← Home

Privacy Policy

Last updated: 26 September 2026

Flitdrop is built to need as little of your data as possible. Your transfers go directly between your devices on your own Wi-Fi: there is no cloud, no account, and no server ever receives your files, photos, texts or clipboard. To understand how the app and this website are used, and to fix what breaks, we do measure a few things. This page says exactly what, why, and how to say no.

In short

What we never collect

In the Flitdrop app

Basic anonymous statistics (on by default)

To know whether Flitdrop really works for people, the app sends small anonymous counts:

These events carry no identifier of any kind: they cannot be linked to each other or to a person. Our collector works out the country from the connection and keeps only the country; the IP address is never stored.

Your choice: you can turn these statistics off at any time in Settings, and nothing more is sent. Legal basis: our legitimate interest in measuring how the app is used, following the rules of the CNIL (the French data protection authority) for audience measurement that does not require consent. The switch in Settings is your right to object.

Detailed statistics and error reports (only if you say yes)

On first launch, or after an update, the app asks you once whether you want to share more to help improve Flitdrop. Nothing extra is sent unless you say yes. If you do, the app also sends:

Legal basis: your consent. You can withdraw it at any time in Settings, and nothing more is sent afterwards.

Where app data goes and how long it is kept

App statistics go to our collector hosted by Cloudflare (flitdrop.com/api/telemetry, and telemetry.flitdrop.com for versions before 0.6.4), which keeps only the country and passes the events on to PostHog, where they are stored in the European Union (Frankfurt). Individual events are kept there for 12 months at most; after that, only overall totals (for example the number of transfers per month) are kept.

On this website

If you are in the EU, the EEA, the UK or Switzerland

You see a banner with two equal buttons, Accept and Refuse. Until you accept, or if you refuse, no cookie is set and neither Google Analytics nor Microsoft Clarity is loaded. While you have not chosen, only anonymous measurement without cookies runs:

If you refuse, PostHog counts that refusal once, anonymously, then stops and counts nothing more. Only Cloudflare's visit count remains, because it is part of the hosting and has no cookie and no personal data.

If you accept, the site also uses Google Analytics 4, Microsoft Clarity and PostHog with its cookie (details below), including recordings of how pages are used (clicks, scrolling, where the pointer goes), heatmaps, time spent on each page and errors on the site, with anything typed into fields hidden.

Your choice is saved in your browser (under the name fd_consent) and we ask again after 6 months. You can change it at any time with the "Cookies" link at the bottom of every page, or with this button:

Everywhere else

The same tools run by default. You can refuse at any time with the "Cookies" link at the bottom of every page; after that, only Cloudflare's visit count without cookies runs.

What these tools see

The pages you visit, the site you came from, your clicks and scrolling, the type of browser, system and screen, and your approximate country (worked out from the connection). Never your name or your email, and we do not try to find out who you are. Advertising signals are always refused and Google's advertising features are off: nothing is used for advertising or sold.

Microsoft Store links

Links to Flitdrop on the Microsoft Store carry a short campaign code (cid) so that the Store statistics can tell us how many installs came from this website. The code is the same for everyone and says nothing about you.

Hosting and security

The website is hosted by Cloudflare, which processes technical data such as your IP address to deliver the pages and protect the site against attacks. We do not keep these logs ourselves.

Every tracker, one by one

Cloudflare Web Analytics

  • Provider: Cloudflare, Inc.
  • Purpose: count visits and measure page speed.
  • On your device: nothing, no cookie.
  • When it runs: always, for every visitor.

PostHog without cookies

  • Provider: PostHog Inc., data stored in the EU (Frankfurt).
  • Purpose: count pages viewed, download clicks and answers to the cookie banner.
  • On your device: no cookie, only the entry that remembers a refusal (see "Your settings on this site"). A code computed on PostHog's servers, renewed every day; the IP address is not stored.
  • When it runs: in the EU, the EEA, the UK and Switzerland, until you make a choice. If you refuse, it counts that refusal once, then stops completely.

