Privacy Policy

This Privacy Policy explains how Drop collects, uses, shares and protects your personal information when you use the Drop apps for iOS and Android and the website at dropsocial.app (together, "Drop"). We handle personal information in accordance with the New Zealand Privacy Act 2020 and, where they apply to you, the privacy laws of the country you live in.

1. Who is responsible for your information

Drop is operated by Ernest Manirambona, an individual based in New Zealand ("we", "us" or "our"). We are responsible for the personal information described in this policy. Our privacy officer can be contacted at support@makedrop.icu.

2. Information we collect

We collect the following information:

• Account information: your email address and, if you sign up with a password, your password (stored only in a securely hashed form by our authentication provider). If you sign in with Apple or Google, we receive the details that provider shares for sign-in, typically your name, email address and, for Google, a profile photo.
• Profile information: your display name, username, bio, profile photo, whether your account is private, and the answer you give to "What brings you to Drop?" during sign-up.
• Content you post: drops (photos, video, audio and links) and their captions, people you tag, stories (including their text, backgrounds and media), and comments.
• Messages: the direct and group messages you send, including photos, drops and stories you share in them, and reactions. Messages are visible only to the people in that conversation.
• Activity: who you follow and who follows you, follow requests, the drops you like and save and the folders you save them in, which stories you view, the notifications you receive, the reports and blocks you make, your place on the waitlist and any link to your work you add to it, who let you in and who you let in (including the email addresses you give us to let friends in), and feedback you send us.
• Device and technical information: a push notification token for each account signed in on your device (if you allow notifications), your app version, and crash and error reports when something goes wrong in the app. A report says what went wrong and includes your device model, system version, app version, your account ID and the names of the screens you visited just before, so we can find and fix the problem. When an error happens in the app, the report can also include a short recording of the screen from the moments before it, with all text, photos, videos and icons blanked out, so it shows only the layout and where you tapped. Reports do not include your posts, messages or contacts, and we do not use them for advertising or tracking. Our hosting providers also process technical information such as IP addresses as part of delivering the Service.

We do not collect your precise location, your contacts, or information from other apps on your device.

3. Device permissions

The Drop apps ask for permission before using your device's camera, microphone or photo library. The camera and microphone are used only while you take a photo or record a video for a story, a drop or a profile photo, and the photo library when you choose media to post or send. On iPhone, if you allow photo access, the story camera also shows your newest photo on its Library button. Drop does not use the camera, microphone or photo library in the background.

Notifications are optional. You can turn them off for each account in Settings, Notifications, or for Drop as a whole in your device settings.

4. What other people can see

• Your display name, username and profile photo are visible to anyone on Drop and to anyone who opens a link to your profile.
• If your account is public, your bio, drops, stories, follower and following counts and lists are visible to anyone. If your account is private, they are visible only to you and to the followers you approve.
• Comments are visible to anyone who can see the drop they are on.
• When you view a story, the person who posted it can see that you viewed it.
• When you like a drop, the person who posted it can see that you liked it. Like counts are not shown publicly. Saves are visible only to you.
• In messages, the people in the conversation can see what you send, when you have read it, and when you are typing.

5. How we use your information

We use your information to:

• create and maintain your account and verify your identity when you sign in;
• provide Drop's features, including your feed, profile, stories, messages and notifications;
• keep Drop safe, including reviewing reports, enforcing our Terms of Service and Child Safety Standards, and preventing abuse;
• fix problems and improve how Drop works;
• communicate with you about your account, including security and service messages; and
• comply with our legal obligations.

Drop has no advertising. We do not sell your personal information, we do not share it with advertisers or data brokers, and we do not use it to build advertising profiles. Your feed is shown in time order from the people you follow; we do not use your information to rank it.

6. Legal bases (for people in the EU and UK)

If you are in the European Union or the United Kingdom, we rely on the following legal bases: performance of our contract with you (to provide Drop under our Terms of Service); our legitimate interests (to keep Drop safe, fix problems and improve the Service, where those interests are not overridden by your rights); your consent (for push notifications and device permissions, which you can withdraw at any time); and compliance with legal obligations.

7. Who we share information with

We share personal information only with the service providers that help us run Drop, and only as needed for them to do so:

• Supabase: database, authentication, file storage and sign-in emails.
• Vercel: hosting for the website and the server functions it uses, including building previews of links you post or send.
• Expo: delivery of updates to the Drop apps.
• Sentry: crash and error reports, and the blanked-out screen recordings that come with errors, from the Drop apps.
• Apple: Sign in with Apple, if you use it, and the Apple Push Notification service on iPhone.
• Google: Google sign-in, if you use it, and Firebase Cloud Messaging for notifications on Android.

We may also disclose information if we believe in good faith that it is required by law, or necessary to protect the safety of any person, to report child sexual abuse material to the appropriate authorities as described in our Child Safety Standards, or to respond to a lawful request from a public authority.

8. Where your information is stored

Your information is stored on servers operated by Supabase in Seoul, South Korea, and is processed by our other service providers in the United States and elsewhere. These countries may not have privacy laws that are comparable to New Zealand's. We use reputable providers that are contractually required to protect personal information and to use it only to provide their services to us.

9. How long we keep information

• Stories are available for 24 hours and are then deleted, together with any copies made when a story was shared in a message.
• Drops, comments, messages and your profile are kept until you delete them or delete your account.
• When you delete your account, your profile, drops, stories, comments, messages you sent, likes, saves, follows and uploaded media are deleted from the live service. Residual copies may remain in routine backups for a limited period before they are overwritten.
• Reports you made, or that were made about you, may be kept for up to 90 days after your account is deleted for safety reasons, and then deleted.
• Error reports are kept only for as long as they are needed to fix the problem they describe.

We may keep information for longer where we are required to by law or where it is needed to deal with a legal claim or a serious safety concern.

10. Information stored on your device

The Drop apps store some information on your device so that they open quickly and work with a poor connection, including recently viewed content and your preferences. If you sign in to more than one account on the same device, the sign-in details for each account are stored in your device's secure storage. Signing out of an account removes its information from the device.

11. Your rights and choices

Under the Privacy Act 2020 you have the right to ask for a copy of the personal information we hold about you and to ask us to correct it. Depending on where you live, you may also have the right to ask us to delete it, restrict or object to how we use it, or provide it to you in a portable format.

• You can edit your profile, make your account private, block people and change your notification settings at any time in the app.
• You can delete any drop, story, comment or message you have posted.
• You can delete your account in the app from Settings, Account, Delete account.
• You can make any other request by emailing support@makedrop.icu from the email address linked to your account. We will respond within 20 working days.

To delete your account without using the app, email support@makedrop.icu from the email address linked to your account with the subject "Delete my account" and your username. We will confirm the request and delete the account within 30 days.

If you are not satisfied with how we have handled a privacy concern, you can complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), or to the data protection authority in the country where you live.

12. Children

Drop is not intended for anyone under 13, and we do not knowingly collect personal information from children under 13. If we learn that an account belongs to someone under 13, we will delete it. If you believe a child under 13 is using Drop, please contact us at support@makedrop.icu.

13. Security

We take reasonable steps to protect your personal information from loss, misuse and unauthorised access, including encryption in transit, access controls that limit each account to its own data, and private storage for stories. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above, and if a change is material we will let you know in the app or by email before it takes effect.

15. Contact

Questions about this policy or your personal information can be sent to support@makedrop.icu.