Privacy Policy

In short. Your photos, videos, files and chat messages live on your own PC and travel directly between your devices. They do not pass through, and are not stored on, our servers: the service is built so that we cannot see what you keep. Our website keeps only what it needs to run your account: who you are, which devices are yours, which plan you have, and the short-lived details needed to introduce your phone to your PC. We do not sell your information and we do not show advertising.

1. Who we are

DRL-FileSync is a service of The DRL Initiative ("we", "us"). It consists of this website, an Android app and a Windows program. For the information described in this policy, The DRL Initiative is the party that decides how and why it is handled. Address: Ranchi, Jharkhand, India. Contact: thedrlintiative@gmail.com.

2. What we collect

We collect the following when you use the website and apps. It is held on our web server.

• Account details. Your name and email address, and your password stored only as a one-way hash (we cannot read your password). If Google sign-in is offered and you use it, we also store Google's identifier for your account and the email address Google confirms.
• Your country. The country you choose when you sign up or later on your profile. We use it to show you the plan prices for your country. Before you choose, the website may make a guess from signals your browser or our host sends, such as the language setting. That guess is not stored.
• Your devices. For each phone or PC you sign in on: the name it reports (for example the phone model or the PC name), its type, a public key used to verify it, a hash of its access token, when it was last online, and the internet address (IP address) it last connected from. We also record which phones are paired with which PC.
• Plan and payments. Your subscription, its tier and dates, promo codes you redeem, and any payment we record (amount, date, method and a note). We do not store card numbers. Where a payment service such as an app store handles the payment, that service holds your payment details.
• Connection set-up details. When your phone reaches your PC away from home, short messages are passed through our server to set up the direct link. They contain technical network information, including network addresses of your devices. They are deleted within minutes. If you choose "Let phones wake DRL-FileSync" on your PC, a small helper program on the PC also asks our server about every 20 seconds whether one of your phones is waiting to connect, so it can start DRL-FileSync again; each such request carries the PC's device identity and reaches us with the PC's internet address, like any other request from your PC.
• Signing a PC in with your phone (QR code). When a PC shows a sign-in QR code, we store for ten minutes or less a random code, a hash of a secret that only that PC holds, the PC's name and public key, and the internet address it asked from. When you approve it in the app, we link that PC to your account and delete the request. A request nobody approves is deleted when it expires.
• Share links (only if you make one). To let someone open your photos in a browser, we store the link's random id, which PC made it, which account, and when it ends or is removed. When a visitor opens a link, we also hold for a few minutes their connection set-up messages and the internet address they came from, to introduce their browser to your PC. The secret part of the link (after the #) and the photos never reach our server: the photos go straight from your PC to the visitor's browser.
• How well share links connect (statistics, no address). Each time someone opens a share link, their browser tells our server whether the direct connection to your PC worked, how long it took, whether their network looks like it allows such connections, and whether it ran directly, and whether their network supports IPv6. Our server looks up the name of the visitor's internet provider or mobile carrier (for example "Reliance Jio") from their internet address, using a list stored on our own server, so the address is not sent to anyone else. We then keep only that network name, its number, its country, the result and the time. We do not keep the visitor's internet address, which link it was, whose PC it was, or anything about the files. These records cannot be tied to a person or to your account. We keep them to find out which kinds of networks cannot open share links and to make links work for more people, and to tell visitors on such networks why it failed instead of leaving them to think something is wrong with the owner's PC.
• How your PCs are doing. A Windows PC reports, about once a minute while it is signed in, how much disk space it has free and uses, how many photos and videos DRL-FileSync holds (a number only), what it is doing (for example copying to a duplicate server) and which version of DRL-FileSync it runs. Your other PC shows this to you. It carries no file names and no content.
• Your phone's app settings. A copy of which folders the phone backs up, the schedule and the rules, so a reinstalled app can offer them back. Never photos, keys or passwords.
• Encryption key material (only if you turn encryption on). A key unique to your account, stored on our server in a form locked with a secret held by us, so that your PC can encrypt and decrypt your files and so that you can recover your files if you lose your password.
• Security records. Failed sign-in attempts (the email and IP address, with the time) to slow down password guessing, and a log of actions taken by our administrators.
• Technical data. Our hosting provider's server logs record requests to the website (for example IP address, time, page and browser).

3. What we do not collect

• We do not receive, store or look at your photos, videos, drive files or chat messages. They are sent between your devices.
• We do not use advertising or analytics trackers, and we do not build advertising profiles.
• The Windows program reads and writes only the folders you choose in its set-up (a working folder, and optional backup folders). It does not scan the rest of your PC.
• We do not read your contacts, location or messages on your phone. The Android app asks for access to your photos and videos so it can back up the folders you choose, to the camera so it can scan the pairing QR code, and to show notifications.

