Privacy

• Email address when you subscribe. Required for the newsletter to reach you.
• IP address and user-agent on subscribe — used for rate-limiting the signup form, blocking abuse, and verifying that the inbox can receive mail (MX lookup). Stored on the subscriber row.
• Click events when you tap an affiliate link via /go/[slug]. We log which drop you clicked, the referrer, the user-agent, UTM params, and a one-way hash of your IP — never the raw IP.
• Anonymous traffic data via Vercel Analytics. No cookies, no cross-site tracking, no fingerprinting. Aggregate page views only.
• Submission form data if you pitch a drop — name, email, tool name, URL, your description. Used to reply to you.

• Tracking cookies. Vercel Analytics is cookieless.
• Browser fingerprints, ad-tech identifiers, third-party trackers.
• Payment information. We don't take payments — affiliate networks do.
• Personal data we don't need to deliver the newsletter.

• Supabase (Postgres, hosted in the US) — subscribers, click events, submissions.
• Resend — sends the confirmation, welcome, and drop emails. Resend sees your email address and the email contents.
• Vercel — hosts the site and collects anonymous traffic analytics.
• Cloudflare (DNS) — sees connection metadata as part of routing requests.

We don't sell, rent, or share your data with anyone outside this list of processors. Affiliate clicks pass through /go/[slug] on our domain first — we don't hand the affiliate network any extra data they wouldn't already see when you arrive at their site.

Most drop CTAs are affiliate links. When you buy through one, Predrop earns a commission at no extra cost to you. Every drop page discloses this inline. The choice to feature a drop is editorial — commission size never decides what runs.

• Subscriber rows: until you unsubscribe + 30 days, then deleted.
• IP address + user-agent on subscribe: rotated after 30 days.
• Click events: kept for analytics aggregation; raw IPs are never stored.
• Submission form data: kept while we triage, then archived.

You can unsubscribe via the one-click link at the bottom of every email — no account required. To request export or full deletion of everything tied to your address, email hi@predrop.ai and we'll handle it within 30 days. EU/UK readers have GDPR rights (access, rectification, erasure, portability, objection); they apply here too.

Predrop is built for working AI builders and operators. The newsletter isn't directed at anyone under 16 and we don't knowingly collect data from children.

When this page changes, the "last updated" date at the top changes too. Material changes that affect existing subscribers will be announced in the newsletter before they take effect.