Vela Drop

Privacy

What we keep, and for how long.

Vela Drop hosts one HTML file and tells you who opened it. Almost everything below follows from that, and from the fact that all of it is deleted after 30 days.

The short version.

  • No accounts. There is nothing to sign up for, so there is no profile to hold.
  • No cookies by default. None on this site, and none on the pages we host for you. Visitor counting is approximate and cookie-free — no cookie is ever used to count anybody, on any plan. Pro can add two, in two quite different senses, and both are set out below: one that lets a page owner restrict their document to named addresses, and one they may switch on to tell a returning reader from a new one.
  • No trackers. No third-party analytics, no ad network, no pixel — on this site or in what we serve.
  • Nothing sold or shared. Your pages and their analytics are not a product, and we don't pass them to anyone who would treat them as one.
  • Nothing kept. Thirty days after upload the file, the analytics and the metadata are permanently deleted.

When you upload a page.

We store the file itself, the two links minted for it, and the small amount of metadata the dashboard needs: the tags you add, the browser title you set, when it was uploaded, and when it expires.

We don't ask who you are, and there is no account to attach an upload to. Our infrastructure provider, Cloudflare, processes the request on our behalf and keeps its own short-lived operational logs, as any host does.

We never modify your HTML. No injected script, no analytics snippet, no badge. If your page sets cookies or collects anything from a visitor, that is yours — we neither see it nor process it, and disclosing it is your responsibility.

When someone opens your page.

An open is recorded so your dashboard can be useful. It is deliberately coarse.

What is recorded

  • The tag on the link that was opened, and the time
  • Country, from Cloudflare's edge
  • Device type and browser family, from the user agent
  • The referring site, origin only
  • The network the request came from — the operator's name, such as a mail scanner's, never the address
  • Whether it looks like a machine rather than a reader

What is not

  • No IP addresses. The address and user agent go into a one-way hash that changes every day. It cannot be reversed, and it cannot follow anyone from one day to the next.
  • No identities, unless the page asks for one. Nothing in the analytics learns a visitor's name or email, and we can't see anything they typed into your page. The two exceptions are the ones a page owner switches on deliberately and a reader is asked about to their face — restricting a page to named addresses, and asking every reader who they are.
  • No cross-site profile. Nothing links a visitor to any other page, yours or anyone else's.

That daily hash is the whole reason unique visitors are described as approximate. It is the honest word for the number, and the reason we can offer one at all without a cookie.

Restricting a page to named addresses

A page owner on Pro can name the addresses allowed to open their document. A visitor is asked which address they are, and if it is on the list they get a one-time link by email; opening it sets a cookie on that one page's own address which says nothing except that this browser proved that address. It lasts twelve hours, it holds no name and no address — only a hash of one — it counts nothing, it reaches no other page, and it is deleted with the page.

This is the kind of cookie that is strictly necessary for a service the reader has asked for: without it, proving your address once would mean proving it again on every click. It exists only on pages whose owner switched the restriction on, and we do not treat it as requiring consent — but if you are the page owner and your own rules say otherwise, the list is yours to switch off.

Asking every reader who they are

A page owner on Pro can put a question in front of their page instead of a lock: anyone may read it, once they have given an email address. The reader types an address, we send a one-time link to it, and the page opens when they follow that link. Nothing is recorded until they do — an address typed and never confirmed leaves no trace at all.

Once confirmed, the address is stored against that page and shown to whoever published it, along with when the page was opened and the country it was opened from. This is the one place Vela Drop holds a reader's address in a form somebody can read, and it is held for that page's owner, on their instruction. The screen the reader sees says so before they type anything.

It is deleted with the page, on the same schedule as everything else — 30 days, or 90 on Pro. We do not email these addresses, we do not add them to anything, and they are never shown to anyone but the page's owner. What the owner does with an address afterwards is between them and the reader, and it is their obligation under data-protection law rather than ours.

If you attach your email.

Claiming a page stores your address against that page, so entering it again brings back the edit links you'd otherwise have lost. It is visible only to whoever already holds the edit link.

The index used to look you up stores only a one-way hash of the address, never the address itself — so the lookup table exposes no addresses even to us. We don't add you to a mailing list, and the address is deleted with everything else at 30 days.

Abuse, and what it costs in privacy.

Anyone can host a page here, which means some people will try to host a phishing page. We may analyse an uploaded page's own text automatically to catch that, and a reported page is looked at by a person. Automated checks run on Cloudflare's AI platform; the page is not sent to anyone else, and the analysis is used for nothing but deciding whether the page breaks our rules.

If you report a page, we use the link, the reason and anything you add to assess it and act on it, and your email — which is optional — only to come back to you. Where a page is removed for abuse we may keep enough of a record to stop the same content being uploaded again.

After 30 days.

The file, the analytics, the tags, the title and any email attached to the page are deleted permanently. Not archived, not anonymised and kept — deleted. Three independent mechanisms enforce it, because it is the promise the whole product rests on.

You don't have to wait. Delete on the edit dashboard removes everything immediately, and it is the fastest answer to any question about what we still hold. For anything else, email us — we can only act on a page while it still exists.

Two domains, on purpose.

This site is veladrop.com. Uploaded pages are served from veladrop.app, each on its own subdomain and therefore its own browser origin. One person's page can never read another's data, and nothing hosted for a user can reach the rest of Vela Drop.

One third party is involved on this site: the fonts on these marketing pages are loaded from Google Fonts, so your browser makes a request to Google to fetch them. Pages we host for users load nothing of ours at all.

Questions.

Vela Drop is a tool from Vela Intelligence. Email abuse@veladrop.com and a person will read it.

Last updated 6 August 2026.

Drop a file How it works