On this page7 sections
There are six cookies, and all of them are strictly necessary
DropTheDoc runs no advertising cookies, no analytics, no tracking pixels and no third-party trackers of any kind. We set six cookies, all of them required to sign you in, keep you in the right workspace, or let a signer through the checks a sender asked for. That is why you are not being asked to accept anything.
1.What cookies are
A cookie is a small text file a website asks your browser to store and send back on later requests. Similar technologies include local storage, which keeps data in the browser without sending it anywhere. This policy covers both.
Cookies are called first-party when the site you are visiting sets them, and third-party when someone else does. Every cookie DropTheDoc sets is first-party.
2.Every cookie we set
Name
dtd_session
Purpose
Keeps you signed in. Holds an opaque random token, never your identity or password. The server stores only a SHA-256 hash of it, so the cookie is useless to anyone who obtains the database.
Type
Strictly necessary
Expires
30 days, or immediately when you sign out or change your password
Attributes
HttpOnly, SameSite=Lax, Secure in production
Name
dtd_workspace
Purpose
Remembers which workspace you were last working in, so you land in the right place. Holds a workspace identifier. Access is still checked against your membership on every request, so this cookie cannot grant access to anything.
Type
Strictly necessary
Expires
1 year
Attributes
HttpOnly, SameSite=Lax, Secure in production
Name
dtd_oauth_state
Purpose
Protects single sign-on against cross-site request forgery by tying the request that starts a sign-in to the response that finishes it. Set only if you sign in with Google, GitHub or Microsoft.
Type
Strictly necessary
Expires
10 minutes, and deleted as soon as sign-in completes
Attributes
HttpOnly, SameSite=Lax, Secure in production
Name
dtd_oauth_next
Purpose
Remembers the page you were heading to before you were asked to sign in, so you are returned there afterwards. Set only during single sign-on.
Type
Strictly necessary
Expires
10 minutes, and deleted as soon as sign-in completes
Attributes
HttpOnly, SameSite=Lax, Secure in production
Name
dtd_2fa
Purpose
Holds the step between your password and your two-factor code, so you are not asked for the password twice. It names your account, is signed so it cannot be forged, and grants nothing on its own. Set only if you have two-factor turned on.
Type
Strictly necessary
Expires
5 minutes
Attributes
HttpOnly, SameSite=Lax, Secure in production
Name
dtd_check_ followed by a recipient's reference
Purpose
Remembers that you passed the checks a sender added to your signing link, an access code or an emailed code, so you are not asked again on every page. It names which checks you passed and when it expires, and is signed so it cannot be forged. Set only on a signing link that has checks.
Type
Strictly necessary
Expires
12 hours
Attributes
HttpOnly, SameSite=Lax, Secure in production
| Name | Purpose | Type | Expires | Attributes |
|---|---|---|---|---|
| dtd_session | Keeps you signed in. Holds an opaque random token, never your identity or password. The server stores only a SHA-256 hash of it, so the cookie is useless to anyone who obtains the database. | Strictly necessary | 30 days, or immediately when you sign out or change your password | HttpOnly, SameSite=Lax, Secure in production |
| dtd_workspace | Remembers which workspace you were last working in, so you land in the right place. Holds a workspace identifier. Access is still checked against your membership on every request, so this cookie cannot grant access to anything. | Strictly necessary | 1 year | HttpOnly, SameSite=Lax, Secure in production |
| dtd_oauth_state | Protects single sign-on against cross-site request forgery by tying the request that starts a sign-in to the response that finishes it. Set only if you sign in with Google, GitHub or Microsoft. | Strictly necessary | 10 minutes, and deleted as soon as sign-in completes | HttpOnly, SameSite=Lax, Secure in production |
| dtd_oauth_next | Remembers the page you were heading to before you were asked to sign in, so you are returned there afterwards. Set only during single sign-on. | Strictly necessary | 10 minutes, and deleted as soon as sign-in completes | HttpOnly, SameSite=Lax, Secure in production |
| dtd_2fa | Holds the step between your password and your two-factor code, so you are not asked for the password twice. It names your account, is signed so it cannot be forged, and grants nothing on its own. Set only if you have two-factor turned on. | Strictly necessary | 5 minutes | HttpOnly, SameSite=Lax, Secure in production |
| dtd_check_ followed by a recipient's reference | Remembers that you passed the checks a sender added to your signing link, an access code or an emailed code, so you are not asked again on every page. It names which checks you passed and when it expires, and is signed so it cannot be forged. Set only on a signing link that has checks. | Strictly necessary | 12 hours | HttpOnly, SameSite=Lax, Secure in production |
Every one of these is marked HttpOnly, which means JavaScript on the page cannot read it, and SameSite=Lax, which stops it being sent from another site's request. In production they are also Secure, so they travel only over HTTPS.
