Privacy policy

The data controller is hotdrop, the operator of this website. For any privacy question, you can reach us at hello@hotdrop.app.

Account data: your name, username, email address and password (stored as a secure hash, never in plain text). If you sign up with Google or GitHub, we receive basic profile information from that service, such as your name, email and profile picture.

Content you post: deals, comments, your bio and anything else you choose to share. This content is public.

Activity on the site: your votes, saved deals, the people you follow, your alerts, reports and notifications.

Session data: when you log in, we store your IP address and user agent (browser and operating system) with the session to keep your account secure and spot suspicious sign-ins.

To provide the service: creating and managing your account, publishing your content, calculating temperature and karma, sending you notifications and telling you about deals that match your alerts. Our legal basis is performance of the contract you accept when you sign up (our terms of use).

To keep the site safe: moderating content, handling reports, preventing fraud, spam and abuse, and protecting accounts. Our legal basis is our legitimate interest in running a safe and reliable service.

To send essential transactional emails, such as password reset links. Our legal basis is performance of the contract.

To comply with legal obligations where the law requires it.

We don't sell your data or use it for targeted advertising.

We only use strictly necessary cookies: a session cookie that keeps you logged in, and the NEXT_LOCALE cookie that remembers your language. We also save your theme preference (light or dark) in your browser's local storage.

To understand how the site is used we rely on Vercel Web Analytics, which uses no cookies or persistent identifiers: it counts visits in aggregate and anonymously (page, country, device type and browser) and doesn't track you across sites. Before each visit is sent we strip sensitive data from the URL, such as password reset links.

We don't use advertising cookies. Because the cookies we set are essential for the site to work, they don't require your consent, which is why you won't see a cookie banner.

When you click “Get deal”, you pass through a redirect from our affiliate partner Sovrn Commerce on the way to the store. Sovrn and the store may set their own cookies to attribute the purchase, under their own privacy policies.

We rely on service providers that process data on our behalf (data processors), only to deliver their service to us: Turso for database hosting; Vercel for web hosting and anonymous visit analytics; and Resend for transactional emails such as password resets.

If you choose to log in with Google or GitHub, those services take part in authentication under their own privacy policies.

Some of these providers may process data outside the European Economic Area. Where that happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

Beyond this, we'll only share data when required by law or by a competent authority.

We keep your data for as long as your account is active. When you delete your account from settings, we delete your profile and the content linked to it (deals, comments, votes, saved deals, follows and alerts).

Backups are rotated regularly, so deleted data also disappears from them as they're replaced. We may keep some information for longer where the law requires it.

You have the right to access, rectify, erase and port your data, and to restrict or object to its processing. You can do a lot of this yourself: edit your name and bio, or delete your account, from settings. For anything else, email us at hello@hotdrop.app.

If you believe we haven't handled your data properly, you can lodge a complaint with your data protection supervisory authority. In Spain, that's the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

We take reasonable technical and organisational measures to protect your data, including encrypted connections, hashed passwords and restricted access to our systems. No system is bulletproof, so we recommend using a unique password for your account.

hotdrop isn't intended for anyone under 16, and we don't knowingly collect their data. If you think a child has given us personal data, let us know and we'll delete it.

We may update this policy to reflect changes to the service or the law. The date of the latest update is shown at the top, and we'll let you know on the site if the changes are significant.