Dropack Privacy Policy
Draft for review — not yet published.
Effective date: September 30, 2026
This Privacy Policy explains how Dropack handles personal information when you create an account, publish a creator page, visit shared resources or contact us. It covers creators and visitors, including visitors without an account.
1. Who is responsible for your information
Dropack is operated by TOKEN DYNAMICS INC, with an address at 1500 N GRANT ST STE R, DENVER, CO 80203, United States. This entity is responsible for the processing described in this Policy. Creators and external providers also have responsibilities for their own processing, as explained below.
Privacy contact: [email protected]
2. Information we handle
We handle information you provide when registering, publishing content or contacting us, together with interaction information used for engagement statistics.
| Category | Information and source | Purpose |
|---|---|---|
| Account information | Your name, first and last name, email address, verification status, account identifier and timestamps. For email and password registration, we store a password hash. | Create and administer your account, verify access and communicate about the service. |
| Google sign-in | Your Google account identifier, email address and verification status, name, given and family names, profile image, and authentication tokens and related expiry information returned during sign-in. | Authenticate you and associate your Google sign-in with your Dropack account. |
| Profile and resource content | Your username, profile name and image, biography, tutorials, prompts, workflows, uploads and links, plus contact details you enter for publication. | Provide creator pages, resource publishing and sharing. |
| Interaction information | Page views, page and article shares, article and social link clicks, invitation clicks, the associated creator or resource, timestamps and traffic source labels derived from referral information or source parameters. | Provide engagement statistics and understand how resources are used. |
| Registration and session information | Country information supplied in request headers, device category inferred from the browser user-agent, an inviter identifier where applicable, and session information including IP address and user-agent when available. | Administer registration, invitations, authentication and account security. |
| Creator form submissions | Answers you submit to a creator's form, including email address, phone number or other requested details where provided, submission time and an IP-derived hash used to limit abuse. | Deliver your submission to the creator and prevent repeated or abusive submissions. |
| Communications and reports | Information you send in support requests, privacy requests, reports or appeals, including contact details and supporting material. | Respond, investigate issues and maintain appropriate records. |
We process IP addresses and browser information for authentication and abuse prevention. Article and link analytics event records do not themselves contain a visitor account identifier, raw IP address or device information. Sign-in sessions and abuse-prevention records are separate from these analytics records.
Dropack is currently free during beta testing and does not charge subscription fees. Before introducing paid offerings, we will update this Policy to describe any payment-related information processing.
Do not include information about other people in public content unless you have an appropriate right to share it. Avoid publishing sensitive personal information or material you intend to keep confidential.
3. Why we use information
We use information to provide accounts and published pages, authenticate users, deliver engagement statistics and creator form submissions, attribute invitations, remember language preferences, maintain the service, respond to requests, detect misuse and meet applicable legal obligations.
We currently use personal information only for the service purposes described in this Policy. We do not use it for additional purposes such as marketing campaigns, advertising or AI model training. Before introducing an additional use, we will update this Policy, provide any required notice and obtain consent where required by law.
Where the GDPR or UK GDPR applies, the legal basis depends on the purpose and circumstances of the processing:
- Contract: account administration and service delivery that are necessary to perform our agreement with a creator.
- Legitimate interests: proportionate security, fraud prevention, troubleshooting and responding to inquiries, and limited engagement measurement where lawful without consent and where our interests are not overridden by your rights. These interests are keeping Dropack secure, operating a reliable service and helping creators understand use of their resources.
- Consent: where a particular activity requires your consent, we will request it before beginning that activity. You may withdraw consent without affecting the lawfulness of earlier processing.
- Legal obligation: processing necessary to comply with applicable recordkeeping duties, valid legal orders or other legal requirements.
Email and password registration requires your name, email address and password; the application stores name components as first and last name. Google sign-in uses the identity information described above. Without the information needed for authentication, we cannot provide an account. Public contact details are optional. Creator forms indicate which answers are required.
4. Public pages and creator statistics
Your registration email address, password hash and authentication tokens are not exposed through your public creator profile. Public profiles include your username and account name, and use your account image if you have not supplied a separate profile avatar. This can include a name or image originally received through Google sign-in.
Creators can separately enter an optional contact email for public display. Your registration email is not automatically used as that public contact email. Published resources and profile information may be accessed, indexed or copied by others. Removing content does not necessarily remove copies held by third parties.
Creators receive aggregate engagement reports, including counts, date-based trends and traffic source categories. Analytics event records identify the creator and relevant resource, not the visitor's account. These reports do not provide a list of visitors' registration emails or account identities.
When you submit a creator's form, that creator can view your answers, any submitted email address and the submission time. Form responses are distinct from aggregate analytics. Only submit information you intend to share with the creator. Creators are responsible for explaining their independent use of submitted information.
Uploaded media are served through public asset URLs. Do not upload confidential files: an uploaded file may remain accessible to someone with its URL even if it is not currently displayed on a published page.