4. Built so that we cannot see what you keep

This is how DRL-FileSync is built, not only something we promise: what you keep never reaches us, so there is nothing on our side to look at.

• Nothing to see on our side. Your photos, videos, drive files and chat messages are stored on your own PC and phone. They are never uploaded to our servers, so we have no copy to open, browse, search, scan or hand over.
• At home we are not involved. On your own Wi-Fi your phone talks straight to your PC. Our website is not part of that connection and does not know it is happening. In Offline mode the apps do not contact the website at all.
• Away from home we only make the introduction. Our server passes short set-up messages so your two devices can find each other, then they connect directly, with encryption between the two of them. Neither our server nor the public helper servers that assist the connection can see your photos, your file names or which files you open. All we can see is that a connection was asked for, between which of your devices, and when.
• What we do see is about your account, not your content: who you are, which devices you have, when they were last online, your plan, and the technical details listed above. We cannot tell what is in your library or what you do in the apps.
• Chat messages are stored on the PC, not with us. They are not end-to-end encrypted, so the owner of that PC can read the messages stored there. We cannot.

The limits, said plainly. Your PC trusts the list of devices paired to your account, and that list is kept on our website. We do not use it to reach your files, and we have no reason to, but it is how pairing works. If you turn encryption on we hold a locked recovery key for your account (see "Your files stay on your PC"); we still do not hold the files themselves. Because we have no copy of your files, we also cannot restore them if you lose them, and we cannot give them to anyone who asks us for them: we can only give the account and device records we hold.

5. How we use it

• To create and run your account, sign you in, and keep your devices paired.
• To help your phone find and securely connect to your PC.
• To provide the plan you chose, apply promo codes, and keep records of payments.
• To protect the service and your account: preventing abuse, investigating problems and enforcing our Terms of Service.
• To contact you about your account or important changes to the service.
• To meet our legal obligations, such as tax and accounting records.

6. Who it is shared with

We do not sell your personal information. We share it only as needed with:

• Our hosting provider, which runs the website and database on our behalf.
• Google, for connection set-up. To help two devices connect directly, the apps use public STUN servers operated by Google. A STUN server sees the internet address of the device that contacts it, and nothing else about your account or files.
• Google, if you choose to sign in with Google. Google handles that sign-in under its own privacy policy and tells us your verified email and account identifier.
• Payment and app store services, if and when you pay through them, under their own terms and privacy policies. If you install the Windows program from the Microsoft Store, Microsoft handles the download and its own records of it under Microsoft's privacy policy; we do not receive your Microsoft account details.
• The other person's device. People who share a PC can see the names of the accounts that use it, and the chat feature shows your name to the people you message.
• Authorities and advisers, where the law requires it or to protect rights, safety and security, and professional advisers bound by confidentiality.
• A successor, if the service is sold or reorganised, who must honour this policy.

7. Your files stay on your PC

Photos, videos, drive files and chat attachments are stored on the Windows PC you set up, in the folders you choose, and on any backup folders you add. The Android app keeps a small local list and previews so your gallery opens quickly. Between your devices, traffic uses encrypted connections: your phone and PC verify each other with keys created during pairing, and traffic away from home goes over a direct, encrypted peer-to-peer link.

If you turn on optional encryption, your PC also encrypts the files it stores (AES-256-GCM) and decrypts them when you open them. This protects files at rest, for example if a drive is lost or shared. Because we hold a recovery key for your account so you cannot lose your library by forgetting a password, this is not the same as end-to-end encryption that even we could never unlock, although our servers never hold your files.

When encryption is on, your PC fetches the account key it needs from our server each time DRL-FileSync starts and keeps it in memory only, never on its disk, so your files open without your phone. Our server keeps that key locked with a secret that is stored on the server, so a forgotten password does not lose your files. This is why it is not end-to-end encryption: we never hold your files, but the locked key does sit on our server.

Offline mode (optional). If you turn on Offline mode, in the Android app or in the Windows program, DRL-FileSync stops using the internet and works only over your Wi-Fi. The one exception: once a day your PC asks the website what your plan includes and when it ends (it sends no addresses, no file information and no status, only that request). So that your PC can still start and open encrypted files without the internet, it then saves your key on its own disk. The saved key is sealed by the PC's security chip (where it has one) and by your Windows account, and it is deleted when you switch Offline mode off or switch encryption off. It never leaves the PC. Anyone who can sign in to that Windows account on that PC could open your files, so protect it with a Windows password.

