We use a random browser ID (a cookie) to support voting, submissions, feedback, views, and click-through counts; this is Personal Information because it can be linked to your device. We also use limited anti-abuse signals, including hashed IP-derived values, to keep votes and submission queues fair. For URL submissions, we retain your IP address along with your confirmation that the material is public and that you have the right to share it. If you sign in to follow projects, your account is handled by our sign-in provider and we collect your name and email address along with other profile details needed to power follows, notifications, and creator features.

The information we collect falls into two main groups: (1) account information you provide directly (name and email), and (2) technical and usage data we collect automatically when you use the Site (including device identifiers, IP addresses or hashed values derived from them, and activity records). All of this is Personal Information under this policy.

• Browser ID. When you vote, submit a build, send feedback, open a listing, or click through to a project, we set a cookie with a random ID. This is Personal Information because it identifies your browser and can be linked to your activity on the Site. We collect it automatically. It lasts up to two years. We use it to remember your vote state, limit abuse, and count activity.
• Anti-abuse data. For actions like votes, submissions, and feedback, we automatically collect basic request information (such as timestamps and request headers) to rate-limit spam and prevent repeat abuse. Votes may retain a keyed, one-way hash derived from your IP address for network-level deduplication. Although this value is pseudonymized, it is still Personal Information because it is derived from an identifier that can be linked to you. We retain anti-abuse data for as long as the associated vote or submission record exists. We do not use it to build a profile of you for advertising or marketing.
• Submission records. When you submit a URL, we collect and store your IP address, the URL, the date and time, and the version of the Terms you accepted. This is Personal Information collected automatically at the time of submission. We retain this record for as long as the submission exists in our database, and we use it to document your confirmation that the URL and its contents are public and that you have the right to share them, as well as to investigate abuse or respond to legal complaints.
• Directory activity. We automatically collect records of which listings were voted for, viewed, or clicked through to, along with submitted URLs and feedback messages. Links shared in Dropday’s own social posts may include a campaign identifier so we can count how many unique browsers followed that particular post. This activity data is linked to your browser ID (and to your account if you sign in), making it Personal Information. We retain it for as long as your browser ID or account exists.
• Display preferences. Dark/light theme and card layout live in your browser’s local storage. They never leave your device unless you clear them.
• Account data. Sign-in is optional. If you create an account, we collect your name and email address directly from you (or from your authentication provider). Our third-party authentication provider, Clerk, handles credentials and sessions and sets its own cookies that are needed to keep you signed in. We also keep a local profile record that may include your avatar and connected social handles when available, so we can support following, notifications, and creator ownership features. All of this is Personal Information. We retain account data until you delete your account or ask us to delete it.
• Watches and notifications. If you watch projects, we store those follows and the notifications generated for your account. This is Personal Information linked to your account. We retain it until you unfollow or delete your account.
• Email preferences and communications. If you opt into a Dropday digest or other communications, we store your chosen frequency and use your account email (or, if you sign up without an account, the email address you give us) to send messages through our third-party email provider, Resend. Signing up without an account sends a confirmation email first, and nothing else is sent until you confirm. This is Personal Information. Every digest includes a one-click unsubscribe link. We retain your preferences until you unsubscribe or delete your account.
• Public creator and project information. We index public names, handles, profile images, posts, project pages, and related source links to create directory listings. If that information is inaccurate, you can use the feedback form; we will attempt corrections or removals on a best-effort basis.
• AI-assisted directory metadata. On a best-effort basis, public pages, posts, images, videos, and related sources may be analyzed by AI services to draft descriptions and tags, infer maker or model credits, capture shared prompts, and otherwise populate listing metadata. AI systems can misread material, omit context, invent facts (“hallucinate”), or attribute work incorrectly, so this metadata can be incomplete, outdated, or wrong. Where we surface AI-generated or inferred fields, we disclose that on listing and creator pages. Send feedback through the feedback form if something looks off; we will attempt to correct it on a best-effort basis and do not guarantee every report will result in a change.
• Aggregate analytics. We use Vercel Web Analytics and Speed Insights to count page views and measure performance. They are cookieless, set nothing on your device, and do not track you across other sites.
• Server logs. Our third-party host, Vercel, automatically logs IP addresses, browser type, and request paths for security and reliability. These logs are Personal Information. Vercel retains server logs in accordance with its own data retention practices; we do not control the retention period for logs held by Vercel.

