Droplist GET THE APP

Privacy Policy

Last updated 8 September 2026

Droplist LTD ("we", "us", "our") is the data controller for the Droplist app on iOS and Android and for the website drop-list.com. We are registered in England and Wales, company number 12806969, registered office 118 High Street, Staple Hill, Bristol, BS16 5HH. This policy explains what we collect, why, who we share it with and what you can do about it. If you have a question or a request about your data, email george@drop-list.com.

1. What we collect

If you create an account: your email address, or the private relay address provided by Sign in with Apple, and an account identifier.

What you do in the app while signed in: the products you follow, the raffles you record as entered, giveaway entries, and your Droplist+ subscription status.

Automatically, from every install: device model, operating system version, language, country, app version, IP address, a push notification token if you allow notifications, and usage events such as screens viewed and buttons tapped. We use this for analytics, to fix problems and to deliver notifications.

For advertising, only if you allow it: your device's advertising identifier. See section 3.

If you use the sneaker scanner: the photo you take, which is used only to identify the product and is then deleted.

If you contact us through the website: the name, email address and message you type into the form.

We do not collect your name (unless you type it into the contact form), postal address, phone number, payment card details, precise location, contacts or photo library.

2. How we use it

We use your information to run the Service: to sign you in, to sync what you follow between your devices, to send the notifications you have asked for, to check whether Droplist+ is active, to show adverts in the free version, to understand how the app is used so we can improve it, and to reply when you contact us. Our legal bases under UK GDPR are performance of our contract with you (accounts, subscriptions, notifications), our legitimate interest in running and improving the Service (analytics, security), and your consent (personalised advertising, notifications). You can withdraw consent at any time as described below without affecting the lawfulness of earlier processing.

3. Advertising and your choices

The free version of Droplist shows adverts served by Google Mobile Ads and Nimbus. On iOS, the app asks whether you allow tracking. If you allow it, these networks may use your device's advertising identifier to show adverts relevant to you and to measure them. If you do not, you still see adverts, but they are not personalised. On Android a consent screen asks the same question. You can change your answer at any time: on iOS in Settings, Privacy & Security, Tracking; on Android in Settings, Google, Ads. Droplist+ subscribers do not see adverts. We do not sell personal information.

4. Who we share it with

We share data only with the providers we need to run the Service, each of which may only use it on our instructions:

  • Sign in and account storage: Google Firebase and Apple (Sign in with Apple).
  • Subscriptions: RevenueCat, the Apple App Store and Google Play.
  • Notifications and Live Activities: OneSignal, which receives your push token, device details and the products you follow so alerts can be targeted.
  • Advertising: Google Mobile Ads and Nimbus.
  • Analytics: Google Analytics for Firebase.
  • Links and attribution: AppsFlyer, which powers our app links (app.drop-list.com) and tells us which link, page or share an install came from so the app can open the right product. It receives your device identifier (the vendor identifier, not the advertising identifier), device details, IP address, country and the events of installing and opening the app. It does not receive your account details, and we do not use it to track you across other companies' apps or websites. Older Branch links continue to work through Branch.
  • Crash reporting: Firebase Crashlytics, which receives a report when the app crashes, containing device details, app version and the state of the app at the time. Reports contain no account data.
  • Sneaker scanner: your photo is processed by Google's image search to identify the product.
  • Affiliate networks: Awin, Skimlinks and Impact receive a click reference when you follow a retailer link. They do not receive your personal data from us.
  • Hosting and delivery: our cloud hosting providers, including Cloudflare, which see the request data needed to deliver content. Squarespace processes the website contact form.

We may also disclose information where the law requires it, to protect our rights or someone's safety, or as part of a sale or merger of the business. Several of the providers above are in the United States. Those transfers are covered by the UK International Data Transfer Addendum or the provider's equivalent standard contractual clauses.

5. Third party websites and adverts

The Service links to retailers, marketplaces and advertisers that we do not control. Anything you share with them is governed by their own privacy policies, not this one, and we are not responsible for their practices.

6. How long we keep it

  • Account data: until you delete your account, after which it is removed from our live systems straight away and from backups within 30 days.
  • Analytics events: up to 14 months.
  • Crash reports: 90 days.
  • Sneaker scanner photos: deleted after the search.
  • Subscription records: for as long as tax and accounting law requires.
  • Contact form messages: for as long as we need to reply and resolve your query.

7. How we keep it safe

Data is transmitted over encrypted connections and stored with providers that hold recognised security certifications. Access is limited to what is needed to run the Service. No internet service is completely secure, so please keep your device and account details safe.

8. Children

The Service is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, email us and we will delete it.

9. Your rights

Under UK GDPR, and the GDPR if you are in the European Economic Area, you can ask for a copy of your personal information, ask us to correct or delete it, restrict or object to how we use it, and receive it in a portable form. To make a request, email george@drop-list.com. We respond within 30 days. In other regions, including California, you may have similar rights; California residents can request details of any personal information disclosed for direct marketing (we do not do this) and can opt out of personalised advertising using the controls in section 3.

Deleting your account: open the Account screen in the app and choose Delete Account, use the account deletion form, or email us from the address on the account. This removes your email address, followed products, recorded raffles, giveaway entries and subscription record. Your subscription itself is managed by Apple or Google and continues until you cancel it there. Anonymous analytics that cannot identify you are retained.

10. Data breaches

If we become aware of a breach that is likely to put your rights at risk, we will investigate promptly, notify the Information Commissioner's Office within 72 hours where required, and tell you if you are likely to be seriously affected.

11. Do Not Track

There is no agreed standard for Do Not Track signals, so the app and website do not respond to them. Your advertising choices in section 3 are the controls that apply.

12. The website

drop-list.com is served through Cloudflare, which processes your IP address to deliver pages and protect the site from abuse. We measure visits with Fathom Analytics, which is cookie-free and does not identify you or track you across other sites; it records the page viewed, the country and the type of device, and which buttons were used, nothing more. The website sets no advertising trackers.

The download buttons, Follow and Open in app buttons and QR codes on the site are AppsFlyer links (app.drop-list.com). When you use one, AppsFlyer records the click, your IP address and device type, so that if you install the app it can open the product you came from. Retailer logos are loaded from Logo.dev, and the contact form is provided by Squarespace, which stores your message so we can reply. Links to retailers and StockX are affiliate links, as described in our Terms.

13. Changes to this policy

We will update this policy when our practices change. The date at the top shows the latest version, and material changes will be announced in the app.

14. Contact

Droplist LTD, 118 High Street, Staple Hill, Bristol, BS16 5HH. Email george@drop-list.com, or use the contact form.