Privacy Policy

1. Who we are and who this covers

This policy covers:

• Customers: label owners, admins and artists with a droplr.fm login;
• Fans: people who visit a smart link, pre-save page or bio page hosted on droplr.fm or on a label's custom domain;
• Visitors to the droplr.fm website, and anyone who contacts us.

2. Labels, fans and who's responsible

For customer accounts and billing, we decide how the information is used and we're responsible for it.

For fan data, we act for the label whose page you visited. That label decides why your information is collected (for example, to email you on release day), and it's responsible for how it uses the information. We process it on the label's behalf under our Data Processing Terms. In GDPR terms, the label is the controller and we're its processor. The label's name is shown on the page and in any email you receive. If you have a question about a specific label's use of your data, contact the label, or contact us and we'll pass it on and help.

3. What we collect

From customers

• Account details: email address, label name, artist name, role, and your password, which we store only as a one-way bcrypt hash.
• Label settings: logo, timezone and location, theme, custom domain, reply-to address, and the IDs of any Meta, TikTok or Google Analytics pixels you add.
• Content: release titles, artwork, UPC/ISRC codes, store links, the lyric line you type for a share graphic, bio pages and invites you send, including the invitee's email address. Bio pages include the pictures you upload for the page background and for individual buttons, and any contact address you put on an email button — that address is published on a public page, so if it belongs to your manager, booker or anyone other than you, make sure they are happy for it to be there. The pictures you upload for merch items on a bio page are stored the same way. If you tick “Show it in the gallery”, the page's picture, name, bio line and address are also listed at droplr.fm/b until you untick it or make the page private; its view and tap counts never are.
• Spotify developer credentials, if you connect your own Spotify app. These are encrypted with AES-256-GCM before storage.
• SoundCloud developer credentials, if you connect your own SoundCloud app for download gates, encrypted the same way, along with the SoundCloud profile your gates point at.
• The subscribe box on a bio page: if an artist or label switches it on, their page shows a box where you can give your email address. We keep the address, that you ticked the consent box, when you did it, and which version of the wording you saw — recorded separately from a pre-save and from a download gate, because all three ask for different things. The wording names the artist or label, not droplr.fm: they are the ones who will email you, and you can unsubscribe from any email they send. Giving your address here is not a pre-save and does not put you on a release-day email for any particular release.
• Download gates: the link to wherever your files are kept, and the steps you ask fans to take. We store the link; the files stay with whoever hosts them, which is not us.
• Remix contests: the brief, prize, rules link and dates you set, and the notes you write against an entry while judging. Your notes are never shown to the entrant or to anyone else.
• Release clips: nothing. The clip is made in your browser from a track you pick on your own computer, and neither the audio nor the finished video is ever sent to us. We don't record that you made one, how long it was or what was in it.
• Billing: your plan and the customer and subscription IDs Stripe gives us. Your card and billing details go directly to Stripe and Link; we never see or store your full card number.
• Security records: when you agreed to the Terms, password reset requests (we store only a hash of the reset link, which expires after 60 minutes), and a record of failed logins and reset requests used for rate limiting. Those rate-limit records contain a hash of the email or IP address, not the address itself, and are deleted after a day.
• Support and feedback: what you tell us when you email us, and the messages in any feedback conversation you start in the dashboard, with your account and login attached.
• Notifications: if you turn them on, the push subscription your browser creates for that device (an address at your device's push service, plus the keys needed to encrypt a message to it), which notification types you want, and when the device was added. We don't receive your phone number or device ID.
• Invitations and referrals: invite links we or a label create, the email address they were sent to, when they were used, and which account signed up through a referral link.
• Product state: small settings such as whether you've finished the walkthrough, and which dashboard notices and help cards you've closed, so we don't show them again.

From fans (on behalf of labels)

