Privacy Policy

This Privacy Policy explains how DropSync, a product of ChaseDex ("DropSync," "we," "us"), collects, uses, and shares information when you use the DropSync website (dropsync.chasedex.com), the DropSync mobile app (iOS and Android), the DropSync browser extension, our Discord alerts, and related features (the "Service").

1. Information we collect

• Account & subscription. When you create an account we collect your email address. We use passwordless "magic link" sign-in, so we do not store a password. If you subscribe, our payment processor (Stripe) handles your payment; we receive your subscription status and identifiers (not your card number).
• Browser-extension data. While you use DropSync on product pages you choose, the extension reads limited information needed for the feature — such as the page URL, product identifiers, price, availability/stock status, and timing data. Snipe history and transient execution state stay in Chrome storage. The extension does not collect or transmit your retailer password, full card number, or delivery address.
• Optional purchase authorizations. If you expressly authorize an assisted purchase feature, we store the armed item, quantity, price/shipping limits, checkout mode, consent version and time, scheduled execution time, and a limited outcome receipt (for example entered, refused, unconfirmed, or safety review) with your DropSync account. For Target whole-cart checkout, the extension may send limited product-line evidence (product identifiers, quantities, and prices) needed to verify the result; it does not send your retailer login, payment-card details, or delivery address. For Walmart drawings, saved payment and address details are read only by Walmart inside your signed-in browser and are not returned to DropSync.
• Usage stats: browser extension (optional). "Share anonymous drop stats" is on unless you turn it off in the extension's settings. While it's on, the extension sends PostHog, our product-analytics provider, what it did and how that turned out: for example cart, checkout and tab events, product identifiers, timing and outcomes. It also sends its version and rough device and connection details (CPU cores, memory, network speed). These are tied to an ID made for that install, not your name or email. If you arm an item for an assisted purchase, the extension also sends that ID to DropSync with its attempts on that item, so those records are linked to your account.
• Usage stats: web app. The DropSync web app sends PostHog each screen you open, plus how long the page took to load and display. These are tied to an ID stored in your browser, not your name or email. A screen's address can include an item, listing or order number. There's no setting to turn this off.
• Usage stats: mobile app. The mobile app sends PostHog app usage: app opens, tabs opened, setup steps, card-scan outcomes, how many cards you've scanned, and whether you have Plus. These are tied to your DropSync account ID, so they stay consistent across your devices. There's no setting to turn this off.
• How we use usage stats. We use them to understand and improve DropSync, and we don't sell them. PostHog may also work out your approximate location and device type from your request (for example, from your IP address).
• Marketplace. If you sell on the DropSync Marketplace, or buy there once buying opens, we collect what Section 5 describes. That includes a name and a shipping address.
• Community sightings (when that feature is active). If you share a live-drop sighting, we collect the content you submit (retailer, product, availability, timestamp) and show it to other users. Don't include sensitive personal information in a sighting.
• Mobile app. If you use the DropSync mobile app, we collect a push notification token for your device (issued by Apple or Google) so we can deliver drop alerts, along with an install identifier, your device platform, and app version. Your alert preferences (retailer and category toggles, per-item mutes) are stored with your account so they sync across your devices; your alert history stays on your device. You can disable push notifications at any time in your device settings.
• Card scanning (camera, on-device only). The mobile app's card scanner uses your device's camera to photograph a card and recognize its text using on-device text recognition (Apple's Vision framework on iOS, Google's ML Kit on Android). The photo and the recognized text never leave your device — nothing is uploaded to us or to any other company. Only the card you choose to save (name, set, and the details below) is stored with your account.
• Collection data. If you save cards to your collection, we store that information with your account so it syncs across your devices — including any free-text notes you write, the purchase price you enter, grading/certification details, source, and acquisition date. This is the same account storage described throughout this policy; we don't share it with other users.
• In-app purchases. If you subscribe through the App Store or Google Play, the purchase is processed by Apple or Google respectively and managed on our behalf by RevenueCat, our subscription-management provider. We and RevenueCat receive subscription status, product, and transaction identifiers — never your payment details, which stay with Apple or Google.
• Discord. If you use our Discord alerts, your activity there is also governed by Discord's own policies. If you link your Discord account, we store your Discord user ID, your username and whether you have the Plus role. We use them to add you to our server and manage that role. If you sell on the Marketplace, members see your Discord username with your listings, at checkout and on their orders, but not on your public seller page (section 5). We check it with Discord from time to time so it stays current. When you make a sale, our #marketplace-wins post on Discord tags your Discord account.

2. How we use information

To operate and improve the Service (the drop calendar, the Sniper, alerts, and any community feed); to create and manage your account and subscription; to communicate with you about the Service; to run the DropSync Marketplace (reviewing sellers and listings, pricing and printing shipping labels, tracking packages, and handling payments, payouts, refunds and card disputes); to maintain security and prevent abuse and fraud; to produce aggregated, de-identified insights; and to comply with law.

