Privacy Policy

1. Who is responsible

DropTactics is responsible for the personal information described in this policy. For questions about personal information or to exercise your rights, contact support@droptactics.com.

This policy covers DropTactics and its test website. External services have their own privacy notices.

2. Information we collect and why

Account and security information

Your email address, account identifier, password hash if you use a password, email verification status, account creation and sign-in times, and session and security records. We use these to create and secure your account, confirm your email, restore access, and manage your sessions. Passwords are stored as salted hashes.

Discord sign-in

When you choose Discord sign-in or linking, we receive your Discord identifier, display name, email address and email verification status. We use these to sign you in or connect the correct DropTactics account. We do not receive your Discord password. This integration does not request your messages, friends list, or server memberships.

Epic Games connection and free trial

When you connect Epic Games, we request basic profile access. The response may include your account identifier, display name, preferred language and linked account display names. We use this response to confirm your identity; we keep your Epic account identifier, display name, the connection/check time, and the names of profile fields observed during the connection check. We do not keep the language or linked account display-name values in our account database. We use the identifier to link your account and enforce one free trial per DropTactics account and Epic Games account. We record the trial's start and end time. We do not receive your Epic password. Our integration does not retrieve Fortnite playtime or match history.

Plans, access and rewards

We store routes you save, your access entitlements, redeemed codes, referral or creator attribution, purchase history, reward amounts, and settlement records. These records let us restore your plans, apply eligible discounts, calculate rewards, prevent duplicate use, and record access changes.

Payments

Where payments are enabled, PayPal processes the checkout. DropTactics receives payment identifiers, amounts, currency, payment status and refund information. We keep order, reward and payout records needed to administer the transaction, the version of purchase terms and early-start request accepted at checkout, and purchase withdrawal or complaint records including your submitted name, statement and timestamps. If you request a payout, we also keep the PayPal email address you provide, the requested amount, request status and the payment or review outcome. Our checkout does not collect your full card number or card security code. Payments explicitly marked Sandbox or test are simulated.

Support and technical records

If you contact us, we receive the email address and message you provide. Website and security logs may contain your IP address, browser information, requested address, timestamp and error details. We use these to respond to you, operate the site, diagnose faults and prevent abuse.

3. Cookies and browser storage

DropTactics uses a session cookie to keep you signed in, with a maximum lifetime of seven days. A short-lived Discord sign-in cookie helps protect the connection flow and expires after five minutes. Logging out ends your current DropTactics session.

The browser also stores interface preferences and a pending referral or creator code. A successfully processed invite is removed from temporary browser storage; the account attribution remains in our account records. You can remove browser storage in your browser settings, which may reset preferences or sign you out. External services may use their own cookies when you visit them.

Optional advertising measurement. On droptactics.com, Google Ads is loaded only if you choose Allow ad measurement. It connects advertising clicks with confirmed paid purchases, using advertising identifiers and cookies, browser/network information, and the purchase amount, currency and a random order reference. We do not include your email, DropTactics account identifier, Discord or Epic details, payment credentials or email-confirmation tokens in our conversion events. Enhanced conversions and ad personalization are not enabled by this integration. Google receives these measurement data and may process them in the United States or other countries; see Google's privacy policy and how Google uses information from sites that use its services.

Your choice is stored in this browser for up to 180 days. Google advertising measurement cookies may last up to 90 days. Choose Cookie settings in the app at any time to withdraw permission. Withdrawal stops future measurement from this integration and removes its accessible first-party advertising cookies; it does not undo data already sent. Declining optional measurement does not prevent using the site or making purchases.

4. Purposes and legal grounds

We use information needed to provide the account, planner, requested connections, access and purchases. We also use necessary security and trial or reward abuse records for our legitimate interests in protecting the service, taking account of your rights. Where applicable, payment and other records may be retained to meet legal obligations or handle legal claims.

Connecting Discord or Epic is initiated by you through that provider's permission screen. You can stop future access through the provider's account settings. This does not automatically delete records already held by DropTactics; contact us to request account deletion or discuss a connection.

5. Who receives information

Account records are available to authorized DropTactics administrators for operation, support, security, payments and reward administration. Referrers and creators see aggregate attributed signup and purchase counts and their own earnings and settlement history; their dashboard does not provide a list of referred users' email addresses.

Our website and account database use VPS hosting supplied by Contabo in its Hub Europe region. We use Namecheap Private Email for account email and support messages. Authorized operation and backup handling also take place in Serbia. Discord and Epic Games receive the information necessary for the connection you initiate; PayPal receives checkout information where you choose that payment option. We may disclose necessary records if required by law or to establish or defend legal claims.

