PRIVACY

This Privacy Policy describes how Introgy LLC, a Delaware limited liability company with its registered address at 16192 Coastal Highway, Lewes, Delaware 19958, United States (“Introgy”, “we”, “us”, “our”), operator of thedrop.games, collects, uses, discloses, and safeguards personal information when you use thedrop.games, its subdomains, APIs, and related features (the “Platform”). This Policy is a companion to ourTerms & Conditions.

Data controller. Unless stated otherwise for a specific feature, Introgy LLC is the data controller for personal information processed through the Platform. For payment information submitted to Stripe, Stripe is an independent controller with respect to the payment instrument itself.

1. Plain-English Summary

• We collect what we need to run the Platform — Account identity (handle, email, hashed password), gameplay, payment confirmations from Stripe, and basic technical telemetry.
• We use third-party subprocessors (Cloudflare, Stripe, Anthropic, ElevenLabs). We list them in Section 6.
• We do not sell or rent your personal information. We do not run third-party ad networks on the Platform.
• Nova generates commentary by sending game events — not your email or payment info — to Anthropic’s Claude API.
• You can export or delete your Account from the Platform or by emailing [email protected].

The rest of this document is the detailed version. If it conflicts with the summary, the detailed text controls.

2. Information We Collect

2.1 Information you provide directly

• Account registration: email address, chosen handle (display name), hashed password (hashed with Argon2id — we never see or store the plaintext password), and optionally an avatar URL and profile bio.
• Authentication: session cookie contents, login attempts, and password-reset request records.
• Account settings: theme, locale, notification preferences, Nova persona choice, spending and play-time controls.
• Communications: support emails, bug reports, feedback, and any content you submit via forms on the Platform.
• User-generated Content: word submissions, in-Match chat or reactions (where enabled), replay annotations, handle changes.

2.2 Information generated by your use of the Platform

• Gameplay records: Match history, seed, moves, timestamps, outcome, rating change, daily-Game attempts, retries used, streak state, Tournament results.
• Snark ledger: each Snark credit, debit, commit, and forfeiture is logged in an append-only ledger with the reason and timestamp. This is required for auditability of the virtual economy.
• Nova interactions: events that triggered Nova commentary, the generated line, the persona used, and whether the user muted or played back audio.
• Feature-flag and A/B bucket assignment for the features we gate by flag.
• Internal platform events (the events table) — a structured log of state changes such as rating updates, unlock grants, subscription lifecycle transitions.

2.3 Information collected automatically (technical)

• Device & connection: IP address, user-agent string, approximate geolocation derived from IP (country / region level, not precise), language, and coarse screen-size class (mobile / tablet / desktop).
• Cloudflare traffic signals: request timing, edge colo location, bot-management score, challenge-page outcomes, and security-event flags. These are processed by Cloudflare on our behalf to protect the Platform.
• Cookies & similar technologies: see Section 7.
• Diagnostics & errors: stack traces, request IDs, performance timings, and similar operational telemetry. We do not attach this telemetry to advertising identifiers.

2.4 Payment information (never stored by us)

When you purchase Snarks, Snark Pass, or another paid product, Stripe collects your payment instrument (card number, expiration, CVC, bank authorization data, or equivalent). Stripe returns to us a non-sensitive payment confirmation including the amount, currency, last four digits of the card, card brand, billing country, customer and subscription IDs, and the timestamp. We store that confirmation data to fulfill the purchase and for tax, accounting, and fraud-prevention purposes. We do not receive or store full card numbers, CVC, or bank account numbers.

2.5 What we do not collect

• Government-issued ID, date-of-birth documents, or similar identity documents, unless we must verify age or identity in response to a specific regulatory request or account-recovery escalation.
• Precise GPS location. Geolocation is IP-derived and coarse.
• Contacts, SMS, microphone data, camera data, or device storage beyond what the browser automatically provides.
• Advertising identifiers. We do not run third-party ad networks on the Platform and do not build a profile of you for cross-site advertising.
• Sensitive personal data categories (health, biometrics, political affiliation, religion, sexual orientation) — these are not collected.