Google Analytics 4

  • Provider: Google Ireland Limited.
  • Purpose: audience statistics (visits, pages, where visitors come from).
  • On your device: cookies _ga and _ga_6D1N284CCF, up to 13 months.
  • When it runs: in the EU, the EEA, the UK and Switzerland only if you accept; elsewhere by default, until you refuse.

Microsoft Clarity

  • Provider: Microsoft.
  • Purpose: recordings of how pages are used and heatmaps, to see where visitors get stuck. Text typed into fields is hidden.
  • On your device: cookies _clck (up to 1 year) and _clsk (1 day). Microsoft may also set its own cookies on its clarity.ms domain (such as MUID, up to 1 year).
  • When it runs: in the EU, the EEA, the UK and Switzerland only if you accept; elsewhere by default, until you refuse.

PostHog with cookie

  • Provider: PostHog Inc., data stored in the EU (Frankfurt).
  • Purpose: detailed statistics (every click and where it happens on the page, time spent on each page, page speed, errors on the site) and recordings of how pages are used, with anything typed into fields hidden.
  • On your device: a cookie and a browser storage entry named ph_<project key>_posthog, up to 1 year.
  • When it runs: in the EU, the EEA, the UK and Switzerland only if you accept; elsewhere by default, until you refuse.

Your settings on this site

  • Provider: none, they stay in your browser and are never sent to us.
  • Purpose: remember your cookie choice (fd_consent, 6 months) and your language (flitdrop_lang); remember during the visit whether you are in a region where we ask first (fd_geo, only a yes or a no, cleared when you close the tab); keep the list of the latest download files for one hour (fd_rel, cleared when you close the tab); and let PostHog remember whether it may use its cookie (__ph_opt_in_out_<project key>, kept until your choice changes).
  • When it runs: always, because the site needs them to work as you asked.

Flitdrop app statistics

  • Provider: Cloudflare (collector, keeps nothing) and PostHog (storage in the EU, Frankfurt).
  • Purpose: know whether the app works and where it fails.
  • On your computer, in the app settings file: the date of first launch (to count days since install), the last version launched, the last day the daily count was sent, whether a phone already opened the page, whether a first pairing and a first transfer already happened, whether you answered the question about starting Flitdrop when you log in, the number of successful transfers counted for the rating request (it stops at 23) and your answer to that request, and a random install identifier. The rating request and your answer are never sent. This identifier is created on every install but is sent only if you accepted detailed statistics.
  • When it runs: basic statistics by default, until you turn them off in Settings; detailed statistics and error reports only if you say yes.

Who receives the data, and transfers outside the EU

We never sell data and never share it for advertising. The only providers that process data for us are Cloudflare (hosting, measurement without cookies, app statistics collector and its copy of app statistics), PostHog (statistics, stored in the European Union, in Frankfurt), Google (Google Analytics), Microsoft (Clarity) and GitHub (the download buttons ask GitHub for the list of the latest files, and the files are downloaded from GitHub, which sees your IP address as any server does). Google, Microsoft, GitHub and Cloudflare may process data in the United States; they are certified under the EU-US Data Privacy Framework, which the European Commission recognises as offering an adequate level of protection. PostHog stores our data in the European Union.

How long data is kept

Legal basis

Your rights (GDPR)

Under the GDPR you have the right of access, rectification, erasure, restriction, objection and portability over your personal data, and the right to withdraw your consent at any time. Because the statistics we collect do not identify you, we usually cannot tell which data are yours; the simplest way to stop any collection is the switch in the app Settings and the "Cookies" link on the site. For any question or request, contact us at [email protected] and we will reply within one month. You also have the right to lodge a complaint with your data protection authority (in France, the CNIL, cnil.fr).

Data controller

Flitdrop (Thomas Bidault), sole trader (entrepreneur individuel), France. Contact: [email protected].