These providers may process information outside your country, including the United States. Namecheap publishes a data processing addendum containing standard contractual clauses for relevant transfers. For details about the hosting location and safeguards applicable to your information, or to request a copy where applicable, contact us.

External services describe their own processing in their notices: Epic Games, Discord, PayPal, Namecheap, and Contabo.

6. How long information is kept

We apply the following retention rules. A specific legal requirement or an unresolved dispute may require selected records to be held longer. Such a hold applies to the records needed for that purpose, not automatically to the whole account.

Open accounts and saved routes

Kept while your account is open. After a verified closure request, we remove information no longer needed for the exceptions below and explain any information we need to retain. Account expiry or the end of a pass does not itself close the account.

Unconfirmed registrations

Removed after 30 days without email confirmation, measured from the latest requested confirmation email, where the registration has no active access, payment, reward, dispute or other record requiring review.

Sign-in and recovery records

Unused expired session and email-action records are removed within 30 days after expiry. Confirmation links are valid for 24 hours and password-reset links for 30 minutes; expiry ends their use before the later cleanup.

Free-trial eligibility

After a trial has been used, a limited record of protected email and Epic identifier fingerprints and trial dates may be retained while the one-time trial programme operates, to prevent repeat claims using another account. We review the continued need for this record at least annually and when you object or request deletion. For closed accounts, this record uses keyed fingerprints instead of the original email and Epic identifier. These fingerprints remain personal data, not anonymous data. It does not include saved routes, your password or provider display names. If no longer necessary or legally permitted, it is removed. Deleting an account does not promise a new free trial.

Purchases, refunds and rewards

Kept while an order, purchased access, refund, reward balance, settlement or dispute remains open, and for any applicable mandatory accounting or tax retention period afterwards. The applicable period depends on the record and obligation; an open claim is reviewed until resolved. Unneeded test-only transaction records are removed within 90 days after the related test is closed.

Support correspondence

Ordinary support messages are removed within 12 months after the last substantive exchange. If a message is evidence for an unresolved payment, security incident or legal claim, only the necessary evidence is kept under that case's retention rule.

Technical logs

The web server keeps a rotating set of the 14 most recent non-empty daily log archives, plus the current log. Empty days do not produce a new archive, so this may cover more than 14 calendar days. Selected incident evidence is retained only while needed to investigate or address that incident or a related claim.

Backups and request records

Routine account-database backup copies are removed within 30 days of creation unless a specific recovery incident or legal hold requires a selected copy. Deleted information may remain in restricted backups until those copies expire; any restoration must reapply completed deletions before normal use. We keep a minimal record of a completed privacy request and our response for 12 months, unless an unresolved complaint or legal duty requires longer.

Retention is administered by the operator using scheduled cleanup for eligible abandoned registrations, expired sign-in records, completed request records and catalogued recovery copies. Records requiring individual review, including account closure, open financial matters, trial eligibility and support correspondence, are handled separately; not every deletion is an automatic feature of the website.

7. Access, correction and deletion

Email support@droptactics.com from your account address to request access to or a copy of your information, correction, or account deletion. The operator verifies and reviews requests. An admin closure tool removes login and unnecessary profile data after this review; the current site does not have a self-service account deletion button. We may ask for proportionate information to verify that the request comes from the account holder. Do not send passwords, card details or identity documents unless we explain why a specific verification step is necessary.

We review the request, identify the account records concerned and explain what will be deleted and any limited records that must remain. Closure ends sign-in access and removes saved routes, password information and provider links no longer needed. A restricted account reference may remain to preserve financial or redeemed-code relationships. A private restoration journal reapplies closures before a restored database serves users. Financial records, request evidence and trial fingerprints follow the separate retention criteria above. Outstanding money, purchases or disputes are reviewed separately; a deletion request does not silently forfeit a reward balance or settle a payment dispute.

We aim to respond within one month of receiving the request and follow any shorter or other deadline required by applicable law. Where an extension is legally permitted, we will explain the reason and revised timing. Depending on applicable law, you may also have rights to portability, restriction, objection, and withdrawal of consent where processing relies on consent. You may raise a complaint with the competent data protection authority, including the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, or your local authority where applicable.

8. Questions and changes

If you believe an account contains information that should not have been collected, including information about a child, contact us. We will review the report and the appropriate action.

Changes to this policy will be reflected in its effective date. Significant changes to how account information is handled will be communicated through the service or another appropriate channel.