Drop: Privacy Policy

Version 2.0 · Effective September 3, 2026 · Last updated September 3, 2026

Drop ("Drop," the "App," the "Service") is operated by Ethan Yueh-Lin Yang, an individual based in the Commonwealth of Massachusetts, United States ("we," "us," or "our"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, the choices you have, and the rights you may have under applicable law.

This Policy is part of, and is incorporated by reference into, our Terms of Service. By creating an account or using the App, you acknowledge that you have read and understood this Policy. If you do not agree with it, do not use the Service.

A note on our approach. Drop is intentionally minimal in the data it collects. We do not sell your personal information, we do not serve third-party advertising, we do not use advertising identifiers, and we do not track you across other companies' apps or websites. We built Drop this way on purpose.

1. Who this Service is for (age requirement)

Drop is offered only to individuals who are 18 years of age or older and who hold a valid, verified Brandeis University @brandeis.edu email address. The Service is not directed to, and is not intended for, anyone under the age of 18, and we do not knowingly collect personal information from anyone under 18. See Section 11 (Children and Minors) for details.

2. Information we collect

We collect only the information we need to operate Drop. The categories below reflect how the App actually works.

2.1 Information you provide

• Account and identity. Your Brandeis @brandeis.edu email address, which we verify by sending a one-time code. We use your email to confirm you are a member of the Brandeis community and to sign you in. Authentication is handled through our infrastructure provider (see Section 4).
• Date of birth. We collect your date of birth for the sole purpose of verifying that you are 18 or older. We store the fact of age eligibility and your date of birth on your profile record.
• Profile information. Your display name, username, and, where you choose to provide them, a profile photo/avatar, a short bio, an Instagram handle, your gender, your interests, and your general availability. Much of this is optional and is provided at your discretion.
• Content you create ("User Content"). Plans you create (which we call "drops"), including the title, category, the campus spot or place you select, the start and end time, capacity, description, and any emoji; your RSVPs to drops; messages you send within a drop; comments you post on events; pings you send; and any reports you submit about other users or content.
• Communications with us. If you contact us for support or to make a privacy request, we collect the information you include in that communication.

2.2 Information collected automatically

• Location you choose to share. When you create a drop or a ping, you select a named campus spot or place. That chosen location is associated with the drop or ping so other eligible users can find it. Drop does not continuously track your device's location and does not run location tracking in the background. If the App shows your position on a map (for example, a "locate me" control), it accesses your device location only while the App is in use and only with your operating-system permission, to display the map to you; it is not used to follow or profile you.
• Live location shared with friends (foreground only). Drop includes optional features that let your accepted friends see your location on the campus map while you have the App open, and that can notify you and a friend when the two of you are near each other on campus. These features use your device location only while the App is in the foreground, only with your operating-system permission, and never in the background. You stay in control: you can choose which friends can see your location, turn location sharing off inside the App, and disable location access entirely in your device settings at any time.
• Push notification token. If you enable notifications, we store a push token issued by the Apple Push Notification service (via our notifications provider) so we can deliver alerts such as new plans, RSVPs, and reminders. You may turn notifications off at any time in your device settings; the App remains usable without them.
• Usage and device information. We collect a limited set of first-party analytics about how the App is used, for example, in-app events (such as opening a screen or creating a drop), the app version, and basic device and technical information. We use this only to operate, secure, and improve Drop. These analytics are first-party and are not used to track you across other apps or services.

2.3 Information we do not collect

We do not collect your device's advertising identifier, we do not use third-party advertising or cross-app tracking SDKs, and we do not knowingly collect special categories of sensitive data beyond what is described above. We do not access your contacts, photos, camera, or microphone except where you actively choose to use a feature that requires it (for example, selecting a photo to upload as your avatar), and then only for that purpose.

3. How we use your information

We use the information described above to:

• create and maintain your account and verify your eligibility (18+ and a valid Brandeis email);
• operate the core Service: show you relevant plans, let you create and join drops, send and receive pings, build your friends list, and display maps of campus spots;
• deliver push notifications you have enabled;
• keep the community safe: operate our content filter, process reports, enforce blocks, and detect, prevent, and respond to fraud, abuse, harassment, violations of our Terms or Community Guidelines, and threats to safety;
• provide customer support and respond to your requests;
• understand and improve how the App is used, and develop new features, using first-party analytics;
• maintain the security and integrity of the Service; and
• comply with legal obligations and enforce our agreements.

We rely on the following legal bases where the GDPR or similar laws apply: performance of our contract with you (to provide the Service you request), our legitimate interests (to secure, maintain, and improve the Service and keep the community safe), your consent (for example, for push notifications or optional profile fields), and compliance with legal obligations.

4. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described here:

• With service providers (processors) who operate the Service for us. These providers process data on our behalf, under contract, and are not permitted to use it for their own purposes:
• Supabase: our database, authentication, and file-storage provider, which hosts your account and App data.
• Expo and the Apple Push Notification service (APNs): used to deliver push notifications to your device.
• Apple MapKit: used to render maps within the App. We chose Apple's native maps in part to avoid third-party map-tracking telemetry.
• With other users, as directed by you. Your profile and the content you create are visible to other eligible users according to the visibility settings you select (for example, whether a drop is public, limited to friends, or otherwise restricted). Please be thoughtful about what you post and share.
• For legal, safety, and security reasons. We may disclose information if we believe in good faith that it is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms, Community Guidelines, or other agreements; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of Drop, our users, or the public.
• In connection with a business transfer. If Drop is involved in a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, information may be transferred as part of that transaction, subject to this Policy.
• With your consent or at your direction, for any other purpose disclosed at the time.

We do not transmit your personal information to third-party artificial-intelligence services for their own model training or other independent use. If this ever changes, we will update this Policy and, where required, obtain your consent.

5. How long we keep information

We keep your personal information for as long as your account is active and as needed to provide the Service. When you delete your account (see Section 6), we delete or de-identify your personal information as described below, except where we are permitted or required to retain certain information, for example, to comply with legal obligations, resolve disputes, enforce our agreements, or maintain the safety and integrity of the community (such as retaining a limited, de-identified record needed to enforce a ban and prevent a removed user from re-registering). Residual copies in routine backups are purged on our regular backup cycle.

6. Your choices and how to delete your account

• Access and edit. You can view and edit much of your profile information directly in the App.
• Delete your account in the App. Drop provides in-app account deletion. When you delete your account, we permanently disable your login, end your active sessions, delete content associated with your account (including your photos, the drops you hosted, your messages, RSVPs, saved places, and notifications), and replace your profile with an anonymized placeholder. This action is permanent and cannot be undone. You may also request deletion by emailing us at support@dropitnow.app.
• Push notifications. You can enable or disable notifications at any time in your device's settings.
• Location. You can grant or revoke the App's access to your device location at any time in your device's settings. Drop remains usable without location access.

7. Security

We take reasonable administrative, technical, and physical measures designed to protect your information, including encryption of data in transit (TLS) and encryption of data at rest through our infrastructure provider, access controls, and row-level security on our database. Consistent with Massachusetts law (201 CMR 17.00), we maintain safeguards appropriate to the personal information we handle. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your device and email account secure, since access to your email can be used to sign in to Drop.

8. Your privacy rights (U.S. states)

Depending on where you live, you may have rights under state privacy laws, such as the right to know or access the personal information we hold about you, to correct it, to delete it, to obtain a copy (portability), and to not be discriminated against for exercising these rights. Because Drop does not sell personal information, does not share it for cross-context behavioral advertising, and does not use it for profiling that produces legal or similarly significant effects, certain opt-out rights may not apply.

We honor access, correction, and deletion requests regardless of your state of residence as a matter of practice. To make a request, email support@dropitnow.app. We will verify your request by reference to your account (for example, by confirming control of your registered email) before acting on it. You may use an authorized agent where the law allows; we may still require verification. We will respond within the timeframes required by applicable law.

Note on applicability: Comprehensive state privacy laws (such as the California Consumer Privacy Act) generally apply only to businesses that meet certain revenue or data-volume thresholds. As a small, free service, Drop likely falls below these thresholds; we nonetheless extend the core rights above voluntarily.

9. Users outside the United States

Drop is intended for members of the Brandeis University community in the United States, and we do not target or offer the Service to individuals in the European Economic Area, the United Kingdom, or other regions outside the United States. The Service is hosted in the United States, and any information you provide is processed there. If you access Drop from outside the United States, you do so on your own initiative and are responsible for compliance with local law. If you are located in the EEA or UK and believe the GDPR applies to your use, you may contact us at support@dropitnow.app to exercise applicable rights, including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.

10. Third-party services and links

Drop relies on the third-party providers named in Section 4 and may contain links to third-party content (for example, an Instagram handle you add to your profile). We are not responsible for the privacy practices of third parties. This Policy applies only to Drop. We encourage you to review the privacy policies of any third-party services you access.

11. Children and minors

Drop is for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and we never knowingly collect personal information from children under 13 (as defined by the U.S. Children's Online Privacy Protection Act). If we learn that we have collected personal information from someone under 18, we will terminate the account and delete the information. If you believe a minor has provided us with personal information, please contact us at support@dropitnow.app. See our separate Minimum Age Policy for more detail.

12. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will revise the "Version" and "Last updated" dates above and provide notice through the App, which may include requiring you to review and accept the updated Policy before continuing to use Drop. Your continued use of the Service after an update becomes effective constitutes acceptance of the revised Policy, to the extent permitted by law.

13. Contact us

If you have questions about this Policy or your information, contact:

Ethan Yueh-Lin Yang (operator of Drop) Email: support@dropitnow.app Mailing address: 45 Moody Street, Apartment B212, Waltham, MA 02453

About this document. We may update this document from time to time. When we do, we will post the revised version and update the dates shown above. Questions are welcome at support@dropitnow.app.