Last updated: October 10, 2026
Who we are
The Drop (thedrop.so) is run by Stefano Monteduro, an individual based in Italy, who is the data controller for the personal data described on this page. For anything privacy related, write to privacy@thedrop.so.
What we collect and why
1. Your launch, if you reply to a Drop post on X
When you reply to a Drop post, we collect public information from your reply and your public X profile: username, display name, profile picture, the text and link of your reply, how many likes and replies it gets, your follower count and when your account was created. We also read public information from the website you link: its name, description, icon and preview image.
- Why: to rank launches, show the leaderboard, give each launch its own page, keep the archive of past Drops, and check the rules (one product per account, makers only, no gaming the vote).
- Legal basis: our legitimate interest in running The Drop (Art. 6(1)(f) GDPR). You enter by publicly replying to a post that explains how it works.
- Source: public posts on X, collected with Apify, a web data service, and with X's public post embeds.
- How long: launches stay in the public archive, as the rules say. You can ask us to remove yours at any time.
2. Newsletter
If you subscribe, we store your email address, when you signed up, where you signed up (sidebar or popup, and which page) and an approximate country based on your connection. We don't store your IP address.
- Why: to email you when a Drop goes live and when it closes, with the winners and a short breakdown.
- Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every email, or by writing to us.
- How long: until you unsubscribe. Then your email is deleted.
3. Analytics
We use DataFast in cookieless mode to see how the site is used: pages visited, where visitors come from, device and browser type, approximate country, and clicks on some buttons. Visitors are counted with a pseudonymous identifier made from the IP address, browser user agent, our domain and a salt that changes every 24 hours, so visits on different days aren't linked to one profile.
- Legal basis: our legitimate interest in understanding and improving the site (Art. 6(1)(f) GDPR).
4. Hosting and security
The site runs on Cloudflare. When you visit, Cloudflare processes technical data such as your IP address and request details to deliver the pages and protect the site from abuse. Legal basis: our legitimate interest in a working, secure site (Art. 6(1)(f) GDPR).
Cookies and browser storage
We don't set cookies. We use your browser's local storage only to remember your light or dark theme, whether you already subscribed, and when the newsletter popup was last shown, so it doesn't come back for 7 days. This stays on your device and you can clear it at any time. DataFast may use session storage for the current tab, which is cleared when you close it.
Who we share data with
We never sell your data. We use these providers to run The Drop:
- Cloudflare, Inc. (USA): hosting and storage of newsletter sign-ups.
- JustShipIt Pte. Ltd., trading as DataFast (Singapore, with infrastructure that includes the USA): analytics.
- Apify: collecting public replies to Drop posts on X.
- X Corp.: The Drop lives on X. Your reply and your profile are also covered by X's own privacy policy.
- An email delivery provider, once we start sending emails. We'll add it to this list before the first email goes out.
Launch information is public on the site by design: that's the point of The Drop.
Transfers outside the EU
Some providers process data outside the European Economic Area, for example in the USA or Singapore. These transfers rely on the safeguards in the providers' data processing terms, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR you can ask to access, correct or delete your data, restrict or object to how we use it (including the publication of your launch), get a copy in a portable format, and withdraw your consent at any time. Write to privacy@thedrop.so and we'll reply within one month.
You can also lodge a complaint with a data protection authority: in Italy, the Garante per la protezione dei dati personali, or the authority where you live.
Kids
The Drop is not meant for anyone under 16, and we don't knowingly collect their data.
Changes
If this policy changes, we'll update this page and the date at the top. For important changes we'll also let you know on @thedropso or by email.