• Email pre-saves: your email address, that you ticked the consent box, when you did it, and which version of the consent wording you saw. If you also tick the optional box for news and new music, we record that separately with its own time; without it, the artist or label may only email you about that release. Your chosen store and timezone, if given, are kept to send the release-day email at the right time and to the right place. We also record whether the release-day email was sent, whether you clicked it, and whether you unsubscribed.
• Fan emails from an artist or label: if you ticked the optional news box, that artist or label can send you occasional emails through droplr.fm. For each one we keep your address, which send it belonged to, when it went out, and any delivery failure the email provider reported, so the sender can see what happened and so nobody is emailed twice. Your consent is re-checked immediately before each batch: if you unsubscribe in the meantime, you are dropped from the send.
• Spotify or Deezer pre-saves, if you choose them: your account ID on that platform and an encrypted refresh token that lets us save the release to your library and follow the artist on release day. The platform's permission screen may also mention your email address; we don't store it from there. You can revoke access at any time in your Spotify or Deezer account settings.
• Download gates: if a gate asks for your email address, we keep the address, that you ticked the consent box, when, and which wording you saw — recorded separately from a pre-save, because the two ask for different things. We also keep an anonymous record of which steps you finished, so you don't have to do them twice and so the artist can see which step people stop at. That record uses the random visitor ID from your browser, not your name.
• Remix contest entries: if you enter a remix contest, we keep the link you paste, the artist name you give, your email address, any note you add, the country and device information described below, a one-way hash of your network address, and a dated copy of the exact wording you ticked. We never receive your audio — the track stays wherever you uploaded it. We check once, and again when entries close, whether the link still opens, and record only whether it did. Your email is used to send your confirmation and to contact you about that contest; entering is not a subscription, and you are not added to the label's fan list. Every confirmation carries a link that withdraws your entry.
• What is shown publicly, and when: nothing about an entry appears while entries are open. Once they close, the artist name you gave, your note and a player or link to your track are listed on that release's page, and people can vote for it. Your email address is never shown, and neither is anything the label writes about your entry. The wording you tick before entering says this; if you entered under an earlier version that didn't, your entry is left out of that list.
• Contest votes: if you vote, we record which entry, the random visitor ID from your browser, a one-way hash of your network address and your country. No account and no email. One vote per contest, which you can move to another entry; the hash is kept so a label can see how many separate networks a vote count came from before treating it as meaningful.
• SoundCloud gate steps: if you choose to connect SoundCloud, you are sent to SoundCloud to approve it. We then carry out the exact action the page described — a follow, like or repost — using the permission you just gave, and we immediately discard the access token. We do not store it, we do not keep your SoundCloud username or account ID, and we cannot do anything else with your account. All we record is that the step was completed. You can undo the follow, like or repost in SoundCloud at any time.
• Steps that open another website — Instagram, TikTok, YouTube, Spotify, Facebook or any link an artist adds — simply send you there. We record that you clicked; we cannot see what you do once you arrive, and no follow on those platforms can be checked by us or by anyone else. What happens on those sites is covered by their own privacy policies, not this one.
• Page and click analytics: which page and button you used, the time, your country (worked out by our hosting provider from your IP address), device type (mobile, tablet or desktop, from your browser's user agent), the referring website, campaign tags in the link, and a random visitor ID stored in a cookie.
• IP addresses: we don't store your raw IP address in our database. We store a one-way hash of it, mixed with a secret and the date so it changes every day, to help detect abuse and bot traffic. Our hosting provider may keep IP addresses in short-term server and security logs.

From visitors

Pages you visit on droplr.fm and the same kind of technical information as above. If you join the waitlist, your email address and when you joined; we use it only to tell you when droplr.fm opens and delete it on request. We don't run advertising pixels on the droplr.fm marketing site.

4. How we collect it

• Directly from you, when you sign up, fill in a form or email us.
• Automatically, through cookies and server requests when you use the service. See the Cookie Policy.
• From third parties: Stripe (payment status), Spotify or Deezer (when a fan connects an account), and a label that invites you to its team.
• From a label directly, if it uploads a list of fan email addresses it collected before it used droplr.fm. See Lists a label brings with them.
• Release details such as titles, artwork and store links come from public catalogues (Spotify, Apple's iTunes Search API and Deezer's public API). Those lookups use release codes, not personal information.

You can browse the droplr.fm website without giving us your name. You can't use an account or pre-save by email anonymously, because we need an email address to do it.

5. Lists a label brings with them

A label can upload a list of fan email addresses it already had — collected on its own site, or through a download gate or mailing list service it used before droplr.fm. If you're a fan, you may be on such a list.

The label is responsible for having your consent, not us. Consent you gave was given to that label, and moving the record between tools doesn't change what you agreed to. When a label imports a list it must tell us where the addresses came from, roughly when, and what people agreed to, and it must confirm it collected them directly and did not buy, scrape or swap them. We keep that statement on record.

What we store for an imported contact is the email address, and a name, country or timezone only if the label's file included them. We don't buy, sell, rent or enrich contact data, and we never import a list on a label's behalf from another service.

An imported address is never added to a release-day email. It can only receive a news email the label writes and sends. If the label told us the addresses were only ever given in exchange for a download — rather than to receive news — we mark them as unconfirmed and they can't be emailed at all until the person confirms.

If you had already unsubscribed from that label through droplr.fm, an import can't put you back: we check every uploaded address against our unsubscribe records and skip anyone who has opted out. Every news email carries a one-click unsubscribe, and using it stops all email from that label, including release-day emails.

