1. Controller and scope
The controller of personal data processed by DropHarbor is FOP Ovcharenko Ruslan Serhiiovych, Ukraine, taxpayer/registration number 3482609212. Privacy contact: [email protected]; general support: [email protected].
This Policy applies to dropharbor.app, DropHarbor accounts, cloud automation, notifications, billing integration, and support. Twitch, Paddle, Telegram, Mailjet, Cloudflare, and other third parties also process information under their own notices. Paddle acts as merchant of record and independently determines parts of payment processing required for a transaction.
2. Data we process
- Account data: email address, password hash, preferred language, account status, verification and deletion dates, and administrator security data where applicable.
- Twitch data: user ID, public profile, connection and session expiry, verified session material in the isolated cloud-module volume, and encrypted OAuth tokens for older connections. A temporary server browser processes the sign-in page; its profile is deleted after verification or expiry, and sign-in credentials are not recorded in application logs.
- Service data: selected games and priorities, ignored reward keywords, miner state, campaigns, progress, claimed-Drop history, errors, and actions you request.
- Subscription and transaction data: plan, account limit, status, dates, Paddle customer/subscription/transaction identifiers, amount, currency, payment status, and refund or cancellation events. DropHarbor does not receive full card number, security code, or reusable card credentials.
- Referral data: referral code, attribution between the inviting and newly created accounts, qualification and reward status, related payment and subscription identifiers, review and expiry dates, and fraud-prevention events.
- Communications: notification preferences, delivery status and provider message ID, Telegram user/chat IDs if connected, and the email, subject, message, status, and time of support requests.
- Technical and security data: IP address in short-lived operational logs, hashed IP and user-agent values attached to sessions, session and CSRF identifiers, locale/currency preferences, timestamps, audit events, diagnostics, and internal product events such as registration or feature use.
3. Sources
We receive data directly from you, your browser, connected Twitch or Telegram accounts, Paddle transaction and subscription events, and the operation of DropHarbor’s miners. Public campaign, category, artwork, and reward metadata may come from Twitch and game publishers.
4. Purposes and legal bases
We do not use special-category data and ask you not to send it through support. We do not make decisions producing legal or similarly significant effects solely by automated processing.
- Contract: create and authenticate your account; connect accounts; run the automation you configure; show progress; provide subscriptions, support, and transactional notices.
- Legal obligations: maintain transaction, tax, accounting, consumer, and compliance records; respond to valid legal requests.
- Legitimate interests: secure the Service, prevent fraud and abuse, diagnose faults, plan capacity, keep audit trails, defend claims, and improve reliability, balanced against your rights.
- Consent: optional Telegram connection, optional notification channels, and any processing for which applicable law requires consent. You may withdraw consent without affecting earlier lawful processing.
5. Cookies and similar storage
DropHarbor does not currently use its own advertising cookies or sell behavioural profiles. Blocking necessary cookies may prevent login, security controls, preferences, or checkout from working.
- dh_session authenticates an account and normally expires after 30 days; the server stores only its hash.
- dh_csrf protects forms from cross-site requests and normally expires after one hour.
- dh_locale and dh_currency remember language and display-currency choices for up to one year.
- dh_ref remembers an accepted referral code for up to the configured referral-cookie period so it can be attached to a newly created account; it is removed after successful registration.
- Paddle and Cloudflare may set their own cookies or process device/network data for checkout, fraud prevention, security, and service delivery under their notices.
6. Recipients and processors
We disclose only what is reasonably necessary for the relevant function. We do not sell or rent personal data.
- Twitch/Amazon, to authenticate the connected account and provide requested platform interaction.
- Paddle, as merchant of record and payment/billing provider.
- Mailjet, to send verification, reset, service, and support email.
- Telegram, only when you connect the bot or enable Telegram notifications.
- Cloudflare, cloud-hosting, network, database, backup, and infrastructure providers used to deliver and protect the Service.
- Professional advisers, insurers, purchasers of a business subject to confidentiality, and competent authorities where necessary or legally required.
7. Storage location and international transfers
DropHarbor is operated from Ukraine using cloud infrastructure. Providers listed above operate internationally, so information may be processed in Ukraine, the EEA, the United Kingdom, the United States, and other countries where a provider or subprocessor operates. Those countries may provide different legal protections.
Where GDPR or comparable law applies and a transfer requires safeguards, we rely as applicable on an adequacy decision, Standard Contractual Clauses, a provider’s recognised certification, or another lawful transfer mechanism. Information about the relevant safeguard may be requested at [email protected].
8. Retention
- Account and operational data are kept while the account is active and as needed to provide the Service.
- Session and authorisation tokens expire according to their function or are invalidated on logout, password reset, disconnection, or deletion. Local rotating technical logs are kept only as needed for operations and security; incident evidence may be retained until the matter is resolved.
- When you request account deletion, access is disabled immediately. After the configured safety period, normally 30 days, Twitch connections, miner and Drop history, sessions, notification data, Telegram links, and support content tied to the account are deleted or anonymised.
- The account row and analytics events are de-identified. Subscription, transaction, accounting, fraud, audit, dispute, and legal records are retained for the period required by applicable law or necessary to establish or defend claims, then deleted or anonymised.
- To prevent repeated free trials, we retain the Twitch user ID and the identifier of the account that first used its trial in a separate fraud-prevention record after Twitch is disconnected or the DropHarbor account is de-identified. This record contains no Twitch tokens or profile details. Contact [email protected] about retention or your rights.
- Encrypted backups may temporarily contain older data until rotation; restored data remains subject to the deletion request and will be removed again through the normal process.
9. Security
We use HTTPS, access controls, least-privilege service separation, hashed passwords and session identifiers, isolated private storage for Twitch sessions and encryption of legacy OAuth tokens, signed payment webhooks and checkout metadata, audit logging, encrypted backups, and restricted administrative access. No system is perfectly secure. If you suspect compromise, disconnect Twitch, change relevant passwords, and contact support immediately.
10. Your choices and rights
Send a request from the account email to [email protected] and describe the right you wish to exercise. We may verify identity and may retain information where a legal exception applies. We aim to answer within 30 calendar days, or sooner when local law requires.
- Access and obtain information about your personal data; request a copy in a practical electronic format where applicable.
- Correct inaccurate information; object to or restrict certain processing; withdraw consent where consent is the basis.
- Disconnect Twitch or Telegram, change notification preferences, cancel renewal, or request account deletion from Settings.
- Request deletion or portability where applicable, and complain to the Ukrainian Parliament Commissioner for Human Rights or another competent data-protection authority or court.
11. Children
DropHarbor is not directed to anyone below Twitch’s applicable minimum age. A minor who meets that minimum may use the Service only with the supervision and consent of a parent or guardian. If you believe a child provided data without valid authority, contact [email protected] so we can investigate and delete it where required.
12. Changes and contact
We may update this Policy when the Service, providers, or legal requirements change. Material changes will be announced in the Service or by email where reasonably required. The current version and date remain available on this page. Questions and requests: [email protected].