Privacy Policy

What we collect and why

• Request data. Like any website, our server and Cloudflare receive your IP address, browser type, the page requested and the time of each visit. We use this to deliver pages, keep the site secure and fix errors. Our server does not record your IP address in its technical logs.
• Accounts and sign-in. Accounts are optional for browsing and required for the watchlist. We store your email address, when it was verified, sign-in sessions and your watchlist entries (domain, when added and last checked status). To sign in, we email you a single-use link that expires after 15 minutes; its token is deleted once used. Sign-in emails are sent through a third-party email delivery provider acting as our processor.
• Rate limiting. To prevent abuse, sign-in requests are rate-limited by IP address and email address in memory. These counters are not stored in the database and reset within an hour.
• Analytics (planned). We plan to use Umami, self-hosted on our own server and configured without cookies. It records aggregate page views, referrers, and browser and device types. It does not identify individual visitors or follow them across sites.

We do not sell personal data and do not use it for advertising.

Cookies

DropTicker sets one strictly necessary session cookie only when you sign in, to keep you signed in. We do not use tracking or advertising cookies. Cloudflare may also set a strictly necessary security cookie to tell people from bots.

How long we keep it

• Our server keeps limited technical logs (errors and service messages). They are capped in size and overwritten as new entries arrive, and they do not record your IP address.
• Account data: until you delete your account.
• Expired sessions and unused sign-in tokens are removed. Deleting an account removes its sessions and watchlist.
• Rate-limit counters: held in memory and reset within an hour.
• Analytics, once added: aggregate statistics only, with no individual-level data.
• Cloudflare keeps its own logs under its own policy.

Third parties

• Cloudflare sits in front of our server to provide security, caching and delivery, so it processes every request. See Cloudflare's privacy policy.
• Our hosting provider runs the server that stores our database and logs.
• Domain registrars. When you follow a registrar link, you leave DropTicker and that registrar's privacy policy applies. Some links are affiliate links, so the registrar may record that you arrived from DropTicker. See our affiliate disclosure.

Your rights

EU and UK (GDPR and UK GDPR): you can ask to access, correct or delete personal data we hold about you, object to or restrict how we use it, and ask for a copy. Our legal basis for request data and rate limiting is our legitimate interest in running a secure site. You can also complain to your data protection authority.

California (CCPA/CPRA): you can ask what personal information we collect and ask us to delete it. We do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using your rights.

To delete your account, or to make another privacy request, email [email protected]. Deleting an account removes its sessions and watchlist.

Changes and contact

We will update this page and the date above if our privacy practices change.

Questions or requests: [email protected].