5. Cookies and similar technologies
Dropack uses cookies and browser session storage for authentication, preferences, invitation attribution and avoiding duplicate article click counts. Dropack does not currently use advertising tracking technologies.
| Technology | Purpose | Duration in the current implementation |
|---|---|---|
| Authentication cookies | Maintain your signed-in session and protect the sign-in flow. | The main session cookie defaults to seven days and may renew with use; browser-session and shorter-lived sign-in cookies may also be used. |
| Language preference cookie | Remember the display language you select. | Up to one year after it is set. |
| Invitation referral cookie | Carry the referring creator's username through registration and Google sign-in. | Up to seven days; cleared by the post-sign-in continuation flow. |
| Article click marker in session storage | Avoid counting the same article click repeatedly within a browser tab session. | The browser tab session. |
You can manage cookies and site storage through your browser. Blocking authentication cookies can prevent sign-in; clearing preference or invitation cookies removes the associated preference or attribution information.
Google sign-in, third-party embeds and linked websites have their own privacy and cookie practices. Embedded content can connect your browser to another provider when loaded. Please review the Google Privacy Policy and the relevant external provider's privacy information.
If we introduce advertising tracking or change the purposes of these technologies, we will update this Policy and obtain consent where legally required.
6. Who receives information
We disclose information only for the purposes described in this Policy and as permitted by applicable law. Relevant recipients include:
- Visitors and creators: public profile and resource information, aggregate statistics, and responses you submit to a creator, as described above.
- Infrastructure providers: Cloudflare, including R2 for uploaded files, and Amazon Web Services (AWS) provide infrastructure supporting Dropack. These providers process information to deliver the services we use.
- Email delivery provider: Resend processes recipient email addresses and message content to send account verification and password reset emails.
- Sign-in provider: Google provides authentication and processes information associated with Google sign-in under its own privacy policy.
- Professional advisers and authorities: where necessary to obtain advice, comply with law or a valid legal request, establish or defend legal claims, or address fraud or safety risks.
- Parties to a business transaction: where information is lawfully involved in a merger, acquisition, financing or transfer of the business, subject to appropriate confidentiality and applicable notice requirements.
We do not sell your personal information or provide it to third parties for advertising or other unrelated commercial uses. This does not prevent the service-related processing, user-directed publication or legally necessary disclosures described above.
7. International processing
Dropack is operated by a United States company and uses the service providers identified in this Policy. Depending on where you live and where the relevant services operate, processing your information may involve transfers outside your country. Data protection laws may differ between countries.
You can contact [email protected] with questions about where your information is processed and the arrangements applicable to a particular transfer. This Policy does not ask you to waive any rights or protections that apply to international transfers.
8. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to applicable legal requirements. There is no single retention period for all information.
When determining retention periods, we consider the type and sensitivity of the information, whether it is needed to provide your account and published resources, the purposes of engagement statistics, form submissions, session security and support records, and any applicable accounting, recordkeeping or legal claims requirements.
To request account closure or deletion of your information, email our support team. We review requests and delete or anonymize information as required by applicable law, subject to lawful exceptions. Limited records may be retained where necessary to comply with legal obligations, resolve disputes, prevent fraud or establish or defend legal claims. Backup copies may remain until removed through the applicable backup cycle, subject to these same retention limits.
You can request deletion or ask about retention of your information by emailing [email protected].
9. Your choices and rights
Depending on where you live and the applicable law, you may have rights to access or obtain a copy of information, correct it, request deletion, restrict processing, object to processing or receive certain information in a portable format. Where processing relies on consent, you may withdraw it. If direct marketing is introduced in the future, you will have the right to object where applicable.
To submit a request or request account deletion, contact [email protected]. We may request information reasonably necessary to verify your identity or an authorized representative's authority. We will respond within the time required by applicable law and explain any lawful restriction on fulfilling a request.
You may complain to the relevant data protection authority, including your local supervisory authority where GDPR or UK GDPR rights apply.
10. Security
Our application uses password hashing for email and password accounts, email verification, authenticated access checks for account management, ownership checks for creator form responses, and limits on repeated analytics requests and form submissions. Authentication cookies are configured to prevent access by page scripts and to be sent over secure connections when the service is configured with HTTPS.
No online service can guarantee absolute security. Keep your sign-in credentials secure and report suspected unauthorized access through [email protected].
11. Children
Account eligibility follows the local minimum age requirements described in our Terms of Service. Where a feature is designated for adults, you must be at least 18 to use it. Users must obtain any parental or guardian consent required by applicable law before using the service. These eligibility rules also apply to registration through Google.
If you believe a child has provided information that Dropack is not permitted to process, contact our privacy contact so we can investigate and take appropriate action.
12. Changes and contact
We may update this Policy when our practices or legal obligations change. We will update the effective date and provide additional notice of material changes as required by law. If a new use requires consent, we will request it separately.
Operator: TOKEN DYNAMICS INC
Address: 1500 N GRANT ST STE R, DENVER, CO 80203, United States
Privacy inquiries and requests: [email protected]