// Privacy Policy

Your data,
plainly explained.

Last updated · February 2026

Summary (the TL;DR)

We collect the minimum data needed to run The Drop Calendar. If you never sign in, we store nothing about you on our servers — your watchlist lives only in your browser.

If you sign in with Google, we store your email, name, and profile picture so we can sync your watchlist and (optionally) email you launch reminders.

We don't sell your data. We don't run ads. We don't share your data with third parties except the strict service providers listed below.

What we collect

Guest browsing — Nothing on our servers. Your watchlist, vote choices, and hype clicks are stored only in your browser (localStorage).
Signed-in accounts — Your Google email, display name, and profile picture (received via Emergent-managed Google OAuth). No password is ever stored because Google handles authentication.
Watchlist — The drop IDs you've marked with 'Notify Me' and whether you've opted in to email reminders.
Interactions — Aggregate counts of votes and hype clicks per drop (not tied to your identity).
Technical logs — Server logs may temporarily record request IPs and user agents for security and debugging. These are rotated and not linked to your profile.

Why we collect it

To sync your watchlist across devices when you sign in.
To send you launch reminders — only if you explicitly opt in per drop.
To display which drops the community is hyped about (aggregate only).
To protect the service from abuse.

Who processes your data

The Drop Calendar uses a small number of processors, each strictly for a stated purpose:

Google (via Emergent-managed OAuth) — authentication only. We never see your Google password.
MongoDB Atlas (or self-hosted MongoDB) — stores your account and watchlist.
Resend — sends launch-reminder emails, only if the feature is enabled and you opt in.
Alpha Vantage — reads public IPO calendar data. This service never receives any personal information about you.

Cookies

We use one first-party cookie: a session token (httpOnly, Secure, SameSite=None) that keeps you signed in for 7 days. It is not used for tracking or advertising.

We do not use third-party analytics or advertising cookies.

Your rights

You can, at any time:

Sign out — instantly ends your session on this device.
Delete your watchlist — remove items one at a time or clear your browser storage.
Delete your account — email us and we will erase all data associated with your email within 30 days.
Export your data — email us to receive a JSON copy of your profile and watchlist.
Object or restrict — you can ask us to stop specific processing (e.g., reminder emails) by turning them off in-app or contacting us.

Data retention

Account data: kept while your account is active. Deleted within 30 days of an account-deletion request.

Session tokens: expire after 7 days automatically.

Server logs: rotated within 30 days.

Aggregated interaction counters (poll votes, hype meter): retained indefinitely because they're not tied to any individual.

Children

The Drop Calendar is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, please contact us and we will delete it.

Security

All traffic is served over HTTPS. Passwords are never stored (Google OAuth). Session cookies are httpOnly and Secure. Access to the database is restricted to the backend service.

No system is perfectly secure. We aim to disclose any material breach to affected users within 72 hours of discovery.

Changes to this policy

If we make material changes, we will update the 'Last updated' date and, for signed-in users, surface a one-time notice in the app before the changes take effect.

Contact

Questions, deletion requests, or data exports: reach the maintainer directly at the email associated with the admin account. Response time is typically within a few business days.

← Back to the board

Your data,plainly explained.