3. How We Use Your Information

We process personal information to:

• Operate, maintain, and secure the Platform — including authentication, session management, rate-limiting, anti-cheat, anti-abuse, fraud prevention, and incident response.
• Run Matches and Tournaments — including building the authoritative server-side game state, computing outcomes, updating Glicko/Elo ratings, awarding Snarks, and updating leaderboards.
• Power Nova commentary and recaps — by forwarding game events (not your email, not your password, not your payment info) to Anthropic’s Claude API and optionally to ElevenLabs for text-to-speech synthesis.
• Process payments, subscriptions, refunds, and tax compliance — via Stripe as our payment processor.
• Provide customer support and respond to your requests.
• Communicate with you about the Platform — service announcements, billing receipts, security alerts, and (if you opted in) product updates.
• Improve the Platform — by analyzing aggregated, anonymized, or pseudonymized usage patterns to fix bugs, tune difficulty, calibrate Nova persona prompts, and design new features.
• Comply with legal obligations and enforce the Terms — including responding to lawful requests, tax reporting, preventing money-laundering, and enforcing account sanctions.

4. Legal Bases (EEA / UK / UAE / KSA)

Where GDPR, UK GDPR, UAE PDPL (Federal Decree-Law No. 45 of 2021), or KSA PDPL applies, we rely on the following legal bases:

• Performance of a contract (GDPR Art. 6(1)(b)) — running your Account, delivering purchases, honoring Snark Pass benefits, and computing Matches.
• Legitimate interests (GDPR Art. 6(1)(f)) — keeping the Platform secure, preventing fraud and cheating, pursuing abuse remediation, and improving the product. We have assessed these interests against your privacy rights and believe the processing is proportionate.
• Legal obligation (GDPR Art. 6(1)(c)) — tax, accounting, anti-fraud, and response to lawful requests.
• Consent (GDPR Art. 6(1)(a)) — marketing emails, if any, and any optional analytics cookies where required. Consent can be withdrawn at any time.

5. When We Share Information

We do not sell personal information. We share it only in these cases:

• With other Users, by design: your public handle, rating, avatar, Match history summary, replay, leaderboard rank, and Tournament results are visible to other Users where those features surface them. Your email, IP, and payment data are never visible to other Users.
• With subprocessors listed in Section 6, under a data-processing agreement.
• With law enforcement, courts, or regulators in response to a valid legal request. We will challenge overbroad requests where legally permitted.
• With a successor entity as part of a merger, acquisition, financing, or sale of assets. We will notify you of a change of controller.
• To protect rights and safety — for example, to investigate fraud, prevent harm, or enforce the Terms.
• With your consent for any purpose not described in this Policy.

6. Subprocessors

We rely on the following subprocessors to run the Platform. Each is bound by contract to process personal information only on our instructions and to apply appropriate security measures.

We may update this list from time to time. Material additions will be reflected here at least 30 days before they take effect (subject to urgent security needs).

7. Cookies & Similar Technologies

We use a small set of first-party cookies and storage mechanisms:

• drop_games_session — HTTP-only, signed session cookie. Strictly necessary. Keeps you logged in.
• CSRF and form-nonce tokens — strictly necessary, prevent cross-site request forgery.
• Cloudflare security cookies (for example, __cf_bm) — strictly necessary, bot-management.
• Local storage — UI preferences (theme, audio volume, Nova mute state). No personal data is exfiltrated.

We do not deploy third-party advertising or retargeting cookies. If we add optional analytics cookies in the future we will request your consent where required.

8. AI Processing & Automated Decisions

Nova commentary and recaps are generated by forwarding structured game events (for example, “Player A missed letter E”, “Player B won in 34 seconds”) to Anthropic’s Claude API. We do not include your email, password hash, IP address, or payment information in these requests. Generated text may be stored with the Match record so it appears in replays.

We do not engage in solely automated decision-making producing legal or similarly significant effects on you within the meaning of GDPR Art. 22. Anti-cheat flags are reviewed by a human before enforcement actions that affect your Account.

9. Data Retention

• Account records — kept for the life of your Account and for 30 days after deletion to allow recovery from accidental deletion, then deleted or fully anonymized.
• Gameplay & leaderboard records — retained for the life of the Account. After deletion we may retain anonymized match outcomes (without your handle) for statistical and balancing purposes.
• Snark ledger — retained for 7 years for audit and accounting purposes, even after Account deletion (pseudonymized where possible).
• Payment records — retained for 7 years for tax and accounting purposes.
• Security & abuse logs — retained up to 13 months.
• Support correspondence — retained up to 3 years.
• Backups — encrypted backups are retained up to 90 days; deletion requests cascade to backups on the next expiry cycle.

