Scope and privacy roles

This Privacy Policy applies to the Sitedropper public website, dashboard, APIs, hosted MCP service, support and account communications, and the infrastructure used to build, deploy, and route customer projects (together, the Services).

For account, billing, product-usage, support, and public-website information, Sitedropper determines why and how the information is processed. For personal information that a customer places in project files or collects through a deployed application, the customer generally determines the purpose and means of processing, and Sitedropper processes that information to provide the hosting and routing service. Visitors to a customer application should also review the project owner’s privacy notice.

This policy does not govern third-party websites, coding agents, OAuth providers, payment pages, or customer applications that have their own privacy practices.

Information we collect

Information you provide

  • Account and profile information: email address, a generated account/user label, password hash, email-verification status, plan, and account role. Self-serve registration does not ask for separate personal, account, or workspace names. If you choose partner sign-in, the provider may supply a display name.
  • Project and deployment content: project names and descriptions, ZIP archives and source files, build and runtime configuration, generated build artifacts, deployment history, logs, custom-domain names and DNS status, visibility settings, and environment variables. Environment-variable values are encrypted at rest and are not returned after they are saved.
  • Sharing information: email addresses approved for Private projects, one-time-code records, access timestamps, and hashed shared-access passwords.
  • Support and contact information: the email address, message, and related correspondence you send to Sitedropper.
  • Billing information: plan and subscription status, billing period, and provider customer, product, price, subscription, and event identifiers. Stripe handles payment-card and bank-account details on its pages; Sitedropper does not receive full payment-card numbers.

Information from connected services

  • If you choose Google or GitHub sign-in, we receive the provider’s stable account identifier, verified email address, display name, and authentication result. Sitedropper does not retain the provider access token, ID token, authorization code, or refresh token after the sign-in profile is validated.
  • If you use Stripe billing, Stripe sends subscription, invoice, payment-status, and related event information.
  • If you connect a custom domain, Cloudflare and DNS systems provide hostname, validation, certificate, and routing status.

Information collected automatically

  • Service and security data: IP address, user agent, request time, host and request path, session and token metadata, authentication events, rate-limit signals, audit events, operation status, and error information.
  • Public-site analytics: page viewed, referring page, general device/browser details, approximate location derived from IP address, and interactions such as a non-identifying CTA category or MCP-client selection. Sitedropper’s custom analytics events are designed not to include email addresses, project names, project URLs, archive names, form messages, OAuth values, tokens, or API error bodies.
  • Deployed-application traffic: request metadata and, when technically required to proxy a request, request headers and content needed to route traffic to the customer application. A customer application may separately collect information under the project owner’s instructions.

We collect information directly from you, automatically from your browser or API client, from a person who grants you access to a Private project, and from the providers you choose to connect.

How we use information

We use personal information to:

  • create and secure accounts, verify email addresses, authenticate users, maintain sessions, and connect authorized coding agents and API clients;
  • accept, analyze, build, store, deploy, route, and delete projects as instructed;
  • apply Draft, Private, Password protected, and Public visibility choices;
  • send account verification, password reset, security, private-access, support, and billing communications;
  • provide plans, enforce project and deployment limits, process subscriptions, and maintain billing records;
  • operate custom domains, troubleshoot deployments, prevent fraud and abuse, protect the Services, and enforce our Terms;
  • understand public-site use and improve documentation, reliability, usability, and product performance;
  • comply with law, respond to valid legal process, and establish or defend legal claims; and
  • carry out a merger, financing, acquisition, reorganization, or sale of assets subject to appropriate safeguards.

We do not use customer source code, project content, or environment variables to train generative artificial-intelligence models. We do not use personal information for targeted advertising.

Where the GDPR, UK GDPR, or similar law applies, we rely on the following legal bases:

  • Contract: processing needed to create an account and provide requested deployment, hosting, sharing, support, and billing features.
  • Legitimate interests: securing and improving the Services, preventing abuse, maintaining records, understanding service performance, and communicating about the account, balanced against the rights of affected people.
  • Consent: where we specifically request consent for an optional activity. Consent may be withdrawn at any time without affecting earlier processing.
  • Legal obligation: processing needed for tax, accounting, sanctions, law-enforcement, or other legal requirements.

How we disclose information

We disclose information only as needed for the purposes in this policy:

  • Infrastructure and database providers: Google Cloud supports archive storage, builds, container images, deployed runtimes, and platform hosting; Supabase provides managed PostgreSQL hosting; and Cloudflare provides DNS, traffic delivery, TLS, and custom-domain routing.
  • Communication providers: Resend and related email-delivery systems deliver account, support, and private-access messages.
  • Billing providers: Stripe provides Checkout, subscription, invoice, and customer-portal services when billing is available and used.
  • Identity providers: Google and GitHub process a sign-in or account-link request when you choose that provider.
  • Analytics providers: Google Analytics helps measure use of the public site. We do not send the user-provided contact-form contents or project data in custom analytics events.
  • Customer-directed recipients: project files and application responses are delivered according to the project owner’s visibility, domain, API, and agent instructions. Public projects can be accessed by anyone.
  • Professional advisers and authorities: we may disclose information to auditors, legal advisers, insurers, courts, regulators, or law enforcement when reasonably necessary and legally permitted.
  • Business transactions: information may transfer as part of a financing, merger, acquisition, reorganization, bankruptcy, or asset sale, subject to applicable notice and safeguards.

