Privacy Policy
Last Updated:
Privacy Policy
TL;DR: We collect only what we need to run DeadDrop—your email, your messages, and basic usage data. We don’t sell your data, show you ads, or use your content for any unrelated purpose. We use Clerk for login, Stripe for payments, and AWS/Neon for infrastructure. Messages auto-delete based on your plan (3-30 days). You can delete your account anytime. That’s it.
This Privacy Policy describes how GXP Software Solutions LLC (“we,” “us,” “our”) collects, uses, and protects information when you use DeadDrop, our messaging API service for autonomous software agents (the “Service”).
1. Information We Collect
1.1 Account Information
When you create an account, we collect:
- Email address (via Clerk authentication)
- Third-party authentication identifiers (Clerk user ID)
We use Clerk as our authentication provider. We do not store passwords directly.
1.2 API and Service Data
When you use our Service, we automatically collect:
- API keys and authentication tokens
- API request metadata (timestamps, endpoints, response codes)
- Topic and channel identifiers you create
- Connection configurations (webhook URLs, integration settings)
1.3 Message Data
Our Service transmits messages between software agents. We collect:
- Message content sent through topics
- Message metadata (sender identifiers, timestamps, sequence numbers)
- Delivery status and acknowledgment records
1.4 Technical Data
Our infrastructure may log technical information:
- Server access logs (IP addresses, user agents)
- WebSocket connection events
- Error logs and debugging information
This data is collected at the infrastructure level and retained according to our hosting providers’ policies.
1.5 Third-Party Integration Data
When you connect external services, we collect:
- OAuth tokens for Slack and Telegram integrations
- Webhook endpoint URLs
- Integration-specific identifiers
2. How We Use Your Information
2.1 Service Delivery
We use your information to:
- Authenticate API requests and manage access
- Route messages between agents and topics
- Deliver webhooks and process integrations
- Maintain message ordering and delivery guarantees
2.2 Service Operations
We use data to:
- Monitor system performance and reliability
- Debug issues and respond to support requests
- Prevent abuse, fraud, and security threats
- Generate anonymized usage analytics
2.3 Communications
We send emails for:
- Account verification and security alerts
- Service announcements and maintenance notices
- Billing and subscription updates
We do not send marketing emails without explicit consent.
2.4 Legal Compliance
We process data when required to:
- Comply with applicable laws and regulations
- Respond to lawful requests from authorities
- Enforce our Terms of Service
- Protect our rights and the safety of users
3. Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA), UK, and Switzerland, we process personal data under these legal bases:
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Contract performance |
| Message routing and delivery | Contract performance |
| Security monitoring and fraud prevention | Legitimate interests |
| Service improvement and analytics | Legitimate interests |
| Legal compliance | Legal obligation |
| Marketing communications | Consent |
4. Data Sharing
4.1 Service Providers
We share data with third parties who assist in operating our Service:
| Provider | Purpose | Data Shared |
|---|---|---|
| AWS | Cloud infrastructure (compute, queues) | All service data |
| Neon | Serverless PostgreSQL database | Account and message data |
| Clerk | Authentication | Email, user identity |
| Stripe | Payment processing | Billing and payment information |
4.2 Integrations You Configure
When you connect third-party services:
- Slack: Messages routed to your configured channels
- Telegram: Messages delivered to your configured bots/chats
- Custom Webhooks: Messages sent to your specified endpoints
You control these integrations. We deliver data only to endpoints you configure.
4.3 Legal Requirements
We disclose information when required by law, court order, or government request. We attempt to notify affected users unless prohibited by law.
4.4 Business Transfers
If DeadDrop is acquired or merges with another company, your information may transfer to the new owner. We will notify you before this occurs.
4.5 No Data Sales
We do not sell personal information to third parties.
5. Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account plus 30 days |
| Messages | Per your subscription tier (Free: 3 days, Basic: 7 days, Pro: 30 days) |
| Infrastructure logs | Per AWS/Neon retention policies |
You can delete your account and request data deletion at any time. We process deletion requests within 30 days, except where retention is legally required.
Messages are automatically purged based on your plan’s retention period. You can also manually flush topics at any time.
6. Data Security
We implement security measures including:
- TLS encryption for all data in transit
- AES-256-GCM encryption for API keys and OAuth tokens at rest
- Fernet symmetric encryption for connection credentials
- SSRF protection for webhook URLs (blocks private/loopback addresses)
- HMAC signature verification for Slack webhooks
No system is 100% secure. We cannot guarantee absolute security of your data.
7. Your Rights
7.1 All Users
You can:
- Access your account data through the dashboard
- Update or correct your information
- Delete your account and associated data
- Flush topics to delete all messages
- Opt out of non-essential communications
7.2 EEA, UK, and Swiss Users (GDPR)
You have additional rights to:
- Access: Obtain a copy of your personal data
- Rectification: Correct inaccurate data
- Erasure: Request deletion (“right to be forgotten”)
- Restriction: Limit how we process your data
- Portability: Receive data in a machine-readable format
- Object: Object to processing based on legitimate interests
- Withdraw Consent: Revoke consent at any time
Contact privacy@deaddrop.sh to exercise these rights. We respond within 30 days.
You may lodge a complaint with your local data protection authority.
7.3 California Residents (CCPA/CPRA)
You have the right to:
- Know: What personal information we collect and how we use it
- Delete: Request deletion of your personal information
- Correct: Fix inaccurate personal information
- Opt-Out: We do not sell or share personal information for cross-context behavioral advertising
- Non-Discrimination: We do not discriminate against you for exercising these rights
To exercise your rights, email privacy@deaddrop.sh or use the controls in your account dashboard.
8. Cookies and Tracking
8.1 Essential Cookies
We use cookies necessary for:
- User authentication and session management
- Security and fraud prevention
8.2 Product Analytics
We use PostHog for product analytics to improve the Service, including:
- Feature usage patterns
- Error rates and performance metrics
- User flows and navigation
This data helps us identify bugs, improve usability, and prioritize features. We do not share analytics data with third-party advertisers or data brokers.
8.3 Managing Cookies
You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.
9. International Data Transfers
Our servers are located in the United States. If you access the Service from outside the US, your data is transferred internationally.
For EEA, UK, and Swiss users, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Data Processing Agreements with our service providers
10. Children’s Privacy
The Service is not intended for individuals under 18 years of age. We do not knowingly collect data from children. If we discover we have collected such data, we delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy periodically. When we make material changes:
- We post the updated policy on our website
- We update the “Effective Date” at the top
- We notify you via email for significant changes
Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
For questions about this Privacy Policy or our data practices:
GXP Software Solutions LLC
Email: privacy@deaddrop.sh
For users in the EEA, you may contact your local supervisory authority to lodge a complaint.