PRIVACY POLICY

1. SCOPE

This policy explains how Cocotofy LLC processes personal information when you visit, sign in to, upload to, or administer DROP3. It does not govern code or services operated by users inside their hosted drops.

2. INFORMATION WE COLLECT

Account data

When you use Google sign-in, we receive your Google account identifier, verified email address, name, and profile image. We create a DROP3 username, role, plan, session, and terms-acceptance record.

Build data

We process uploaded files, paths, content types, file sizes, drop names, deployment identifiers, timestamps, visibility, and deletion status. Hosted drops are public or unlisted and should not contain confidential information.

Usage and device data

We record events such as sign-ins, uploads, publishes, deletes, storage totals, file operations, asset requests, response bytes, cache status, approximate country, browser information, errors, and security signals. Cloudflare may process IP addresses and network data to deliver and secure requests. DROP3 does not intentionally store raw IP addresses in its account database.

Communications and payments

If you contact us or later purchase a plan, we process correspondence, support details, billing status, and transaction references. Payment processors handle full payment credentials under their own policies.

3. HOW WE USE INFORMATION

• Authenticate users and maintain sessions.
• Store, publish, replace, and delete drops.
• Show account usage and enforce quotas.
• Measure infrastructure cost and support future usage billing.
• Detect abuse, malware, fraud, outages, and policy violations.
• Provide support, legal notices, and service updates.
• Analyze and improve reliability and product design.
• Comply with law and protect rights and safety.

4. LEGAL BASES

Where applicable, we process information to perform our contract with you, pursue legitimate interests in operating and securing DROP3, comply with legal obligations, and act with your consent when consent is required.

5. SERVICE PROVIDERS

We use providers including Cloudflare for compute, storage, databases, security, and analytics, and Google for identity. We may use payment, email, monitoring, or support providers when those features launch. Providers process information for us under their own contractual and legal obligations.

We may disclose information during a business transaction, to comply with valid legal process, to enforce policies, or to protect users, Cocotofy, and others. We do not sell personal information or share it for cross-context behavioral advertising.

6. COOKIES

DROP3 uses essential host-only cookies for login nonce protection and authenticated sessions. These cookies are not made available to user-hosted subdomains. Local storage remembers display preferences. Google may set or read its own cookies when you choose Google sign-in.

7. RETENTION

Account and ownership records remain while your account is active and as needed for security, billing, disputes, and legal compliance. Expired sessions and incomplete uploads are periodically removed. Deleted or replaced files are scheduled for deletion but may remain temporarily in caches, logs, backups, or required records. Analytics retention depends on the applicable provider and configuration.

8. SECURITY

We use signed identity tokens, hashed session tokens, host-isolated cookies, access controls, encrypted transport, tenant-scoped object keys, quotas, logs, and platform security controls. No system is completely secure. Keep your originals and do not upload secrets or sensitive personal data.

9. YOUR CHOICES AND RIGHTS

You may update your username, delete drops, sign out, or request account access, correction, deletion, or export by contacting us. Depending on your location, you may also have rights to restrict or object to processing, withdraw consent, or appeal a decision. We may verify your identity before fulfilling a request and retain information where legally permitted or required.

10. CHILDREN

DROP3 is not directed to children under 13 and is not intended for anyone below the minimum digital-consent age in their jurisdiction. Contact us if you believe a child provided personal information improperly.

11. INTERNATIONAL PROCESSING

Cocotofy and its providers may process data in the United States and other countries. Where required, we rely on recognized transfer mechanisms and provider safeguards.

12. CHANGES AND CONTACT

We may update this policy and will revise the date above. Material changes may be announced in DROP3 or by email.

Cocotofy LLC
cocotofyllc@gmail.com
Use the subject "DROP3 PRIVACY REQUEST."