Privacy Policy

Effective November 10, 2026

DROPNAUT ("DROPNAUT", "we", "us") runs dropnaut.com and the DROPNAUT CONNECT app for Shopify. This policy explains what information we collect, why, who we share it with and the choices you have. We wrote it in plain language. If anything is unclear, email privacy@dropnaut.com.

1. Information we collect

Information you give us

• Account details: your email address, password (stored only in scrambled, "hashed" form by our login provider), username, display name and profile picture. Brands also give their brand name, handle, bio, links, logo, colors and fonts.
• What you post or send: photos, videos, captions, announcements, rewards, survey questions and answers, return or cancellation reasons and notes, and messages you send us.
• Bug reports: what you write, where in the app it happened, and any screenshots you attach.
• Reports and blocks: when you report a post or brand, the reason and anything you add (the brand isn't told who reported it), and the brands you block.

Information created when you use DROPNAUT

• Activity: the brands you subscribe to, posts you view, like or save, folders, surveys you answer, rewards you redeem, and your stars, credits, levels and XP.
• Store visits: when you tap through from DROPNAUT to a brand's store, so the brand gets credit for the visit and your purchase can earn rewards.
• Your choices: which brands you get notifications from, and which brands' newsletters you've turned on.
• Coupons: the codes you redeem, when they expire, and whether they were used, refunded or locked.

Your private calendar link

If you add your saved events to Google Calendar or another calendar app, we create a private link to a feed of those events. Your calendar app reads the feed from us. Anyone who has the link can see the events in it, so keep it to yourself. You can reset it at any time in Saved, which stops the old link working.

Information from Shopify stores (DROPNAUT orders only)

When you buy from a brand's Shopify store with a DROPNAUT code or link, the brand's store tells DROPNAUT CONNECT about that order so we can give you rewards and track it. We receive and keep:

• the order number, items and quantities, subtotal and currency
• whether it was paid, shipped, delivered, returned, canceled or refunded
• the carrier, tracking number and shipping dates
• the city, state/region and country it ships from and to (to show it on the map)

We do not receive or keep your name, street address, phone number or payment card details from these orders. Payments happen entirely on the brand's own store.

For brands using DROPNAUT CONNECT

Billing for DROPNAUT CONNECT goes through Shopify. We see your plan, your spending limit, what we've billed and whether a payment went through, but never your card or bank details. We also keep the kickback ledger for orders made through DROPNAUT, and return and cancellation requests for those orders.

Information stored on your device

We save a few things in your browser's local storage so the app works smoothly: your login (so you stay signed in), the email you last signed in with, where you were in the app, and settings like recent searches. We don't use advertising or tracking cookies.

Technical information

Our hosting and database providers automatically log basic technical information, such as IP addresses, browser type and error details, to keep the service running and secure.

2. How we use it

• To run your account and show you brands, posts, rewards and orders.
• To award, track and, when an order is refunded, returned or canceled, take back stars, credits, XP and rewards.
• To create coupon codes in brands' Shopify stores, and to switch them off or on (for example while your star balance is below 0).
• To send return and cancellation requests to the brand you bought from.
• For brands: to calculate and bill kickbacks, manage spending limits and show your stats.
• To send you sign-up codes, password resets and important service messages.
• To count post views and store visits, so brands can see how their page is doing.
• To keep DROPNAUT safe, prevent fraud and abuse, and fix problems (including the bug reports you send).
• To follow the law.

3. Who we share it with

• Brands you interact with. A brand sees activity on its own page, such as likes, saves, subscriber counts, survey answers and level leaderboards (which show your username and display name). It also sees orders and return or cancellation requests made through DROPNAUT for its store, and coupons redeemed for its rewards.
• Brands whose newsletter you turn on. When you turn on a brand's bell, that brand gets your email address to send you drops, sales and news. From then on, the brand's own privacy policy also covers how it uses your email. Turning the bell off removes you from the brand's list in DROPNAUT, but a brand may already have saved a copy, so use the unsubscribe link in its emails too.
• Other users. Your username, display name, profile picture and level may appear on brand pages and leaderboards.
• Service providers that run DROPNAUT for us and may only use your information to do that:
  • Supabase: database, logins and file storage
  • Cloudflare: website hosting and the DROPNAUT CONNECT app
  • Shopify: brands' stores, discount codes, order information, returns and billing
  • Google Workspace: our email
  • Our email-delivery provider: sign-up codes and service emails
  • Open-Meteo: turns a city name into map coordinates (it only receives the city name)
• Legal reasons. We may share information if the law requires it, or to protect the rights, property or safety of DROPNAUT, our users or others.
• Business changes. If DROPNAUT is merged, sold or reorganized, your information may move with it, still protected by this policy.

We do not sell your personal information, and we do not share it for targeted advertising.

4. How long we keep it

We keep your information while your account is open. When you delete your account (Account, Delete account), your account and what's tied to it are deleted right away, and any remaining copies, such as backups, are deleted or anonymized within 30 days. The exceptions are records we must keep for billing, tax, fraud prevention or legal reasons (such as kickback and order records), which we keep only as long as needed. Brands' Shopify order details are removed when Shopify asks us to remove them.

5. Your choices and rights

You can update most of your information in the app, and delete your account yourself under Account, Delete account (you'll enter your password to confirm). You can also email privacy@dropnaut.com to:

• get a copy of your information
• correct it
• delete your account and information
• object to or limit how we use it

We'll answer within 30 days (45 days where the law allows). We may need to confirm it's really you first. We won't treat you differently for using your rights.

California residents

California law (including the CCPA as amended by the CPRA, and CalOPPA) gives you the right to know what personal information we collect, use and share; to delete it; to correct it; and to opt out of its sale or sharing. We don't sell or share personal information for cross-context advertising, so there's nothing to opt out of. You can use your rights yourself or through an authorized agent by emailing privacy@dropnaut.com. Under California's "Shine the Light" law, we don't share personal information with third parties for their own marketing.

Europe, the UK and Canada

If you're in the European Economic Area, the United Kingdom or Canada, you also have the right to restrict processing, to data portability, and to withdraw consent at any time. We use your information to provide the service you signed up for (performing our contract with you), for our legitimate interests in keeping DROPNAUT safe and working, and to meet legal obligations. Our providers may store information in the United States and other countries, with appropriate safeguards. You can also complain to your local data protection authority.

Do Not Track

We don't track you across other websites, so we treat every visit the same whether or not your browser sends a "Do Not Track" signal.

6. Children

DROPNAUT is for people 13 and older. We don't knowingly collect information from children under 13. If you believe a child under 13 has an account, email privacy@dropnaut.com and we'll delete it.

7. Security

We use encryption in transit (HTTPS), hashed passwords, access controls on our database, and keep secret keys out of the app. No service is perfectly secure, but we work hard to protect your information and will tell you if a breach affects you, as the law requires.

8. Changes to this policy

We may update this policy as DROPNAUT changes. We'll update the date at the top, and for important changes we'll let you know in the app or by email before they take effect.

9. Contact us

Privacy questions or requests: privacy@dropnaut.com
Everything else: hello@dropnaut.com
DROPNAUT · California, USA