We do not collect payment info or precise location. We do not handle account passwords ourselves, and browsing does not require an account or email address. We do not run Google Analytics, Meta Pixel, or any advertising trackers of our own, and we do not sell your data. The only third-party code that runs in your browser comes from the video and post embeds described below.

New listing images remain at their public source URLs rather than being copied into Dropday storage. Historical listings may still reference previously stored display images while those records are transitioned. When a source image or embed loads, your browser talks directly to that source or platform. It can see your IP address and browser details and may set its own cookies under its own privacy policy. Dropday requests images without sending the page referrer.

• YouTube. We use the privacy-enhanced player (youtube-nocookie.com), which is designed not to set cookies unless you press play. Video thumbnails also load from YouTube’s image servers.
• X (Twitter). Listings sourced from X can show the original post or its video via X’s official embed, which loads X’s widget script in your browser. We request these embeds with X’s “Do Not Track” option, which tells X not to use your visit for ad personalization. If the widget cannot load (for example, if your browser or an extension blocks it) we show a plain link to the post instead, and the rest of the site works normally.
• Vimeo and Loom. Some demo videos play through Vimeo’s or Loom’s official player.

Voting needs a stable anonymous ID so one person cannot spam votes. Trending needs rough engagement counts. Follows and notifications need an account so they can stay with you across devices.

Retention periods vary by data type:

• Browser ID cookies expire after two years unless you clear them sooner.
• Submission records (including IP addresses) are retained for as long as the submission exists.
• Account data is retained until you delete your account.
• Anti-abuse data is retained for as long as the associated record exists.
• Votes, views, click-throughs, follows, and feedback are retained until we delete them or you request deletion.
• Server logs held by Vercel are retained according to Vercel’s policies.

Subject to your compliance with our Terms of Service, you have the following choices with respect to your use of the Site:

• Use Cookie settings to accept, reject, or change optional analytics and external-media choices at any time. Rejecting optional services does not limit core site features.
• Clear Dropday’s cookies or site data in your browser settings to remove the anonymous ID.
• Block third-party embeds (for example, with a content blocker), in which case listings fall back to a link to the original video or post, and everything else keeps working.
• Use our feedback form or email us as described in the “Contact us” section below to ask what Personal Information we have about you (including data linked to your device or account), request a copy of it, request correction, or request deletion. We will respond to verifiable requests within a reasonable time.

We do not sell Personal Information. Embedded platforms such as X run their own code in your browser and may use what they collect under their own privacy policies, including for advertising; turning off external media keeps those embeds from loading. We do share Personal Information with service providers (like our hosting provider, authentication provider, and email provider) as necessary to operate the Site; these providers process data on our behalf and are contractually required to protect it. We treat a browser Global Privacy Control signal as a request to keep optional services off unless you make a different choice here.

The Site runs on Vercel (hosting), uses hosted Postgres (database), Clerk (authentication), and Resend (email). Google, xAI, and OpenAI services may process public source material or derived directory metadata for AI-assisted discovery, classification, and search. These service providers may have access to Personal Information as necessary to perform their services. Data may be processed or stored in the United States. By using the Site, you consent to the transfer of your information to the United States, which may have different data protection laws than your country of residence.

Dropday is not directed to children under 13, and we do not knowingly collect Personal Information from anyone under 13. If you believe a child under 13 has created an account or otherwise provided Personal Information to us, please contact us at the email in the “Contact us” section below so we can delete it promptly. If we learn that we have collected Personal Information from a child under 13, we will delete that information as quickly as possible.

We use reasonable administrative, technical, and organizational measures designed to protect the information we hold. No method of transmission over the Internet or method of electronic storage is completely secure, so we cannot guarantee absolute security.

We may update this page as the site evolves. The date at the top shows when it last changed.

If you have questions about this policy or how we handle your information, or want to exercise any of the choices described above, email us at legal@dropday.ai or use our feedback form. We will do our best to respond promptly.