Privacy policy

This policy says what Day Drop stores about you, why, where it is kept, who else handles it, how long it is kept and what you can do about it. It covers the app at app.daydrop.now.

Who is responsible

Day Drop is run by Polyspice, the sole proprietorship of Thorbjørn Lynggaard Sørensen, CVR DK37355968, Præstøgade 11, 2. tv, 2100 København Ø, Denmark. Polyspice is the data controller for everything in this policy.

Questions about your data, and every request below: tls@polyspice.com. We answer within one month.

What we store, and why

Your account. Your email address, a name made from the part of your address before the @, your password as a one-way hash (we cannot read it), your timezone as your browser reports it, when your address was verified, and when you accepted this policy and the terms of service and which version. We need these to give you an account: without them you cannot log in or receive the mails the account depends on. Legal basis: the contract with you (GDPR article 6(1)(b)).

Your workspace. The workspace made for you at sign-up, its name, and everything you put in it. Legal basis: the contract with you.

Social accounts you connect. When you connect a Bluesky or Mastodon account to a project, we store its name on the network, which Mastodon server it is on, and what lets Day Drop post for it: a Bluesky app password or a Mastodon access token. That secret is encrypted with a key kept apart from the database, and is never shown on a page or written to a log. We never see your password for either network. At a post's time we send what you marked ready to the network you chose for it: the text, the link, the images with their alt text, or the video. Every image except a GIF is made anew before it goes, so the camera details and location in a photo stay behind; a GIF and a video are sent as they are, with anything your camera stored in them. A Mastodon post goes to the server you typed, run by whoever runs that server under its own terms, not by us for you. To stop it, press Remove beside the channel on the project's Connections page: we delete the secret, and for Mastodon we also take Day Drop's access away on your server. Deleting the project or your account does the same. Legal basis: the contract with you.

AI assistants you connect. You can connect your own AI assistant, such as Claude or ChatGPT, to your account. When you allow one, we store the name it gives itself, the address it sends you back to, when you allowed it and when it last used Day Drop, and an identifier for each token that lets it act as you, never the token itself. A connected assistant can read the projects, channels and posts you can see, and write posts, always as drafts: each one says Written by and the assistant's name until a person saves it. It cannot mark a post ready, publish one or delete anything, so nothing it writes goes out until you mark it ready. What it reads from Day Drop goes to the company behind the assistant, under your own agreement with that company, not ours; we do not choose it and it does not handle your data for us. To stop it, open the Account page and press Disconnect beside it under Connected assistants: it can no longer reach your account from that moment. Legal basis: the contract with you.

Changes of email. When you change your address we keep the old and the new address and when the change was asked for, confirmed or undone. The old address is what lets you undo a change someone else made, for 7 days. Each record is deleted once those 7 days are over. Legal basis: our legitimate interest in keeping your account safe from takeover (article 6(1)(f)).

Security and abuse limits. While you are logged in we keep your session: its IP address, your browser's user agent and when it was last used. Sessions end when you log out, or two hours after your last visit unless you ticked Remember me, which keeps you logged in on that device until you log out, for up to about 400 days. To stop sign-up and the account mails being abused we count recent attempts per IP address or per account for up to one hour. Errors are written to a log on the server, kept 14 days, which can include the address of the page and your IP address. Simply.com's web servers also keep their own log of each request, with its IP address and the address of the page. Legal basis: our legitimate interest in keeping the service and its users secure (article 6(1)(f)).

Mails we send you. Only mails about your account: verifying your address, a password reset you asked for, notices that your password or email changed, the undo link when your email changes, a warning a week before an unverified account is deleted, and the confirmation when you delete your account. If someone asks to move their account to an address that already has a Day Drop account, we mail that address once to say nothing changed. We send no newsletters or marketing.

We do not use analytics, advertising or tracking cookies, and we do not sell or share your data for marketing.

Cookies

Day Drop sets only the cookies it needs to work: a session cookie that keeps you logged in, a security token that protects forms against forgery, and, if you tick Remember me, a cookie that keeps you logged in on that device. None of them track you across other sites, so we do not ask for consent for them.

Where your data is kept, and who else handles it

Your data is kept in Denmark. These companies handle it for us, only to run Day Drop:

Simply.com A/S (CVR DK29412006, Skanderborg, Denmark), under a data processing agreement: hosts the app and its database, and sends our mails. All its servers, data and backups are in Denmark, in team.blue Denmark A/S's data centres.
Google Ireland Limited (Google Drive, in our Google Workspace organisation), under Google's Cloud Data Processing Addendum: stores our nightly database backups, and a backup taken before each update of the app. They are encrypted before they reach Google, with a key Google does not have, so Google holds files it cannot read. Google may store them outside the EU/EEA; Google LLC is certified under the EU-US Data Privacy Framework.
GitHub (GitHub, Inc., a Microsoft company, USA): runs the job that makes each backup. For the few minutes the job runs, an unencrypted copy of the database exists on a temporary GitHub machine; it is encrypted there, uploaded to Google Drive, and the machine is then discarded. GitHub is certified under the EU-US Data Privacy Framework, and our GitHub Team plan puts it under the GitHub Data Protection Agreement.

How long we keep it

Your account and workspace: until you delete them.
A connected assistant: until you disconnect it or delete your account. Its access lasts an hour at a time and is renewed for up to 30 days of not being used. An assistant that registers but is never allowed is deleted after a day.
A connected social account: until you remove its channel or delete its project or your account. A Mastodon server's record that Day Drop may post for you is the server's; removing the channel, its project or your account here ends it, and so does removing the app there.
A change of email: 7 days, the time its undo link works, then the record is deleted.
When you delete your account: everything above is deleted at once, workspace and email history included. It can still exist in our encrypted backups for a while: daily backups and the backups taken before updates are deleted after 30 days, monthly backups after 6 months. So 6 months after you delete your account, nothing of it is left anywhere. We do not restore a deleted account from a backup.
Accounts that never verify their address: they are paused after 7 days, we mail a warning a week before the end, and they are deleted 30 days after sign-up, workspace included.
Sessions, attempt counts and logs: as above, from two hours to 14 days, or up to about 400 days for a Remember me login.
Password reset links: expire after 60 minutes, and are deleted within a day.

Your rights

You can:

See and correct your data: your address is on the Account page, and you can change it there.
Delete your account and everything in it yourself, from the Account page, at any time, except for 7 days after its email was changed, so the owner of the old address can undo a change first.
Get a copy of your data in a format a machine can read, ask us to restrict a use of it, or object to a use based on our legitimate interest: write to tls@polyspice.com from the address on your account. We send a copy as a file by mail within one month.
Complain to the Danish Data Protection Agency, Datatilsynet, at datatilsynet.dk, if you think we handle your data wrongly. We would rather hear from you first, but you do not need to.

Age

Day Drop is a tool for businesses and people who publish on social media. You must be at least 18 to create an account.

Changes to this policy

The version at the bottom of this page is the date it last changed. When it changes in a way that matters, we tell you by mail or in the app before the change applies, and ask you to accept it again where the law requires it.