3.Local storage
These stay in your browser. None of them identifies you, and none is read by anyone but the DropTheDoc page you are on.
Key
theme
Purpose
Remembers whether you chose light mode, dark mode or your system setting, so the page does not flash the wrong colour on load.
Sent to us?
No. It stays in your browser and is never transmitted.
Key
dtd_pending_ask
Purpose
Keeps what you typed into Ask the agent on our website before signing up, for up to a day, so it is waiting in the agent when you arrive. Removed once it is used.
Sent to us?
Only when you send it to the agent yourself, after signing up.
Key
dtd_agent_width and dtd:inky-width
Purpose
Remember how wide you made the agent's panel beside your documents and in the editor.
Sent to us?
No.
Key
dtd_contact_draft (session storage)
Purpose
Keeps a message you are writing in the contact form if the page reloads. Cleared when you close the tab.
Sent to us?
Only when you press send.
Key
pending-upload (IndexedDB)
Purpose
Keeps a file you picked on our website before signing up, for up to a day, so it can be uploaded once you have an account.
Sent to us?
Only when it is uploaded, after you sign up.
| Key | Purpose | Sent to us? |
|---|---|---|
| theme | Remembers whether you chose light mode, dark mode or your system setting, so the page does not flash the wrong colour on load. | No. It stays in your browser and is never transmitted. |
| dtd_pending_ask | Keeps what you typed into Ask the agent on our website before signing up, for up to a day, so it is waiting in the agent when you arrive. Removed once it is used. | Only when you send it to the agent yourself, after signing up. |
| dtd_agent_width and dtd:inky-width | Remember how wide you made the agent's panel beside your documents and in the editor. | No. |
| dtd_contact_draft (session storage) | Keeps a message you are writing in the contact form if the page reloads. Cleared when you close the tab. | Only when you press send. |
| pending-upload (IndexedDB) | Keeps a file you picked on our website before signing up, for up to a day, so it can be uploaded once you have an account. | Only when it is uploaded, after you sign up. |
4.What we do not set
For the avoidance of any doubt, DropTheDoc does not use:
- Advertising or retargeting cookies.
- Analytics of any kind, including Google Analytics, and no product analytics or session replay.
- Social media pixels or share-button trackers.
- Fingerprinting, cross-site or cross-device tracking.
- Third-party cookies. No other party sets a cookie through our pages.
We also do not sell or share personal data collected through cookies, because there is none to sell.
5.Why there is no cookie banner
Article 5(3) of the ePrivacy Directive 2002/58/EC, and the national laws implementing it, require consent before storing information on a user's device, but exempt storage that is strictly necessary to provide a service the user has explicitly requested. Signing you in, and keeping you signed in, is exactly that.
Since every cookie we set falls within that exemption and we run no optional cookies at all, there is nothing for you to consent to and nothing for you to reject. Asking anyway would be theatre. If we ever introduce a non-essential cookie, we will ask for consent before setting it, offer a genuine reject option that is as easy as accepting, and update this page first.
6.Controlling cookies
You can block or delete cookies in your browser settings, usually under Privacy. You can also use private browsing.
What breaks if you block them
Because every one of these cookies is strictly necessary, blocking them stops you signing in. You will be able to read the public pages, and a recipient can still open a signing link, unless the sender added checks to it, which need the check cookie. The account side of DropTheDoc will not work.
Browser "Do Not Track" and Global Privacy Control signals are respected by default in the sense that there is no tracking to turn off.
7.Changes and contact
If our cookie use changes, we will update the table above and the version at the top of this page, and we will ask for consent first where consent is required. Questions go to privacy@dropthedoc.in.
Version history
- Version 1.215 October 2026
Removed dtd_muted: the Sound and motion switch is gone, sound and motion follow your device's reduced-motion setting, and a saved value is cleared on your next visit.
- Version 1.115 October 2026
Added two cookies that were missing: dtd_2fa, for the step between your password and a two-factor code, and dtd_check_, which remembers that a signer passed the checks a sender asked for. Listed the browser storage behind the sound and motion switch, a question asked before sign-up, panel widths, the contact form draft and a file picked before sign-up.
- Version 1.026 July 2026
First publication.
This document describes how DropTheDoc works and what we and you have agreed. It is written to track the law it cites, but it is not legal advice and it is not a substitute for advice about your own situation. Statutes change. If you are relying on this for something that matters, have your own counsel review it, and any document you send, before you rely on it.