Privacy policy
[OPERATOR: lawyer review] Working draft for the Appdrop product as built. Fill in the operating entity and have it reviewed before production.
1. Who we are
Appdrop is operated by [OPERATOR: legal entity name] ("we", "us"). This policy covers the Appdrop website and app ("the Service").
2. What we never receive
- Your wallet's private key. Your wallet signs in your browser; only signatures and public addresses reach us.
- An email, a password or a social account. A Solana wallet is the only way to sign in. We do not ask for your name or email.
- Any private key at all. No private key is held on our servers. Appdrop's one platform wallet, which receives the platform share of creator fees and signs the buy and burn of $APPD, is signed for by Privy, a third-party key provider. It is not your wallet and holds none of your data.
3. What we collect
- Account: the Solana address you sign in with. The date, version and IP address when you accept the Terms.
- Coins and settings: coins you launch, their metadata and images, launch drafts, your watchlist, pending launch steps and reminders, and records of launches, fee collections, buys and burns with their transaction signatures.
- Optional: issue reports you send.
- Technical: IP addresses for rate limits and abuse prevention, server logs of account actions, limited error diagnostics (never keys or tokens), and one session cookie.
4. How we use it
To sign you in, run the launches you choose, work out and send payouts to app buyers, remind you of a launch step you have not finished, show public coin pages and payout rounds, keep a record of fee collections and burns, prevent abuse, investigate reported problems and record your acceptance of the Terms.
5. Public information
Blockchain transactions are public and permanent. Coin pages and payout rounds show on-chain data to anyone, including which wallets bought a coin in its app and what each was paid. We cannot change or delete on-chain data.
6. Who we share data with
We do not sell, rent or trade personal data. We share only what each provider needs:
- Your wallet provider (Phantom, Solflare or another Wallet Standard wallet): it signs in your browser and sees the transactions you approve
- Railway: hosting and database
- Cloudflare: CDN and DDoS protection (IP addresses and request metadata)
- Solana RPC providers, pump.fun, Jupiter, GMGN and DexScreener: chain and market data and transaction routing (they see wallet and coin addresses, not your account)
- Privy: signs for Appdrop's own platform wallet. It receives no personal data about you from us
- Google Fonts: delivers the fonts to your browser, which exposes your IP address to it
We may disclose information when the law requires it or to protect the Service, its users or the public.
7. Storage and security
Data is stored in a PostgreSQL database hosted on Railway and sent over HTTPS. No storage or transmission is perfectly secure.
8. Retention and your rights
Account data is kept while your account is active or until you ask us to delete it; some launch, fee and Terms records may be kept longer for accounting, security or legal reasons. Sessions expire after 30 days without activity. Depending on where you live you may have rights to access, correct or delete your data: email us. On-chain data cannot be changed. [OPERATOR: lawyer review]
9. Cookies and local storage
One session cookie keeps you signed in. Your browser's local storage keeps preferences such as theme, the last wallet you used and recent coins. No advertising cookies.
10. Children
The Service is not for anyone under the legal age where they live. Contact us if you think a child's data reached us and we will delete it.
11. Changes
We will update the date above when this policy changes.
12. Contact
Privacy questions and deletion requests: [email protected].