The Windows program can start with Windows and keep running in the system tray, so your phone can back up without you opening it, and its helper can start it again when a phone looks for your PC. Both are switches in the program's settings. When nobody is signed in to DRL-FileSync on a PC, neither the program nor the helper stays running. In the Microsoft Store version Windows also lists them under Settings, Apps, Startup, where you can switch them off.

Finding people (optional). If you turn on Find people in my photos in the Android app, your PC looks at your photos and finds and groups the faces in them, using two open models that run on the PC itself. It is off unless you turn it on. The results (where each face is, a set of numbers describing it, and the names you give) are kept in a database on your PC, which is encrypted when you have encryption on, and are never sent to us or to anyone else. Photos in your Locked folder are not scanned. You can switch it off, or delete everything it found with Delete all face data (Settings, People), at any time. Face data can count as biometric or other sensitive data under the law where you live. You decide whose photos you group, so please use it only for photos you are entitled to use this way.

8. Security

We use encrypted connections (HTTPS) for the website and apps, store passwords as salted one-way hashes, sign requests between your devices with keys that never leave them, limit repeated sign-in attempts, and separate administrator access. No system is perfectly secure, and the safety of your files also depends on you looking after your PC, keeping its software up to date and keeping backup copies. Tell us straight away if you think your account has been misused. If a breach of our systems affects your personal information, we will tell you and the authorities as the law of your country requires.

9. How long we keep it

• Account, devices and plan: while your account exists. Deleting your account from your profile page removes it and its devices from our server.
• Connection set-up details: deleted within minutes.
• Share links: until they end or you remove them, then cleared within a day. Visitors' connection details are deleted within minutes.
• Share link connection statistics (network name, result and time, with no internet address): 30 days, then deleted.
• PC sign-in codes (QR): valid for ten minutes, deleted when used, cancelled or expired.
• Failed sign-in records: kept briefly and cleared after a successful sign-in.
• Payment and tax records: as long as the law requires, even after your account is deleted.
• Server logs and administrator logs: for a limited period needed for security and troubleshooting.
• On your PC and phone: your files stay until you delete them. Deleted items wait 30 days in the Bin and are then removed. Deleting your account does not delete files stored on your own PC, because they are yours and are not on our servers.

10. Your choices and rights

You can: view and change your name and password in the app or on your profile page; delete your account there; unpair a phone or PC at any time; delete the backup a phone made on your PC from the app's settings; switch encryption on or off; and decide which folders are backed up.

Depending on where you live, you may also have the right to access the personal information we hold about you, have it corrected or erased, object to or restrict some uses, withdraw consent, receive a copy in a portable format, and complain to a data protection authority. This includes rights under India's Digital Personal Data Protection Act, 2023 for people in the European Economic Area or the United Kingdom the GDPR, for people in the United States the privacy laws of their state (for example California's), for people in Brazil the LGPD, and the data protection laws of the other countries where we offer the service. Wherever you live, we give you the rights your own law gives you. We do not sell your personal information and we do not share it for advertising. To use a right, write to thedrlintiative@gmail.com. We will reply within the time the law allows. We may need to confirm it is really you first.

You may also complain to the data protection authority of the country where you live or work. Privacy complaints can also go to our grievance contact: The DRL Initiative privacy team, thedrlintiative@gmail.com.

Our legal bases, where the GDPR applies, are: performing our contract with you (running your account and plan), our legitimate interests (security, preventing abuse, improving the service), legal obligations, and your consent where we ask for it.

11. Cookies

The website uses only the cookies it needs to work: a session cookie that keeps you signed in and protects forms from forgery. It does not use advertising, tracking or analytics cookies. The apps do not use cookies for tracking.

If you add the website to your phone's home screen (the web app), your browser keeps a small copy of its style sheets, scripts and icons on your phone, so it opens quickly and can show a friendly page when there is no connection. Pages that show your account are never stored there. You can clear it at any time in your browser's site settings.

12. Children

DRL-FileSync is not meant for children under 16, or under the higher age your country sets for using an online service where there is one, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

13. Where data is processed

Our website and database run at our hosting provider's data centres, which may be outside your country. We serve people in several countries, so your information may be processed in a country other than yours. Where the law requires it, we rely on appropriate safeguards for such transfers (for example standard contractual clauses), and we handle the information under this policy wherever it is. Your files stay on your own devices, wherever they are.

14. Changes to this policy

We may update this policy as the service changes. We will change the "last updated" date above and, for significant changes, tell you in the app or by email before they take effect.

15. Contact

The DRL Initiative
Address: Ranchi, Jharkhand, India
Email: thedrlintiative@gmail.com

See also our Terms of Service and the list of permissions the apps use and why.