Privacy Policy

1. Who we are

DropAVibe ("we," "us," or "our") operates the DropAVibe platform available at dropavibe.com. We are the data controller responsible for your personal information.

If you have any questions about this policy, contact us at support@dropavibe.com.

2. Information we collect

Information you provide

• Account information — username, email address, and password when you register or claim a ghost account
• Profile information — bio, city, and any other details you choose to add
• Vibe content — mood selections, optional text notes attached to your pins
• Communications — messages you send to our support team

Information collected automatically

• Location data — approximate GPS coordinates when you drop a vibe pin. We use this only to place your pin on the map and identify your city. We do not track your location continuously.
• Device information — browser type, device type, operating system
• Usage data — pages visited, features used, time spent in the app
• IP address — used for security, fraud prevention, and approximate location
• Cookies and local storage — used to maintain your session and ghost account token

Ghost accounts

Payment information

If you subscribe to DropAVibe Pro, payments are processed by Stripe. We do not store your credit card number, CVV, or full payment details on our servers. We receive only a customer ID and subscription status from Stripe.

3. How we use your information

• To display your mood pins on the live map
• To provide and improve the DropAVibe service
• To send notifications about reactions, comments, and followers
• To calculate streak counts, badges, and mood statistics
• To process Pro subscription payments via Stripe
• To detect and prevent spam, abuse, and fraudulent activity
• To respond to your support requests
• To comply with legal obligations

We do not sell your personal information to third parties. We do not use your mood data for advertising profiling.

4. Location data

Location access is requested only when you drop a vibe pin. We use your coordinates to place the pin on the map and identify the nearest city and neighborhood via OpenStreetMap's Nominatim service (a privacy-respecting, open-source geocoder).

Your precise coordinates are stored in our database attached to your vibe pin. Vibe pins expire and are deleted after 2 hours. We do not track your location continuously or in the background.

You may deny location permission — in that case, we will use your account's last known city as a fallback.

5. Data sharing

We share your information only in these limited circumstances:

• Public content — your username, mood, city, neighborhood, and any note you add to a vibe are visible to other DropAVibe users on the map and in the feed
• Stripe — for processing Pro subscription payments
• OpenStreetMap / Nominatim — your coordinates are sent to reverse-geocode your city (no account required, no tracking)
• Hosting providers — our servers are hosted on Hostinger. Your data is stored on their infrastructure subject to their security standards
• Legal requirements — if required by law, court order, or to protect the safety of users

6. Data retention

• Vibe pins — automatically deleted 2 hours after posting
• Mood journal entries — kept for as long as your account exists
• Account data — kept until you delete your account
• Ghost accounts — deleted after 90 days of inactivity
• Notifications — deleted after 30 days
• Server logs — retained for up to 90 days for security purposes

7. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Correction — update inaccurate information via your profile settings
• Deletion — request deletion of your account and all associated data
• Portability — request your data in a portable format
• Objection — object to certain processing of your data
• Withdrawal of consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, email us at support@dropavibe.com. We will respond within 30 days.

8. Cookies

We use the following cookies and local storage items:

• dropavibe_sess — session cookie to keep you logged in (expires in 90 days)
• ghost_token — stored in localStorage to identify your anonymous ghost account

We do not use advertising cookies, analytics cookies from third parties, or tracking pixels.

9. Children's privacy

DropAVibe is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@dropavibe.com and we will delete it promptly.

10. Security

We implement industry-standard security measures including HTTPS encryption for all data in transit, password hashing using bcrypt, prepared SQL statements to prevent injection attacks, session tokens using cryptographically secure random bytes, and rate limiting on API endpoints.

No system is completely secure. If you discover a security vulnerability, please report it responsibly to support@dropavibe.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will notify you via an in-app notification. Continued use of DropAVibe after changes constitutes acceptance of the updated policy.