To be removed from an imported list, use the unsubscribe link in any email from that label, contact the label directly, or email us at privacy@droplr.fm and we'll pass it on and help.

6. How we use it

• To run the service: logins, dashboards, public pages, link redirects and pre-saves.
• To send release-day emails and perform Spotify or Deezer saves on labels' behalf.
• To show labels analytics about their pages (views, clicks, sources, countries and pre-saves).
• To bill paid plans and keep financial records.
• To send service emails, such as password resets, security notices, receipts and changes to these policies.
• To keep droplr.fm secure: preventing fraud, spam, bots and abuse.
• To fix problems and improve the service, using aggregated or de-identified data where we can.
• To comply with the law and enforce our Terms.

We don't sell personal information, and we don't use one label's fan data for another label or for our own marketing.

7. Legal bases (EU and UK)

If the GDPR or UK GDPR applies, we rely on:

• Contract: to provide your account and paid plan;
• Consent: for release-day emails and connected Spotify/Deezer saves (withdraw it any time by unsubscribing or revoking access);
• Legitimate interests: for security, basic analytics for labels, and improving the service, balanced against your rights;
• Legal obligation: for tax records and responding to lawful requests.

8. Videos embedded from YouTube

Four places on droplr.fm show a video that lives on YouTube rather than on our servers, and in all of them YouTube receives information directly from your browser — your IP address, your browser and device details, and the address of the page you were on — because the player is loaded from Google, not from us. We never send YouTube your name, your email address or anything else from your account.

• "Watch the guide" cards in your dashboard. These show a still picture and a play button, and nothing is loaded from the player until you press play. The still picture itself comes from YouTube's image servers, which is a request for a picture and sets no cookies. Press play and the player loads from youtube-nocookie.com, Google's reduced-tracking address, which doesn't set its usual advertising cookies for a video you only watch — but it is still a connection to Google, and it still happens under your account's session in your browser. You can close any of these cards for good, and you can watch the same video on YouTube instead if you'd rather keep it away from this tab.
• News posts on the public site. Each post at /blog is a written article with the video of it above, and the player behaves exactly like a guide card: a still picture from YouTube's image servers, and nothing from the player until you press play. The difference worth stating is that you do not need an account to be on that page, so this is the second place a visitor rather than an account holder meets a YouTube request on droplr.fm. The article is the whole post in writing, so it reads the same if you never press play or if a content blocker stops the embed entirely.
• Videos on a bio page. An artist or label can add YouTube videos to their bio page. Before you press play, your browser makes no request to Google at all: the still picture is a copy we made and store ourselves when the video was added, and the title was looked up at the same time. Press play and the player loads from youtube-nocookie.com, and from then on YouTube receives what is described above. A “Watch on YouTube” link under each video goes through our own link, which counts the tap for the page's owner the same way as any other button on it.
• Remix contest entries on a public release page. Where an entrant's track is hosted somewhere that allows a player, we embed it so people can listen without leaving the page. This one loads as you scroll to it rather than waiting for a click, so for a YouTube-hosted entry your browser contacts Google as soon as that part of the page is reached. We are telling you this plainly because it is the one place a fan — not an account holder — meets a third-party player on droplr.fm without pressing anything first. We use the same youtube-nocookie.com address there.

What Google does with what it receives is governed by its own privacy policy, not ours, and we have no access to it. If you would rather no YouTube request happened at all, a content blocker or your browser's third-party content settings will stop the embed loading, and the rest of the page works without it.

9. Who we share it with

We share personal information only as needed to run droplr.fm:

We may also disclose information to professional advisers, to law enforcement or regulators when the law requires it, to protect people's safety or our legal rights, or to a buyer if the droplr.fm business is sold, under the same protections as this policy.

10. Where it's stored and overseas disclosure

Our main database is in Sydney, Australia. Our hosting, email and payment providers process information in the United States and may use other countries. We choose providers with strong security practices and contractual privacy commitments. Where the GDPR applies, transfers rely on adequacy decisions or the European Commission's Standard Contractual Clauses.

11. Security and data breaches

• All traffic is encrypted with HTTPS.
• Passwords are hashed. Spotify credentials and platform tokens are encrypted at rest.
• Login sessions use secure, HTTP-only cookies. Each label's data is separated by account, and artists only see their own releases.
• Access to production systems is limited to people who need it.

No system is perfectly secure. If a data breach is likely to cause serious harm, we'll notify affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and notify affected labels without undue delay.

