Privacy Policy
Last updated: October 18, 2026
1. Controller
The controller of your personal data is the Seller identified in section 1 of the Terms, email: support@dropledger.app. Contact us about your data at support@dropledger.app.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| SteamID64, profile name and avatar (from Steam when you sign in) | your account and sign-in | Art. 6(1)(b) — contract |
| SteamID64 of checked accounts and their public Rust inventory | building reports, saving a copy of an unlocked report in your profile | Art. 6(1)(b) (buyer) and 6(1)(f) — legitimate interest (checked account) |
| purchases: product, amount, currency, status, email address given at checkout, Stripe payment IDs, time and text of consent | delivering orders, refunds, complaints, accounting | Art. 6(1)(b) and (c) — contract and tax obligations |
| collection card (only if you create one): profile name, avatar, number of owned drops and completed rounds | a public page and image under a random link that you share yourself | Art. 6(1)(a) — consent (withdraw with the “Delete card” button) |
| IP address and technical request data | security, rate limits, abuse prevention | Art. 6(1)(f) — legitimate interest |
We never receive your card or BLIK details — you enter them directly with Stripe. We receive the email address you give at checkout from Stripe and store it with the order to send you the purchase confirmation and any refund confirmation. We never send ads to it and do not track email opens.
If someone checks your account, we process the publicly available data of your Steam inventory. You can make your inventory private in Steam settings or object by writing to support@dropledger.app.
3. Recipients
- Cloudflare, Inc. — hosting and database;
- Stripe Payments Europe Ltd. — payment processing;
- Resend, Inc. — sending purchase and refund confirmation emails;
- Valve Corporation (Steam) — Steam sign-in and fetching public inventories;
- an accounting firm, if we use one for bookkeeping.
Cloudflare, Stripe, Valve and Resend may process data in the USA, based on the European Commission’s adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses.
4. Retention
- account and unlocked reports — until the account is deleted;
- sign-in session — 30 days;
- collection card — until you delete it or your account;
- purchase records — 5 years from the end of the tax year (tax law);
- technical logs — briefly, according to the hosting provider’s settings.
5. Your rights
You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest. You may lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, uodo.gov.pl). Providing data is voluntary, but you cannot sign in or buy without it.
6. Cookies
We use strictly necessary cookies only — no analytics or advertising:
dl_session— signed-in session (30 days);dl_oid— Steam sign-in protection (10 minutes);NEXT_LOCALE— selected language (1 year).
The Stripe payment page uses its own cookies under Stripe’s privacy policy.