3. How we share information

• Service providers. Stripe (payments and Marketplace seller accounts), Shippo (Marketplace shipping prices, labels and tracking), Apple, Google, and RevenueCat (in-app subscriptions), Apple Push Notification service and Firebase Cloud Messaging (delivering push alerts to iOS and Android respectively), Railway (running the service that sends push alerts, which handles your device's push token), Discord (if you link your account), Cloudflare (hosting and edge, and storing Marketplace records and photos), PostHog (product analytics for the web app, the mobile app and the extension), and Loops (to send your sign-in emails and the Marketplace's emails: a seller's "listing sent back" email, and the order emails to buyer and seller, which carry the listing's title, the order number, the buyer's city and state, the seller's shop name and the tracking number, never a street address), acting on our behalf.
• With other users. Community sightings you submit are shared through the feed. In the Marketplace, buyers and sellers see what Section 5 describes.
• Legal & safety. To comply with law, enforce our Terms, or protect rights and safety.
• Business transfer. As part of a merger, acquisition, or asset sale.
• We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. Payments

Subscription payments are processed by Stripe (web) or by Apple or Google (in-app purchase, managed via RevenueCat). We receive limited information such as your subscription status and the result of a transaction. We do not collect or store your full payment card number. Marketplace payments work differently: see Section 5.

5. The DropSync Marketplace

The DropSync Marketplace lets members buy sealed products from each other. It is in an invite-only beta. Buying isn't open yet, and there's no date for when it will be. The parts of this section about buyers, sales, labels, tracking and payments say how those will work once each one is on.

What sellers give us, and what we do with it.

• Display name. Members see it with your listings, along with your seller level and sales record. If you've linked Discord, members also see your Discord username under it there, at checkout and on their orders. When you make a sale, our #marketplace-wins post on Discord shows your display name and tags your Discord account. It never names the buyer. Your display name also appears on your seller page (below), without your Discord username.
• Photo and About me. Both are optional. Members may see them next to your listings, and your photo appears on your seller page. We can review and remove them. Anyone with the link to your photo can open it without signing in.
• Ship-from name and address. We use them to price shipping and print your labels. "Who sees what" below says where they appear.
• Ships within. The business days you take to ship. Buyers see it, and it sets your ship-by date.
• Listing details. The product, price, quantity, and box size and weight. We review each listing before it goes on sale. Members see the listing once it's live. We use the box size and weight to price postage. Any notes you add to a listing are shown to members with it and copied onto each order, and that copy stays on any order still open or under review when you delete your account.
• Listing photos, including the proof photo. The proof photo shows your display name and the date on paper next to the item. Don't put your legal name or address in it. Until a listing is live, only you, our team and anyone holding a phone link you made while it's active can see its photos. Once it's live, Plus members can see all of them, including the proof photo. Anyone who bought from that listing can still see them after it ends.
• What you paid and receipt photos. You can tell us what you paid for an item and add a photo of your receipt. Both are optional. A receipt can show your name, address and order number, so only DropSync sees it: never buyers, never other members, and it's never shown on the listing or your seller page. If we give a listing the Store price badge from what you paid, members see the amount you paid and whether we checked a receipt, on the listing and in our Discord post for it. We keep the receipt with the listing. It's deleted if you remove what you paid, with the listing's photos, and with your account.
• Hidden photo data. We remove hidden data, including location, from every photo you upload to the Marketplace.
• Seller terms. We record which version you accepted and when.

Your seller page. Once you start Stripe setup, you get a public page that anyone with its address can open without signing in. It shows your display name, your approved photo if you have one, the names of your live listings, and DropSync's support contact and return policy. It doesn't show prices, your About me, your address or your email. We may give the address to Stripe as your website, and Stripe may review it. Search engines are asked not to list it. The page goes away if your invitation is withdrawn or you delete your account.

Your Stripe account. Buyers pay sellers through the seller's own Stripe account. You enter your identity and bank details on Stripe's page, not on DropSync, and DropSync doesn't store them. To set up the account, we give Stripe your DropSync email and account ID. From Stripe we store your Stripe account ID, your account's status, whether charges and payouts are on, a list of the items Stripe still needs from you (not your answers), and when we last checked. Stripe handles your information under its own privacy policy.

Shippo. Shippo is our shipping provider. To get a shipping price, we send Shippo the city, state and ZIP of both addresses, plus the box size and weight. We keep recent prices for a short time under a hashed key made from those details. To buy a label, we send Shippo both full addresses with their names. The sender email and phone that USPS requires come from DropSync's settings, not your profile. We don't store the label file. We fetch it from Shippo when the seller opens it. Shippo keeps what it receives under its own privacy notice.

Who sees what.

