Privacy policy

1. Scope

This Privacy Policy explains what personal information Droppy collects, how that information is used, and the choices you have when using the website, the Droppy for Mac and Droppy for iPhone apps, purchasing a license, using account features, and using Droppy Sync.

2. Information we collect

• Account details: email address and authentication session data when you log in via magic link.
• Purchase and licensing details: payment status, Stripe checkout identifiers, license key records, and issue timestamps.
• Technical and security information: IP address, device/browser metadata, request logs, and anti-fraud signals used to protect services.
• Support communications: messages and information you send to Droppy through email or community channels.
• Creator offer submissions: the email address and public X, Instagram, or TikTok post URL you submit for a social lifetime license, the review decision, and the resulting license record.
• Droppy Sync data: end-to-end encrypted sync content and device records when you turn on Droppy Sync, described in the Droppy Sync section below.
• Droplet install counts: a running total per droplet that increases by one the first time you turn that droplet on in Droppy for Mac. The request carries no account, license, or device identifier, and no per-install record is kept.

3. How we use information

• Process payments, generate and validate license keys, and provide account-based key recovery.
• Deliver product updates, service notifications, and critical account or security notices.
• Operate, maintain, and improve Droppy products and infrastructure.
• Operate Droppy Sync between your Mac and iPhone when you turn it on, including pairing devices and storing only encrypted sync data.
• Prevent abuse, detect unauthorized use, and enforce legal terms and license conditions.
• Comply with legal obligations and resolve disputes.
• Route creator offer submissions to a private staff review queue, communicate the decision, issue approved licenses, and prevent duplicate or abusive claims.

4. Payment and commerce providers

Droppy does not store full payment card numbers. Payments are processed by Stripe. Payment data is handled according to Stripe's policies and security standards.

5. Service providers and sharing

Droppy shares personal information only with trusted processors as needed to run the service. Typical processors include hosting/CDN providers, authentication and database providers, payment processors, email delivery providers, and Discord for the private creator-offer staff review queue.

• Service providers may process data only for Droppy service operations and security.
• Droppy may disclose data when legally required, to protect rights/safety, or in connection with a merger, acquisition, or asset sale.

6. Droppy Sync and the iPhone companion

Droppy Sync keeps your clipboard, OCR history, Basket, Shelf, and Cloud files in sync between your Mac and the Droppy for iPhone app. Sync is off until you create a sync library, and pairing a new device always requires your confirmation on that device.

• End-to-end encryption: synced content is encrypted on your devices before it is uploaded, and the content keys never leave your devices. Droppy's servers store only encrypted envelopes and encrypted file data they cannot read.
• What the server stores: encrypted record envelopes and encrypted file blobs, a random sync library identifier, a hashed access secret, per-device records (a device name you can edit, device type, and last-seen timestamp), and non-content bookkeeping such as sizes, checksums of encrypted data, revision counters, and usage quotas.
• Rate limiting: the sync service keeps short-lived request counters to protect the service from abuse.
• Retention and deletion: deleting your sync library removes its records and schedules its encrypted files for deletion, which background sweeps finalize shortly afterwards. Removing a paired device revokes its access immediately. Stale upload reservations and mutation history are cleaned up automatically on a rolling basis.
• The iPhone app: Droppy for iPhone stores your synced content on your device. The camera is used only to scan pairing codes and documents, and images are processed on device. The app does not contain third-party advertising or analytics SDKs.
• App Store privacy label: the iPhone app declares Other User Content (your encrypted synced content) and Device ID (the random per-device sync identifier) as collected for app functionality and linked to your sync library. Neither is used for tracking, and no data is shared with data brokers or advertisers.
• Processors: sync metadata and encrypted records are stored with Supabase, and encrypted file data is stored with Cloudflare R2, both acting as processors for Droppy.

7. In-app connections to other services

Droppy for Mac runs on your Mac, and most of what it does never leaves it. Three connections are worth stating plainly because they leave your Mac while you are simply using the app.

• Droplet install counter: the first time you turn a droplet on, Droppy sends that droplet's identifier to its own counters service so the in-app Store can show how popular each droplet is. It is sent at most once per droplet per Mac, it carries no account, license, or device identifier, and the service keeps only one running total per droplet. You can turn it off in Droppy settings under About, Privacy, and the Store then shows no install counts.
• Thunderstorm web lookups: when you open a search result in the Thunderstorm launcher, Droppy sends that search text to services Droppy does not operate so it can show an answer preview. Those are public SearXNG instances, Wikipedia, DuckDuckGo, Google as a last resort, and Wikidata when the question asks who someone is. Typing in the launcher sends nothing, no account, license, or device identifier travels with the search, and each of those services handles the request under its own privacy policy.
• Other in-app requests: opening a website result fetches that page for its title and preview image, and Thunderstorm's currency conversion downloads the European Central Bank's daily reference rates, which carry no information about you.

8. Data retention

Droppy retains information only as long as necessary for licensing, security, accounting, and legal compliance. Retention periods vary by data type and legal requirements. Creator offer claim records are retained to administer the license, document the review decision, enforce the one-license-per-person rule, and verify the requirement that an approved post remain public for at least 3 months after approval. The anti-abuse IP signal stored with a claim is a keyed hash rather than the original IP address.

9. Security

Droppy uses reasonable administrative, technical, and organizational safeguards. No method of storage or transmission is completely secure, so absolute security cannot be guaranteed.

10. Your choices and rights

• You can request access, correction, or deletion of personal data, subject to legal and contractual limits.
• You can delete your Droppy Sync library from Droppy settings, which removes its records and schedules its encrypted files for deletion.
• You can turn off the anonymous droplet install counter in Droppy settings under About, Privacy.
• You can request account/license support by contacting hi@getdroppy.app.
• Transactional emails about purchases, account access, and security cannot be fully opted out while services are active.

11. International processing

Droppy services may be operated from multiple regions. By using Droppy, you understand that information may be processed in countries different from your own.

12. Children

Droppy is not intended for children under 13 (or the minimum legal age in your jurisdiction). If personal data from a child is identified, Droppy will take steps to remove it.

13. Changes to this policy

Droppy may update this Privacy Policy to reflect product, legal, or operational changes. Material updates are effective when posted with an updated effective date.

14. Contact

Privacy requests and questions: hi@getdroppy.app.