10. Security

We apply industry-standard technical and organizational measures:

• Passwords are hashed with Argon2id. We never store or log plaintext passwords.
• Session cookies are signed with a rotating secret, HTTP-only, Secure, and SameSite.
• All traffic is HTTPS. Internal service-to-service calls on Cloudflare use service bindings, not public URLs, and are gated by a shared internal secret.
• Server-authoritative game state. Client-reported state is never trusted to update the Snark ledger, ratings, or Match outcomes.
• Payment data is handled exclusively by Stripe, a PCI-DSS Level 1 certified processor.
• Access to production systems is restricted to a minimum set of authorized personnel.
• We monitor for suspicious activity and breaches and will notify affected users and regulators as required by applicable law (for example, within 72 hours under GDPR Art. 33 for notifiable breaches).

No system is completely secure. You are responsible for keeping your Account credentials confidential and for enabling available protections (for example, multi-factor authentication if offered).

11. International Data Transfers

The Platform is operated on Cloudflare’s global edge network and relies on subprocessors headquartered in the United States and the European Economic Area. Where we transfer personal information out of the EEA, UK, UAE, or KSA to a jurisdiction that has not been recognized as providing adequate protection, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement / Addendum, or equivalent contractual mechanisms, supplemented by technical measures where appropriate.

12. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Rectify inaccurate or incomplete information.
• Erase your personal information (“right to be forgotten”), subject to our retention obligations in Section 9.
• Restrict or object to certain processing.
• Portability — receive your data in a machine-readable format.
• Withdraw consent where we process on the basis of consent.
• Not be subject to a solely automated decision that produces legal or similarly significant effects.
• Appeal a decision we make on one of these requests.
• Lodge a complaint with your local supervisory authority (e.g., your EU data-protection authority, the UK ICO, the UAE Data Office, the KSA SDAIA, the California Attorney General).

To exercise any of these rights, email[email protected]. We will respond within the time required by applicable law (for example, 30 days under GDPR, 45 days under CCPA, extendable once where permitted). We may ask you to verify your identity before acting on the request.

12.1 California residents (CCPA / CPRA)

California residents have the right to know the categories and specific pieces of personal information we collect, to delete personal information, to correct inaccurate information, to limit use of sensitive personal information, and to opt out of “sale” and “sharing” as those terms are defined by the CCPA/CPRA. We do not sell or share personal information in the CCPA/CPRA sense. We do not knowingly sell the personal information of anyone under 16.

12.2 UAE & KSA residents

Residents of the UAE have rights under the UAE PDPL (Federal Decree-Law No. 45 of 2021) including access, rectification, erasure, and objection. Residents of the KSA have rights under the KSA PDPL including access, correction, and destruction of personal data. You can exercise these rights via the contact address in Section 16.

13. Children’s Privacy

The Platform is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, contact us and we will delete it. Users aged 13–17 may use the free features of the Platform only under the supervision of a parent or legal guardian and may not initiate any paid transaction.

14. Deleting Your Account

You can request deletion of your Account from Settings or by emailing[email protected]. On deletion we will:

• Immediately revoke all sessions and disable sign-in.
• Delete or anonymize your handle, email, avatar, and settings within 30 days.
• Retain the Snark ledger and payment records in pseudonymized form for the retention periods in Section 9.
• Leave anonymized gameplay outcomes (without your handle) in aggregate statistics and leaderboard historical snapshots.
• Purge backups on their next expiry cycle (up to 90 days).

Unspent Snarks and unused subscription entitlements are forfeited on Account deletion and are not refundable for the reasons stated in the Terms, Section 7.

15. Changes to This Policy

We may update this Policy. For material changes we will provide reasonable advance notice (typically 30 days) by email, in-Platform banner, or both. Your continued use of the Platform after the effective date of an update constitutes acceptance of the updated Policy.

16. Contact

For any privacy question, request, or complaint, write to us at:

A dedicated privacy mailbox at thedrop.games will be published once mail is provisioned for the domain. Until then, requests sent to the address above are monitored and actioned. We aim to acknowledge within 5 business days and respond in full within the period required by applicable law.