Privacy Policy
Anastasiia Fesiuk, an individual based in Ukraine ("we", "us", "our"), is the data controller for the Drop Universe app on iOS and Android and for the website dropuniverse.app. This policy explains what we collect, why, who we share it with and what you can do about it. If you have a question or a request about your data, email support@dropuniverse.app.
1. What we collect
If you create an account: your email address, or the private relay address provided by Sign in with Apple, and an account identifier. You can sign in with a one-time email code, Google, or Apple on Apple devices. We don't use passwords and don't ask Apple or Google for your name.
What you do in the app while signed in:
- the drops you save;
- the brands, characters and other interests you follow;
- your likes and dislikes on drops;
- your notification settings, including quiet hours and your time zone;
- your Premium status.
Automatically, from every install:
- device model and operating system version;
- app version;
- IP address;
- a random identifier for the install;
- a push notification token, if you are signed in and allow notifications;
- usage events: screens viewed, drops opened, saves, follows and shares, store links opened, sign-in and purchase results, notifications opened.
We use this for analytics, to fix problems, to prevent abuse and to deliver notifications. You can object to analytics at any time (section 3).
If you send a request or report a problem:
- the name or note you type;
- the reason you choose;
- the drop or screen it concerns;
- the app version and platform.
Requests and reports are linked to your account if you are signed in, otherwise to a hashed install identifier. Please don't include personal details in notes.
We do not collect your name, postal address, phone number, payment card details, precise location, contacts, photo library or advertising identifiers.
2. How we use it
We use your information to:
- run the service: sign you in, sync what you save and follow between your devices;
- send the notifications you have asked for;
- check whether Premium is active;
- understand how the app is used so we can improve it;
- keep the service secure and fix crashes;
- review the requests and reports you send.
Our legal bases under the GDPR are:
- performance of our contract with you: accounts, sync, notifications, subscriptions;
- our legitimate interest in running, securing and improving the service: analytics, crash reports, abuse prevention, requests and reports;
- legal obligation, where the law requires us to keep records.
You can object to processing based on our legitimate interest at any time by emailing support@dropuniverse.app.
3. Analytics and your choices
We use PostHog to understand how the app is used. Analytics is on for everyone who uses the app. To object, email support@dropuniverse.app. If you are signed in, we will delete the analytics data linked to your account.
Analytics works whether or not you have an account. Without an account, events are linked only to a random identifier for the install. If you sign in, your events from that install are linked to your account identifier. They never include:
- your email address;
- anything you type;
- your location;
- an advertising identifier.
IP-based location is switched off, and our analytics project does not store IP addresses.
We don't show adverts, don't use advertising identifiers and don't track you across other companies' apps or websites. We do not sell personal information.
4. Who we share it with
We share data only with the providers we need to run the service, and we use providers that protect it at least as well as this policy describes. They process it on our instructions. Apple and Google also handle data from their sign-in, store and notification services under their own privacy policies.
- Sign in and account storage: Supabase, plus Google and Apple when you sign in with them. Sign-in codes are emailed through Resend.
- Subscriptions: RevenueCat, the Apple App Store and Google Play. RevenueCat receives your account identifier and purchase receipts. We never see your card details.
- Notifications: Expo, Apple Push Notification service and Firebase Cloud Messaging. They receive your push token and the text of the notification.
- App updates: Expo (EAS Update). When the app checks for an update, Expo receives your IP address, your device platform, the app version and a random identifier for the install created by Expo.
- Analytics: PostHog. It receives the usage events described in section 3.
- Crash reporting: Sentry. If the app crashes, it sends a report with the error, the app version, your device model and operating system, and a random identifier created by Sentry. Reports contain no account data.
- Hosting and photos: Supabase, which also stores the catalogue photos shown in the app. Our website is hosted on Cloudflare.
- Brand logos: Logos provided by Logo.dev. When a logo loads from Logo.dev, it receives your IP address and device information.
We may also disclose information where the law requires it, to protect our rights or someone's safety, or as part of a sale or transfer of the service.
Several of the providers above are in the United States. Transfers from the European Economic Area are covered by the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. Third party websites
Visit Store opens the retailer's website in your browser. Anything you do there is governed by the retailer's own privacy policy, not this one. We don't add tracking or affiliate parameters to these links.
6. How long we keep it
- Account data: until you delete your account. It is then removed from our live systems straight away and from backups within 7 days.
- Analytics events: up to 2 years.
- Crash reports: 90 days.
- Requests and problem reports: 24 months.
- Hashed IP and install identifiers used to prevent abuse: up to 2 days.
- Server request logs, which include IP addresses: up to 7 days at Supabase. Expo keeps its request logs only as long as it needs them to deliver app updates and notifications.
- Record that an account was deleted: 30 days after the deletion is complete, so we can complete and prove each deletion step.
- Subscription records: for as long as tax and accounting law requires.
7. How we keep it safe
Data is transmitted over encrypted connections and stored with providers that hold recognised security certifications. Your sign-in session is kept in your device's secure storage. Access is limited to what is needed to run the service. No internet service is completely secure, so please keep your device and email account safe.
8. Children
The service is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email us and we will delete it.
9. Your rights
Under the GDPR, if you are in the European Economic Area, you can:
- ask for a copy of your personal information;
- ask us to correct or delete it;
- restrict or object to how we use it;
- receive it in a portable form.
To make a request, email support@dropuniverse.app. We respond within 30 days. You can also complain to the data protection authority where you live; in Ukraine, where we are established, that is the Ukrainian Parliament Commissioner for Human Rights. In other regions, including US states with privacy laws, you may have similar rights.
Deleting your account. Open Settings → Delete account in the app, or email support@dropuniverse.app from the address on the account, as described at dropuniverse.app/delete-account. This removes:
- your email address;
- what you save and follow;
- your reactions;
- your notification settings and push tokens;
- your Premium record;
- the requests and reports you sent while signed in.
We also ask RevenueCat and PostHog to delete their records of you; PostHog can take about two weeks. Analytics events from before you signed in that were never linked to an account can't be connected to you and are kept until the end of their retention period.
Your subscription itself is managed by Apple or Google and continues until you cancel it there.
10. Data breaches
If we become aware of a breach that is likely to put your rights at risk, we will investigate promptly, notify the competent authority where required, and tell you if you are likely to be seriously affected.
11. The website
dropuniverse.app hosts this policy, our Terms of Use and a page that explains how to delete your account. When you share a drop from the app, the link opens a page on dropuniverse.app with the drop's name and photo and a link to the app. Messaging apps load that page and photo to show a preview. The website is hosted on Cloudflare, which processes requests to it, including IP addresses, to deliver the pages and protect the site. The website sets no cookies, analytics or advertising trackers.
12. Changes to this policy
We will update this policy when our practices change. The date at the top shows the latest version, and material changes will be announced in the app.
13. Contact
Anastasiia Fesiuk, Ukraine. Email support@dropuniverse.app.