Privacy Policy

Last updated: October 18, 2026

This Privacy Policy explains how Droply ("we", "us", or "our") collects, uses, and protects information when you use droply.so (the "Service"). We take your privacy seriously.

1. Information We Collect

Information you provide

• Account data — your email address, your name if you add it, a hashed password if you set one, or your Google sign-in if you use it. API keys are stored hashed.
• Uploaded content — the files you upload to the Service (HTML, ZIP, images, etc.).
• Payment information — processed by Stripe. We do not store your full card details.
• Communications — messages you send us through the contact page or by email.
• Abuse reports — if you report a project, the link, your description and (optionally) your email address.

AI apps and the API

If you connect an AI app (such as Claude or ChatGPT) to your Droply account, or use our API, we receive the requests sent on your behalf: the content to publish, project names and settings. We do not receive your conversations with the AI app, only what it sends to Droply. The AI app receives the results of its requests, such as project links, names and visit counts. You can disconnect AI apps at any time under Account in your dashboard.

Information collected automatically

• Usage data — page views, feature interactions, and visit counts for your hosted sites.
• Log data — IP addresses, browser type, referring URLs, and timestamps when you access the Service. IP addresses are also used briefly (up to 24 hours) to enforce rate limits, stop password guessing on protected projects and prevent abuse.
• Cookies — small files used for authentication sessions and preferences. We do not use advertising cookies.

2. How We Use Your Information

We use collected information to:

• Provide, operate, and improve the Service.
• Authenticate users and maintain account security.
• Process payments and manage subscriptions.
• Display analytics about your hosted sites (paid plans).
• Send transactional emails (password resets, billing receipts).
• Respond to support requests.
• Detect and remove spam, phishing, malware and other abuse.
• Comply with legal obligations.

We do not sell your personal data to third parties. Ever.

3. Data Sharing

We share data only with the following third parties, solely to operate the Service:

• Supabase — authentication and database hosting.
• Cloudflare R2 — file storage and CDN delivery.
• Stripe — payment processing.
• Google — OAuth sign-in (if you choose to sign in with Google).
• Hetzner — server infrastructure.
• Resend — sending sign-in links and account emails.
• AI apps you connect — only the results of the requests they make on your behalf, and only while connected.

Each of these providers has their own privacy practices which we encourage you to review.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it by law (e.g. billing records for tax purposes, retained for 5 years).

Uploaded files are deleted within 14 days of account deletion or site removal.

5. Security

We use industry-standard security measures including HTTPS/TLS encryption, hashed passwords, and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. We will notify you promptly if we become aware of a breach affecting your data.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Data portability (receive your data in a machine-readable format).

To exercise any of these rights, please use our help page. We will respond within 30 days.

7. Children

The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

8. Cookies

We use strictly necessary cookies for authentication and session management. We do not use tracking or advertising cookies. You can disable cookies in your browser settings, but this may prevent you from using certain features of the Service.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a notice on the Service at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

10. Contact

Questions or concerns about your privacy? Contact us at droply.so/contact.