Trust and safety

Droply's commitment to a safe internet

Last updated: September 25, 2026

Droply puts websites and files online in seconds. That is only worth having if people can trust what they find, so we work to keep phishing, malware and scams off the sites we host, and we take down the ones that get through.

What is not allowed

Our Acceptable Use Policy lists everything that cannot be published on Droply. The most serious cases are:

phishing: pages that pretend to be someone else to collect passwords, card details or other private information;
malware: code or files that harm a visitor's device or data;
scams and fraud;
child sexual abuse material.

How we find abuse

Every site has an owner. Publishing needs a signed-in account. There is no anonymous publishing on Droply.
Every version is checked. Uploaded files are scanned for malware before they go live, and each published version is checked for the signs of abuse, such as pages that ask for passwords or card details, or that quietly send visitors somewhere else.
Destinations are checked too. When a page redirects its visitors to another website, we fetch that website and check what it shows.
People tell us. Anyone can report a site through our abuse report form, and reports go to our team for review.

What we do when a site breaks the rules

We take it down. Its address, and any custom domain connected to it, shows a notice instead of the site. We also ask our content delivery network to drop its cached copies of the site's files.
We warn its visitors. Our notice for phishing, malware and scams tells visitors what to do if they typed a password or card details into the site, or downloaded something from it.
We mark it as gone. A site we take down for what it contains answers every request with the HTTP status 410 Gone, so browsers, search engines and security scanners can see that it was removed on purpose.
We tell the owner why. When our team takes a site down for what it contains, its owner gets an email naming the rule it broke, except in a few serious cases where we cannot say.
We remove repeat offenders. An account can be banned for serious or repeated abuse, and every site it hosts goes offline with it.

How to report abuse

Use the abuse report form. You do not need an account. Include the full address of the page, the kind of abuse, and anything that helps us find it, such as where a redirect sent you. You can also write to [email protected].

If your site was taken down

If you think we got it wrong, write to [email protected] with the address of the site. We will review it, and if the takedown was a mistake we will put the site back online. Your files are not deleted while the site is down. The same address works if your account was banned.

For browser vendors, security teams and registrars

Customer sites are served on droply.id and on the custom domains their owners connect. Droply itself runs on droply.host. To reach us about a site we host, write to [email protected] with the full address of the page.

Sites on Droply are static: we serve the files their owners publish, and none of their code runs on our servers.