12. How long we keep it

• Customer accounts: kept while the account is open. If the owner closes the account themselves in Settings, it and its data are deleted immediately — the page offers the fan list as a download first — and copies in backups are overwritten in the normal cycle. Where we closed the account, or closed it at your request, we delete or de-identify account data within 90 days and you can ask for an export during the first 30.
• Fan data: kept until the label deletes the release (which deletes its pre-saves and analytics), closes its account (deleted within 90 days of closure), or asks us to delete it. If you unsubscribe, we keep your email address marked as unsubscribed so that label can't email you through droplr.fm again.
• Interest in features we haven't built: some parts of droplr.fm have a tick box for something that doesn't exist yet, such as letting labels hear an unreleased track or taking booking enquiries. We record whether you ticked it and when. Ticking it shares nothing with anyone and shows nothing publicly — it tells us you want the feature. If we build it, we'll tell you before anything you've ticked is used.
• Shared release reports: if an artist or label turns one on, the page shows totals for that release only — counts of pre-saves, clicks and views, and which stores and countries they came from. It never shows an email address or anything else that identifies a fan. The sharing address is kept until they turn sharing off or reissue it, and either of those makes the old address stop working immediately.
• Notification subscriptions: kept until you turn notifications off, remove that device, uninstall the app, or the push service tells us the subscription is dead, when we delete it. All of them are deleted when the account closes.
• Feedback conversations: kept while your account is open so we have the history of what you asked, and deleted with the account within 90 days of closure.
• Invites and referral records: kept while they can still be used and for our records of how an account was created; deleted with the account.
• Imported fan contacts: kept until the label deletes them, closes its account (deleted within 90 days of closure), or you ask to be removed. If you unsubscribe we keep your address marked as unsubscribed so that label can't email you through droplr.fm again.
• Contest entries and votes: kept while the contest exists, because an entry is also the record of what its entrant declared. Deleted when the label deletes the release or the contest, when it closes its account (within 90 days of closure), or when you ask us to remove your entry. Withdrawing an entry keeps the row but takes it out of the contest and off the public page; ask us if you want it deleted outright. A contest that has entries can't be deleted by the label by accident.
• Billing records: kept for as long as tax law requires, generally five years in Australia.
• Backups and logs: overwritten on our providers' normal cycles.

13. Your choices and rights

• Access and correction. Customers can see and edit most of their information in the dashboard. Anyone can ask us for a copy of the personal information we hold about them, or to correct it. We don't charge for requests.
• Deletion. Ask us to delete your information. We may need to keep some records for legal reasons, and we'll tell you if so.
• Unsubscribe. Every release-day email has an unsubscribe link. It opens a page with a single Unsubscribe button, so an email security scanner that opens links can't unsubscribe you by accident; email apps with a built-in unsubscribe button do it in one step. It stops all droplr.fm emails from that label. If you didn't mean to, the confirmation page has a link that turns release emails back on for 30 days. Only you can use it: a label can never re-subscribe you.
• Revoke platform access in your Spotify or Deezer account settings under connected apps.
• Notifications. Turn them off for a login or a single device in Account, or in your device's notification settings. Turning them off deletes that device's subscription.
• EU and UK residents also have the right to data portability, to restrict or object to processing, and to complain to their local data protection authority.
• US state privacy laws. Where they apply, you can request access or deletion in the same way. We don't sell or share personal information for cross-context behavioural advertising; label pixels are controlled by the label.

Email privacy@droplr.fm with the subject "Privacy request". We'll confirm who you are and reply within 30 days. For fan data, we'll work with the relevant label.

14. Emails from us

We send customers service emails you can't opt out of while you have an account, such as security alerts and billing receipts. If we send product news, it will have an unsubscribe link, and you can opt out at any time. We never send marketing to fans.

15. Children

droplr.fm accounts are for people 18 and over. Fan pages aren't directed at children, and people under 16 shouldn't sign up for release-day emails without a parent or guardian's permission. If you believe a child has given us personal information, contact us and we'll delete it.

16. Automated decisions

droplr.fm doesn't use computer programs to make decisions that significantly affect people's rights or interests. Automated processing is limited to things like counting clicks, filtering bots and scheduling release-day emails. If that changes, we'll update this policy to describe the kinds of personal information involved.

17. Changes to this policy

We'll update this policy when our practices or the law change. The date at the top shows the latest version. For material changes we'll notify customers by email or in the dashboard before they take effect.

18. Contact and complaints

Privacy questions and requests: privacy@droplr.fm, or write to Cody Morrison, Rhythm Revolt Records, PO Box 109, Zillmere QLD 4034, Australia.

If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. If you're in the EU or UK, you can contact your local data protection authority.