Some providers, such as Stripe, Google, and GitHub, may independently determine how they process information on their own pages. Their privacy policies apply to that processing.

Project visibility and app visitors

A project owner chooses how a deployed project is shared. Draft projects are limited to the owner’s authorized account access. Private projects use approved email addresses and a one-time code. Password protected projects are available to people who know the shared password. Public projects are available to anyone. A customer-owned domain follows the same Sitedropper visibility setting, but the deployed application may implement additional data collection or authentication.

Project owners are responsible for giving their visitors any legally required privacy notice, obtaining required consent, honoring visitor rights, and using the Services only for information they are authorized to process. Do not use Sitedropper for regulated or highly sensitive personal information unless Sitedropper has expressly agreed in writing to the required terms.

Cookies and analytics

The Services use essential cookies and similar storage for dashboard sessions, CSRF protection, authentication handoffs, and visitor access to protected projects. These technologies are required for the requested security and account features. Session duration varies by feature; for example, dashboard sessions and protected-project visitor sessions expire and can also be revoked or cleared.

The public site uses Google Analytics to understand page use and non-identifying interaction categories. Google Analytics may use first-party cookies or similar identifiers and may receive IP-derived location and browser/device information. Sitedropper does not use Google Analytics for targeted advertising or intentionally place project or contact-form content in analytics events. You can limit analytics through browser cookie controls, content blockers, or Google’s available opt-out tools, although blocking essential storage may prevent account or protected-project features from working.

Browsers may send a Do Not Track signal, but there is no universally accepted response standard. Because Sitedropper does not sell personal information or use it for cross-context behavioral advertising, we do not currently offer an advertising opt-out cookie.

Retention and deletion

We retain each category only for as long as reasonably necessary to provide the Services, secure the platform, comply with legal and accounting duties, resolve disputes, and enforce agreements. The period depends on the data and context:

  • account, project, deployment, configuration, and support records are generally kept while the account or project is active and for a reasonable period afterward;
  • one-time authentication and upload credentials expire within minutes or hours, and completed partner-auth handoff records are routinely removed after a short security-review window;
  • billing and transaction records may be kept for the period required by tax, accounting, fraud-prevention, and dispute laws;
  • security, audit, operation, and build records are kept long enough to investigate incidents, support deployments, and maintain service integrity; and
  • backups, immutable archives, provider logs, and soft-deleted database records may remain until their scheduled deletion or overwrite cycle.

When project deletion completes, Sitedropper removes the active runtime, generated route, managed custom-domain registration, and project image package. Some source archives, logs, database records, or backup copies may not be removed immediately and may be retained where needed for security, legal compliance, disaster recovery, or a documented deletion cycle. You may request account or personal-information deletion at [email protected]. We may first verify the requester and may retain information where law permits or requires it.

Security

Sitedropper uses administrative, technical, and physical safeguards designed for the nature of the Services. These include encrypted transport, hashed passwords and access credentials, encrypted project environment values, scoped and expiring credentials, access controls, isolated build infrastructure, private-by-default deployment settings, and monitoring or audit records.

No Internet service is completely secure. Keep account credentials and API tokens confidential, do not place secrets in project archives or prompts, use environment settings for required secrets, and contact us promptly if you believe an account or deployment has been compromised.

International transfers

Sitedropper operates infrastructure primarily in the United States, including cloud services in U.S. regions. Providers and users may be located in other countries. As a result, information may be processed in a country with privacy laws different from those where you live. Where required, we use contractual or other legally recognized safeguards for cross-border transfers and provide information about those safeguards on request.

Your choices and rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, or portability; withdraw consent; opt out of certain processing; or appeal a denied privacy request. You may also lodge a complaint with your local data-protection authority.

Account users can update certain project and visibility information in the dashboard, revoke API or MCP access where controls are available, delete projects, and manage billing through the offered billing controls. For other requests, email [email protected] with the subject Privacy request and describe the request. We may verify your identity and authority, and we will respond within the period required by applicable law. We will not discriminate against you for exercising a privacy right.

California notice

For California residents, the categories collected in the preceding 12 months may include identifiers and customer-record information; commercial information; Internet or other electronic-network activity; approximate geolocation; professional information included in a contact message; and the contents of communications, project files, or credentials a user chooses to provide. We collect these categories from the sources and for the purposes described above, and disclose them for business purposes to the provider and recipient categories listed in this policy.

Sitedropper does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not offer a financial incentive for personal information. We do not use or disclose sensitive personal information to infer characteristics or for purposes that create a right to limit under California law.

California residents may request to know, correct, delete, or obtain a copy of covered personal information. An authorized agent may submit a request, but we may require proof of authorization and verify the resident directly. Submit a request using the contact process in Your choices and rights.

Children

The Services are designed for adults and are not directed to children under 18. We do not knowingly collect personal information from a child under 13. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate and take appropriate action.

Changes to this policy

We may update this policy as the Services, providers, or law changes. We will post the revised policy at this URL, update the date above, and provide additional notice when required by law. Material changes apply prospectively from the stated effective date.

Contact us

Sitedropper is the operator responsible for this policy. Send privacy questions or requests to [email protected] or use the contact page. To help us protect account information, do not include passwords, API tokens, source archives, private keys, or environment-variable values in your message.