• Buyers see the seller's city and state at checkout.
• The name and ship-from address on a seller's profile are printed on the shipping label as the return address, and on any return label. The buyer, USPS and anyone who handles the package can see them. We don't show a seller's street address to buyers anywhere else.
• Sellers see the buyer's name and full address on the label, and the buyer's city and state on the sale. DropSync doesn't show sellers the buyer's email or card details. The charge is on the seller's Stripe account, so Stripe may show the seller some payment details there.
• The buyer and the seller of an order both see its tracking.
• If a buyer reports a problem, the seller sees the buyer's words and photos. The seller's reply goes only to our team.
• An optional packed-box photo is seen only by the seller and our team, unless it goes in a card dispute pack.
• Our team can see what it needs to review sellers and listings, handle problems and run payouts. That includes your email.

Buyers, once buying opens.

• Shipping addresses. You save a name and address in your account. We use your default address to show shipping prices. At checkout, we copy the one you pick onto the order.
• Orders. What you bought, the amounts, the dates and the order's status.
• Payment. You enter your card in Stripe's form, and it goes straight to Stripe. We never receive your card number. We store the Stripe payment ID, the payment status, the amounts and when the card hold ends. The charge is made on the seller's Stripe account. We give Stripe the order's ID and number with the payment, not your name, email or address.
• Tracking. Updates from USPS reach us through Shippo. We store the tracking number, the status, and each scan's description with its city and state.
• Problem reports. What you write and the photos you add.

Card disputes. If a buyer disputes a charge with their bank, the seller can send Stripe an evidence pack through DropSync. It can include the order's details, the shipping address without the name, tracking scans, the packed-box photo, a listing photo and the seller's note. It can also include the notes the seller wrote on the listing, as they stood when the buyer bought it. We don't put the buyer's name, email, card or phone in it.

Moderation, invitations and audit records. Selling is by invitation. We record each invitation, who added it, any note, and whether it was withdrawn. We keep our listing decisions and the reasons we give, and any "Report a problem" notes you send from the listing screen. When you withdraw a listing, we keep the reason you pick, and if you pick "Something else", your short note is kept with that listing. Only DropSync sees it, and it's deleted with your account. If we remove a photo or clear an About me, new ones wait for review for a time, and we record until when. We also keep an audit log of actions on accounts, listings and orders. It holds things like account IDs, Stripe IDs, order, listing and photo IDs, product references, file names, action names, field names, amounts, statuses, counts and times. It doesn't hold your profile text or any address.

6. Data retention

We keep personal information while your account is active and as needed to provide the Service, then delete or de-identify it when no longer needed, except where the law requires longer retention and except for the Marketplace records described below. Usage stats stay with PostHog and may also be kept in aggregated form. Deleting your account doesn't remove past stats from PostHog. Locally-stored extension data stays on your device until you clear it or uninstall.

Marketplace: when you delete your account, we delete:

• your seller profile: display name, About me, photo, ship-from name and address, and our record of your Stripe status and your link to your Stripe account;
• all your listings and their photos, including the proof photo and any receipt photos;
• your saved shipping addresses;
• your invitation, your "Report a problem" notes and your phone photo links.

If part of this fails at that moment, your account is still deleted, and we try the rest again every day.

Marketplace: what we keep, with no set end date today:

• order and checkout records, including the copy of the buyer's shipping address on each order, payment and payout records, tracking, and card disputes;
• problem reports, including the buyer's words, the seller's reply and their photos, and packed-box photos;
• each seller's counts of completed sales, cancelled sales and upheld problems;
• the audit log, which can't be changed or deleted;
• a form of your display name with no link to your account, so nobody can take that name right after you leave.

We keep these for refunds, card disputes, and accounting, tax and legal reasons. They keep your old account ID and Stripe account ID, but not your email. We don't delete them on a schedule yet.

While your account is open, listings that are no longer on sale stay with their photos. You can delete a draft you never submitted. When you replace or remove a photo, we delete the old file. If that delete fails, a copy can stay in storage. A profile photo can stay in browser and network caches for up to a day after that.

Stripe and Shippo keep their own records under their own policies. Deleting your DropSync account doesn't close your Stripe account, and doesn't remove what Stripe or Shippo already has.

7. Security

We use reasonable safeguards, including encryption in transit and hashing of sign-in and session tokens at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to opt out of any "sale" or "sharing" (we do neither). U.S. state laws (e.g., CCPA/CPRA): you may request to know, access, correct, and delete your information; we will not discriminate against you for exercising these rights. EEA/UK (GDPR): where applicable, our legal bases are performance of our contract with you, our legitimate interests (security and improvement), your consent (where requested), and legal compliance. To exercise rights, email us (Section 11).

9. Children

The Service is for adults (18+) and is not directed to children. We do not knowingly collect information from children under 13 (or under 16 in the EEA/UK); if we learn we have, we will delete it.

10. Changes

We may update this policy. We'll post the updated version with a new effective date and, for material changes, provide additional notice where required.

11. Contact

Questions or requests: [email protected] · DropSync, a ChaseDex product · dropsync.chasedex.com

---

See also our Terms of Service.

← Back to DropSync