Last updated 7 November 2026. Draft for legal review before launch.

Dropbucket is run by 38South Digital in Melbourne, Australia (“we”, “us”). This policy covers the website at dropbucket.io and the app at app.dropbucket.io.

Your files

Files you send, and files your clients upload through request links, go from the browser directly into the storage bucket you connect (for example Cloudflare R2, Backblaze B2, Wasabi or Amazon S3). They do not pass through or get stored on our servers. Your storage provider’s own privacy terms apply to that storage.

What we store

To run your account and your links we store:

  • Your account: your name, email address and a hashed password (we never see or store the password itself).
  • Your workspace: its name, your team members and their roles, your brands (name, colour, logo, welcome message) and any custom domains.
  • Your storage connection: the bucket name, endpoint and region, and the access key you give us. The access key and secret are encrypted before they are saved and are only decrypted on our servers to sign upload and download links.
  • Links and files: link titles, messages, expiry and password settings (passwords are hashed), file names, sizes and types, and where each file sits in your bucket.
  • People you deal with: email addresses you send links to, and the name, email and message a client enters when they upload through a request link.
  • Download activity: when a file is downloaded, so we can show you download counts and send download alerts. Visitors are counted with a random cookie ID, not their name or IP address.
  • Licence details: your plan and, if you bought through AppSumo or our checkout, the licence or code you redeemed.

We also keep IP addresses for short periods (minutes to an hour) to stop abuse such as password guessing. They are deleted automatically.

Cookies

The app uses a sign-in cookie to keep you logged in, and download pages use a cookie to remember that a visitor already entered a link’s password and to count unique downloads. We don’t use advertising or tracking cookies. The marketing site doesn’t set cookies.

Who helps us run Dropbucket

  • Vercel (United States) hosts the app.
  • Turso (database hosted in AWS US East) stores the account data listed above.
  • Amazon Web Services (Sydney, Australia) sends our emails.
  • Cloudflare hosts this website and handles email sent to support@dropbucket.io.
  • Stripe and AppSumo process payments if you buy a plan. We never see your full card details.

Your account data may therefore be stored or processed outside Australia, mainly in the United States.

Emails

We send the emails the product needs: email verification, links you choose to send, download and upload alerts, and team invites. We don’t send marketing emails unless you opt in.

Your choices

  • Export: download a copy of your account data from Settings at any time.
  • Delete: delete your account from Settings. This removes your account data from our database. Files in your bucket stay there, because they’re yours; delete them with your provider if you want them gone.
  • Questions or corrections: email support@dropbucket.io.

We handle personal information in line with the Australian Privacy Principles. If you’re in the EU or UK, you have rights to access, correct, delete and port your data, and to complain to your local regulator.

Changes

If we change this policy in a way that matters, we’ll update the date above and tell account owners by email.