Updated August 21, 2026
Security
DropToPhone minimizes server-side data, uses short-lived pairing sessions and confirms receipt before declaring a file complete.
Transport protection
WebRTC DataChannels use encrypted DTLS transport. A TURN relay can forward encrypted packets but is not given a DropToPhone file library. Network peers and infrastructure can still observe connection metadata such as IP addresses, timing and traffic volume.
Pairing protection
QR codes contain a high-entropy, short-lived join token. The manual code is rate limited and is intended only as a fallback. Compare the pairing code on both devices and end the session if an unexpected device appears.
Responsible disclosure
Send a clear description, reproduction steps and impact to info@droptophone.com. Do not access other people's data or disrupt the live service while testing.