device data

4.3 Sessions and sign-in

4.4 Security activity log

4.5 Stored transfers and share links

4.6 IP addresses and technical data

4.7 Communications

4.8 Downloads and app updates

We do not use any of this data for advertising, we do not sell it or share it for cross-context behavioural advertising, we do not profile you, and we do not use it to train AI models.

5. What we never collect

• File names, folder names, file types or contents, text snippets or links you send — or the keys that protect them.
• Your contacts, photos, location, microphone or camera data, or advertising identifiers.
• Analytics, crash reports sent to third parties, usage tracking, fingerprints or behavioural profiles — in the apps or on this website.
• Payment details (Dragy is free).

6. Direct connections and your IP address

Devices you connect with can learn your IP address. To find a direct path, the two devices in a transfer exchange their network addresses (using WebRTC), including your public IP address and, in some cases, local network addresses. This happens with your own devices, with devices you reach through a connection code or QR, and with anonymous Nearby devices. The person controlling the other device could see these addresses and use them to estimate your approximate location or internet provider.

To help devices find each other, Dragy uses Cloudflare’s STUN service (stun.cloudflare.com), which sees your IP address while a connection is set up but never your files. If you don’t want the other side to learn your IP address, connect only with devices you trust, or use a VPN. When no direct path works, the encrypted data flows through our relay instead; the address exchange will usually already have happened by then.

7. Nearby

When Nearby visibility is on, our server shows your device to other visible Dragy devices that connect from the same public IPv4 address or IPv6 /64 network — for example, the same home or office Wi-Fi. They see your device’s name and type: your account device name if you are signed in, or a random friendly name (such as “Swift Otter”) or a name you choose if you are not. They can ask to send you files; you decide whether to accept. The network grouping is held in memory only while you are connected and is not logged by our application. You can turn Nearby off in Settings → Privacy & Nearby.

8. Data on your device

Dragy keeps some data only on your own device and never sends it to us: your settings and theme, your device’s private key (which can’t be exported), your session token (in the operating system’s secure storage on desktop and mobile), a history of your recent transfers including file names (up to 300 entries), files waiting to be sent, and, in supporting browsers, the folder you chose for received files. You can remove it by signing out, clearing the site’s data, or uninstalling the app. We use no cookies. Details are in our Cookies & Local Storage policy.

9. Processors and sharing

We do not sell, rent or trade personal data. We share it only as follows:

• Cloudflare, Inc. — provides DNS and a reverse proxy in front of dragy.nexlla.com, and the STUN service. All traffic between your apps and our servers passes through Cloudflare, which decrypts the outer TLS layer to route it; it therefore processes IP addresses and request data, including account details when you sign in. Your files stay end-to-end encrypted inside that traffic.
• Our hosting provider — Hostinger (virtual private server), in [Hosting region — confirm], which runs the server that stores account data and encrypted transfers. To confirm
• Our mail server — Self-hosted mail server (Mailcow) that we operate on the same server, in [Same region as hosting — confirm], which sends system emails. To confirm
• People you send to — the receiving device sees your device name, the content you send it, and (for direct connections) your IP address, as explained in section 6.
• Authorities — only where the law requires it, as described in section 18 and our Law Enforcement Guidelines, and to report child sexual abuse material.
• Professional advisers — lawyers, auditors and insurers, under confidentiality, where needed to establish, exercise or defend legal claims.
• A successor — if Dragy is involved in a merger, acquisition or sale of assets, under this policy.

The current list of processors, what each does and where, is on our Sub-processors page. App stores (Apple App Store, Google Play) are independent controllers of the data they collect when you install from them.

10. International transfers

We are based in United Arab Emirates. Our servers are hosted in [Hosting region — confirm], and Cloudflare operates a global network, so your data may be processed in other countries, including the United States. When we transfer personal data across borders, we use appropriate safeguards:

• From the UAE: to countries with adequate protection, or under the other conditions UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) allows, including contractual safeguards. [Counsel to confirm the mechanisms available under the PDPL implementing regulations.]
• From the EEA, UK and Switzerland: under an adequacy decision (including the EU–U.S. Data Privacy Framework and its UK extension, where the recipient is certified), or otherwise the European Commission’s Standard Contractual Clauses with the UK Addendum or Swiss adaptations. [Counsel to confirm which applies to each processor.]

End-to-end encryption travels with your files: wherever encrypted data is stored or relayed, it stays unreadable without keys only your devices hold.

11. Security

We protect personal data with measures appropriate to the risk, including on-device end-to-end encryption of all content, per-device keys that never leave the device, key pinning and mutual authentication between your devices, scrypt password hashing with lock-out after repeated failures, optional two-step verification, session tokens stored only as hashes, encryption of two-step verification seeds at rest, rate limits and quotas, minimal logging, and TLS on every connection. Read more on our Security page. No system is perfectly secure; keep your devices secure and share codes and links only with people you intend.

12. Retention at a glance

We may keep specific data longer where the law requires it, or where needed to establish, exercise or defend a legal claim or to preserve data under a valid legal request — only for as long as that need lasts.

