Cryptographic Privacy Protocol

ZeroDrop Privacy Policy

Effective Date: October 12, 2026 • Architecture Status: 100% Sovereign • Zero Server Footprint

            Core Principle: ZeroDrop operates under a mathematically enforceable Zero-Knowledge, Zero-Retention privacy paradigm. Files and clipboard transmissions travel directly between client browser runtimes across encrypted WebRTC DataChannels. No intermediary server ever intercepts, buffers, records, or analyzes your payloads.
          

1. Sovereign Peer-to-Peer Data Architecture

Unlike conventional cloud-based file storage or synchronization platforms (e.g., WeTransfer, Google Drive, Dropbox), ZeroDrop does not maintain backend file storage clusters or database tables. All transfers occur over WebRTC DataChannels established directly between your web browser and the peer browser.

Zero Server Ingestion: Files are sliced into 64KB binary ArrayBuffer chunks entirely in client memory and transmitted directly via UDP sockets.
Zero Payload Logging: Clipboard text, source code snippets, and binary streams exist exclusively within browser volatile memory during the active session.
Zero Tracking: There are no advertising trackers, analytical scripts, Google Analytics tags, or telemetry beacons embedded within ZeroDrop.

2. Signaling Ephemerality & STUN Brokerage

To initiate direct peer-to-peer connectivity across NAT firewalls, browsers must exchange Session Description Protocol (SDP) offers and ICE candidates:

Signaling Broker: ZeroDrop utilizes lightweight WebSocket/PeerJS signaling broker channels strictly to relay the cryptographic handshake. These messages contain only session negotiation metadata (IP candidates, port types, cryptographic fingerprints) and are immediately discarded.
Air-Gapped Manual Handshake: Users requiring 100% offline or air-gapped operation may utilize the built-in Manual SDP Exchange mode, bypassing all public signaling infrastructure completely.
STUN Servers: Standard public STUN servers (e.g. Google STUN) are queried only to determine your public-facing NAT IP and port. No content is routed through STUN servers.

3. Cryptographic Guarantees (DTLS 1.3 & AES-256-GCM)

Every WebRTC DataChannel connection enforces mandatory transport-layer encryption via DTLS 1.3 / SRTP, providing forward secrecy and authentication against active eavesdropping.

Additionally, ZeroDrop features client-side AES-256-GCM End-to-End Encryption (E2EE). When a room passkey is specified, keys are derived in-browser using PBKDF2 (100,000 iterations, SHA-256) via the Web Crypto API (`window.crypto.subtle`). In this mode, even a compromised signaling network cannot decipher any byte of the transmitted payload.

4. Local Storage and Client Cookies

ZeroDrop uses zero tracking cookies, third-party cookies, or persistent identifiers. Browser `localStorage` is used solely to store local client preferences (such as audio synthesizer mute toggle and clipboard auto-sync preferences). You can clear this data at any time via your browser settings.

5. GDPR, CCPA & Global Compliance

Because ZeroDrop does not collect, process, or retain any Personal Identifiable Information (PII), it is inherently compliant with GDPR (EU), CCPA (California), and international data sovereignty mandates. There is no user database to breach, no IP access logs retained, and no personal profile generated.

6. Creator Credentials & Contact

ZeroDrop is an independent sovereign system architected by Suraj Mavuleti (Dev Zero), student of Bachelor of Science (BS) in Electronic Systems at the Indian Institute of Technology, Madras (IIT Madras / IITM).

For privacy audits, cryptographic inquiries, or technical verification, reach out directly to:

Suraj Mavuleti • support@zero.skillissue.gg • https://zero.skillissue.gg