Privacy Policy for Deskdrop

Last updated: September 12, 2026
App: Deskdrop · Bundle ID: studio.huashan.deskdrop
Operator: Suzhou Huayu Huashan Culture Development Co., Ltd. (“Huashan Studio”, “we”, “us”)

1. Who we are

The data controller for Deskdrop is Suzhou Huayu Huashan Culture Development Co., Ltd. Contact: hello@huashan.studio · Website: https://huashan.studio

2. What happens to a document you send

When you pair your phone with a computer, the two perform a one-time key exchange. Your phone derives a content key from that exchange and encrypts the document before any part of it is uploaded. Our relay server forwards the encrypted pieces without ever holding the key, so it cannot open them. If both devices are on the same local network, the pieces go directly between them and do not reach our server at all.

Once the receiving computer confirms it has written the file, the encrypted pieces are deleted from the relay immediately. Pieces that are never collected are deleted within 24 hours. Nothing is backed up.

3. The camera and your photos

Deskdrop uses the camera to photograph the pages you want to send. That is the only reason it asks for camera access. The captured pages are held in the app’s own storage until the transfer finishes, then removed.

Pages are combined into a PDF on your phone. Deskdrop does not ask for access to your photo library, does not write to it, and does not upload page images anywhere other than to the computer you paired with.

4. Information stored on your device

• Pairing keys for the computers you have paired with, so you do not have to scan a code every time. A one-time web pairing is not saved at all.
• Preferences, such as your chosen image enhancement mode.
• Pending transfers, held on disk so an upload can survive a lock screen or a lost connection, and deleted once delivered.

This data stays on your device. Deleting the app removes it.

5. What the relay server records

Ordinary web server logs, which include IP addresses, timestamps and request paths, kept so the service stays available and abuse can be stopped. Pairing codes appear in those paths and expire within 15 minutes. Logs are rotated on a short schedule and are not used to build a profile of you.

We do not log file names, page contents, thumbnails, or anything about the documents themselves, because the server never has the key to read them.

6. What we do not collect

• No account. There is nothing to sign up for, and we do not ask for your name, email address or phone number.
• No advertising, no advertising SDKs, and no advertising identifier (IDFA). Deskdrop does not present an App Tracking Transparency prompt because it does not track you.
• No third-party analytics or crash-reporting SDKs.
• No location, contacts, calendars, health data, or payment card details.
• Nothing is sold or shared with data brokers.

7. Third parties

Deskdrop relies on our own relay server and on Apple’s operating-system services for background uploads. It embeds no third-party SDKs. If you obtain the desktop receiver from our download page, that download is served by us.

8. Data retention

• Encrypted transfer data: deleted on delivery, and within 24 hours if never collected.
• Server logs: rotated and discarded on a short schedule.
• On-device data: kept until you unpair, delete the transfer, or remove the app.

9. International transfers

Our relay server may be located in a country other than the one you live in. What passes through it is encrypted end to end and unreadable to us, and it is deleted on delivery.

10. Children

Deskdrop is a general-purpose utility and is not directed to children under 13, or the equivalent minimum age in your region. We do not knowingly collect personal information from children.

11. Your choices and rights

• Forget a paired computer at any time from the app, which deletes that pairing key.
• Withdraw camera or local network permission in iOS Settings. Deskdrop cannot scan without the camera.
• Delete the app to remove everything it stored on your device.
• Where applicable law gives you rights of access, correction, deletion or objection, email us. Note that because we hold no account and cannot read your documents, there is normally nothing about you for us to retrieve.

12. Security

Transfers use X25519 key agreement, HKDF-SHA256 key derivation, and AES-256-GCM encryption, all applied on your device. Connections to the relay use HTTPS. No method of transmission or storage is completely secure, but the relay is designed so that a compromise of it does not expose your documents.

13. Changes

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the app after an update means you acknowledge the revised Policy.

14. Contact

Questions about this Policy or Deskdrop privacy practices:
Email: hello@huashan.studio
Operator: Suzhou Huayu Huashan Culture Development Co., Ltd.
Product page reference: Bundle ID studio.huashan.deskdrop