13. Your rights

Depending on where you live, you have some or all of these rights. We honour the core rights for every user, wherever they live, unless the law prevents us:

• Access — to know whether we process your data and to get a copy.
• Correction — to fix inaccurate data (you can change your name, email and device names yourself).
• Deletion — to have your data erased, including your whole account.
• Portability — to receive data you gave us in a machine-readable format.
• Restriction and objection — to limit processing, or object to processing based on legitimate interests.
• Withdrawal of consent — at any time, where we rely on consent.
• Complaint — to a data protection authority (see section 20).

United Arab Emirates

Under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), you have rights to information, access, correction, erasure, restriction, portability and to object, and to complain to the UAE Data Office. If you are in a free zone with its own regime (the DIFC or ADGM), you may also have rights under it.

European Economic Area, United Kingdom and Switzerland

You have all the rights listed above under the GDPR, UK GDPR or Swiss law, and can contact our representatives or your local supervisory authority.

California

Under the CCPA as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights. In the last 12 months we collected: identifiers (email address, IP address, device identifiers); internet or network activity (server logs); and sensitive personal information limited to account log-in credentials, used only to provide and secure the service. Sources and purposes are in section 4, and recipients in section 9. We do not sell or share personal information (as those terms are defined), and have not done so; we do not use or disclose sensitive personal information for any purpose that would give a right to limit it. We honour Global Privacy Control signals, though there is nothing further to opt out of. You may use an authorised agent; we will verify their authority.

Other US states

If you live in a state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others), you have similar rights to access, correct, delete and port your data and to opt out of targeted advertising, sale and profiling — which we don’t do. If we refuse a request, you can appeal by replying with the subject “Privacy appeal”; if the appeal is denied, you may contact your state attorney general.

Other countries

If you live elsewhere — for example in Saudi Arabia, another GCC state, Egypt, India, Brazil, Canada, Singapore or Australia — you may have similar rights under local law. Contact us and we will respond in line with the law that applies to you.

14. Exercising your rights

• In the app: change your name, email, password and device names; review Settings → Security → Recent activity; delete stored transfers and links in Settings → Cloud & links; remove devices in Settings → Your devices; and delete your whole account in Settings → Security → Delete account. Deleting your account immediately erases your account record, devices, sessions, activity log, stored transfers and share links.
• By email: write to [email protected] from your account’s address. We may need to verify that the request comes from you.

What we can give you. Because so little is stored, an access or portability request is answered with: your account email, name, confirmation status, account creation date and settings; whether two-step verification is on; your device records (names, kinds, platforms, public keys, app versions, dates); your security activity log; and the metadata of any stored transfers and share links (sizes, dates, recipients, limits). We cannot provide file names or contents of any transfer, or anything we never had — they are encrypted with keys only your devices hold. Your transfer history lives only on your devices.

We reply within the period the applicable law sets — generally one month under the GDPR and UK GDPR, 45 days under the CCPA, and the period set by the PDPL and its regulations — and may extend it for complex requests where the law allows. There is no fee unless a request is manifestly unfounded or excessive. Without an account, we usually hold nothing that can be linked to you, other than logs keyed by IP address.

15. Children

Dragy is not intended for anyone under 16 (or the age of digital consent where you live, if higher), and we do not knowingly collect personal data from them. If we learn that we have, we will delete it. If you believe a child has given us personal data, contact [email protected].

16. Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not profile you. Automated security measures — such as temporarily locking sign-in after repeated failed attempts, or pausing relay when a daily quota is reached — are applied by fixed rules, are temporary, and can be reviewed by a person if you contact us.

17. Data breaches

If a personal data breach occurs, we will contain it, assess the risk, and notify the UAE Data Office, other competent supervisory authorities and affected users as the applicable laws require — under the GDPR and UK GDPR, without undue delay and where feasible within 72 hours of becoming aware of it. Because files are end-to-end encrypted, a breach of our servers would not expose their contents or names; we would still assess and notify as the law requires.

18. Requests from authorities

We disclose personal data to public authorities only when required by valid legal process under applicable law, or in a genuine emergency involving a risk of death or serious harm. We can only ever disclose the limited data described in section 4 — never file contents, file names or keys, which we do not have. Where lawful, we tell affected users before disclosing. Our Law Enforcement Guidelines explain the process.

19. Changes to this policy

We may update this policy to reflect changes in Dragy, our providers or the law. If a change is material, we will notify account holders in the app or by email at least 30 days before it takes effect, and ask for consent where the law requires it. The date at the top shows the last update.

20. Complaints

Please contact us first at [email protected] so we can try to put things right. You may also complain at any time to a data protection authority, including the UAE Data Office in the UAE, the supervisory authority where you live or work in the EEA, the Information Commissioner’s Office in the UK, the Swiss Federal Data Protection and Information Commissioner, or the California Privacy Protection Agency.

21. Contact

• Privacy requests and questions: [email protected]
• Data protection officer: [email protected]
• Security issues: [email protected]
• Abuse reports: [email protected]
• Post: [Nexlla Creative Agency — registered legal name] (trading as Nexlla Creative Agency), Attn: Privacy, [Registered address — street, building, city, Emirate, United Arab Emirates], United Arab Emirates

Questions about this policy? Write to [email protected].