Privacy Policy

1. The short version

• We do not require an account, and we do not ask for your name, email, or phone number.
• Your chat messages are end-to-end encrypted — we cannot read them, ever.
• Your shared files self-destruct on the schedule you choose (max 24 hours).
• We never sell, rent, or trade personal information.
• We display advertising through Google AdSense and measure overall site usage with Google Analytics. These are run by Google under their own terms and may set cookies.
• Before any advertising or analytics cookies are set, we ask for your consent through the Google-certified Consent Management Platform (CMP). You can withdraw consent at any time.

2. Information we do not collect ourselves

XDriv deliberately operates with the minimum possible knowledge of its users. The XDriv service itself does not collect:

• Names, email addresses, phone numbers, or passwords.
• Behavioural profiles or browser fingerprints.
• The plain-text contents of your chats or files.
• Payment information — the core service is free.

3. Information we temporarily process to deliver the service

To make sharing and chat work, a minimal amount of information is held only for the lifetime of the share or room you create (a maximum of 24 hours, or sooner if you choose):

• Files you upload — stored only as long as the share you created is alive, then permanently destroyed.
• Encrypted chat messages — we hold ciphertext only.
• Auto-generated room identities (e.g. “Wandering Falcon”) — created on the fly and never linked to you.

4. End-to-end encryption

All chat messages are encrypted in your browser using AES-GCM 256-bit keys. The encryption key is placed in the URL fragment (the part after the # symbol). By long-standing internet standards, browsers never transmit fragments to servers, which means we are technically unable to decrypt your conversations — not on a court order, not after a breach, not by any party.

5. Third-party services we use

To keep XDriv sustainable and freely available, we rely on a small number of trusted services. Each is listed below with the purpose it serves and a link to its own privacy policy.

These services may set their own cookies and process limited technical data such as your IP address and user-agent. They do so under their own terms and policies, which we encourage you to review. XDriv does not sell, transfer, or share personally identifying information with any party.

6. Consent & your choices

The first time you visit XDriv, the Google-certified CMP banner asks for your consent before any advertising or analytics cookies are placed. You may:

• Accept all — allow personalised ads and analytics so we can keep the service free.
• Reject non-essential — only the cookie required to remember your visual preferences will be set; you may still see non-personalised ads.
• Manage choices — granular control of each purpose and partner.

You can change your decision at any time by clicking the Privacy Settings link in the footer, or by clearing cookies for this site in your browser. Your choice is respected immediately.

7. We do not sell personal information

XDriv does not, and will never, sell personal information for monetary consideration. Showing relevant advertising through Google is the only commercial activity on the site, and even that is fully under your control through the consent banner described above.

8. Data retention & deletion

Every share and chat room you create has a self-destruct window (between 1 and 24 hours). When that window ends, all associated content is irrecoverably deleted from our systems. You may also delete a share manually at any time before its expiry. Once content is gone it cannot be restored, even by us.

9. International transfers

Where Google and other third parties process data on our behalf, that processing may take place in regions outside your own. These transfers are governed by the safeguards described in each provider’s own privacy policy (Standard Contractual Clauses, EU-US Data Privacy Framework, and equivalent mechanisms).

10. Your rights

Because XDriv holds no accounts and no directly identifying personal information, traditional “subject access” and “right to be forgotten” requests are largely unnecessary — there is nothing personal to access and nothing personal to forget. For data processed by Google through AdSense or Analytics, please use Google’s own privacy controls or contact Google directly.

11. Security

All traffic is delivered over TLS. Files are protected by random, unguessable identifiers, and chat content is encrypted on your device before transmission. We employ strict security headers and review our codebase regularly. No system is perfect, but we have engineered XDriv to minimise damage in the event of any compromise.

12. Children

XDriv is not intended for children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has used the service, please contact us so we can assist where appropriate.

13. Changes to this policy

We will publish any material changes to this policy on this page with an updated revision date. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

14. Contact

Questions, concerns, or compliance requests can be addressed to the XDriv Team via the contact details published on the website.