Privacy Policy

1. Scope

This Privacy Policy applies to Dropday’s website, application, notifications, and related services. It does not cover Spotify, Apple Music, or other third-party services that you choose to open or use through Dropday.

By using Dropday, you acknowledge the practices described here. Our Terms of Use contain the rules for using the service.

2. Information we collect

Account information

When you create or use an account, we receive information such as your name, email address, profile image, account identifier, plan, preferences, and account dates. Authentication is provided by Clerk; Dropday does not receive your password. If you purchase a plan, we receive subscription, plan, entitlement, and billing-event information needed to manage access. Payment-card details are handled by the billing provider rather than stored by Dropday.

Club and playlist information

We store the information needed to organize your clubs and drops, including club names and descriptions, public or private visibility, artwork, memberships and roles, join requests, queues, schedules, time zones, reminder settings, themes, backup playlists, playlist links and metadata, drop assignments, release dates, and publication history.

Content and interactions

We collect content you submit and actions you take, including playlist notes, club and theme descriptions, uploaded artwork, chat messages, mentions, reactions, notification read status, and membership or administration actions.

Communications and notification data

We keep your email-notification preferences and records needed to send or troubleshoot service messages. If you enable browser notifications, we store a push endpoint, encryption keys, expiration information, a user-agent string, and timestamps for that browser subscription. Your browser or device provider may also process a notification to deliver it.

Device and usage information

We and our infrastructure providers may receive standard technical information when you use Dropday, such as IP address, browser and device type, requested pages, referring page, timestamps, cookie or session identifiers, and diagnostic or security events. We also record limited operational events, such as webhook receipts, rate-limit records, and task or delivery status, to keep the service reliable and secure.

3. How we use information

We use information to:

• create and authenticate accounts and apply plan entitlements;
• operate clubs, rotations, schedules, themes, playlists, drops, chat, and discovery;
• deliver in-app, email, and browser notifications you have enabled;
• process payments and maintain subscription access;
• provide support and respond to questions or account requests;
• monitor performance, prevent abuse, investigate incidents, and protect members;
• debug, analyze, and improve Dropday’s features and usability; and
• comply with law, enforce our terms, and protect legal rights.

Where applicable law requires a legal basis, we process information to provide the service you requested, pursue legitimate interests such as security and improvement, comply with legal obligations, or act with your consent.

4. How we share information

We do not sell your personal information or share it for cross-context behavioral advertising. We may share information in these circumstances:

• With other members. We show profile, club, playlist, drop, and interaction information to the people allowed to view the relevant club or feature.
• With service providers. Vendors process information for us to provide authentication and billing, database and hosting, artwork storage, real-time chat, email, scheduled tasks, browser push, security, and technical operations.
• With integrated music services. Opening or embedding a Spotify or Apple Music playlist sends standard request information to that provider under its own privacy policy.
• For legal and safety reasons. We may disclose information when we reasonably believe it is required by law or needed to protect rights, safety, security, users, or the service.
• During a business transaction. Information may transfer as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate protections.
• With your direction. We may share information when you ask us to or give consent.

Depending on which features are configured, service providers may include Clerk, MongoDB infrastructure, Ably, Resend, Trigger.dev, Vercel Blob, and browser or operating-system push services. They may process information only for the services they provide to us, subject to their own contractual and legal obligations.

5. Club visibility and member content

Public clubs may be discoverable by Dropday members and may display club details intended for discovery. Private clubs and their content are limited to authorized members and administrators, subject to the controls shown in Dropday. Club owners and admins can see and manage information connected to their clubs, such as memberships, join requests, queues, and member-submitted content.

Scheduled playlist content may stay limited to the assigned member or an authorized replacement until its release time. After publication, it becomes available to the relevant club members. Messages and reactions are visible to participants in their club or drop thread.

Remember that another member may save or share information they can see. Choose what you post accordingly, and do not share sensitive personal information in club descriptions, playlist notes, or chat.

6. Cookies and local storage

Dropday and its authentication provider use cookies and similar storage to keep you signed in, protect sessions, remember interface state, and operate account features. Dropday also stores your light or dark appearance choice and visual skin preference in your browser’s local storage. A functional cookie may remember the application sidebar state.

These technologies are used for service operation and preferences, not for third-party advertising. Blocking them may prevent sign-in or cause parts of Dropday to stop working as expected.

7. Data retention

We retain account and service information while your account is active and as needed to provide Dropday. The retention period depends on the type of information, why it was collected, whether a club or shared record still needs it, and legal, security, backup, dispute, and fraud-prevention requirements.

When information is deleted, copies may remain temporarily in backups or logs before being removed through normal rotation. We may retain limited records longer when required by law or reasonably necessary to establish, exercise, or defend legal claims.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated access, authorization checks, limited integration credentials, and encrypted connections where supported. No online service can guarantee absolute security, so please use a strong account sign-in method and report suspected unauthorized access to us.

9. Your choices and privacy rights

You can update many account and service preferences in Dropday. Settings let you control categories of email messages, browser notifications, theme, and visual skin. You can also change browser-notification permission in your browser or device settings. Essential account, security, billing, or service notices may still be sent when needed.

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information; object to or restrict processing; or withdraw consent. You may also have the right to appeal a denied request or complain to a privacy regulator.

To make a privacy or account-deletion request, email hello@dropday.app from the address connected to your account. We may need to verify your identity and authority before completing a request. Some information may be exempt from a request or retained where the law allows.

10. Children

Dropday is not directed to children under 13, or under the minimum age required to consent to an online service where they live. We do not knowingly collect personal information from a child who cannot legally use the service. If you believe a child has provided information in violation of this policy, contact us so we can review and delete it as appropriate.

11. International data

Dropday and its service providers may process information in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers and preserve any mandatory privacy rights available to you.

12. Changes and contact

We may update this policy as Dropday, our providers, or privacy law changes. We will post the revised policy here and change the effective date. If an update materially affects how we use personal information, we will provide additional notice when reasonably possible.