Privacy notice
The short version. We keep only what we need to run your account and your screens. No passwords, no advertising, no tracking cookies, no selling or sharing your data for marketing. You can download everything we hold about you, or delete your account and all of it, yourself, at any time from Account & plan.
Who we are
thedropclock is a trading name of Mick Brennan, a sole trader based in Dublin, Ireland. We are the “controller” of the personal data described here. Contact us about anything in this notice at info@thedropclock.com.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Your email address | To sign you in (we email you a one-time code) and to tell you about your account, e.g. when it’s approved. | Contract |
| Your name and business or venue name | To set up and manage your account. | Contract |
| Your plan, screen and DropClockAI credit usage, storage used | To provide the service and apply your plan’s limits. | Contract |
| Sign-up date, last sign-in date, the date you agreed to this notice | To run and secure the account and to keep a record of your agreement. | Contract; legal obligation |
| What you create: quizzes, countdowns, settings, images and audio you upload | To show it on your screens. Anything you publish is visible to anyone with your screen’s link. | Contract |
| What you send through the contact form: name, email, venue and message | To reply to you. | Legitimate interests (answering you) |
| A scrambled (hashed) form of your IP address and email, kept for one hour | To stop abuse, such as someone requesting hundreds of sign-in codes. | Legitimate interests (security) |
| Scrambled codes made from your email address, business name and internet connection when you sign up | To spot repeat free trials, so we can check them before approving. They can’t be turned back into the original details. | Legitimate interests (preventing misuse) |
We don’t ask for, and you shouldn’t upload, sensitive information about yourself or anyone else.
Cookies
We use one cookie, tdc_s, which keeps you signed in for up to 30 days. It is strictly necessary for the service, so it doesn’t need consent. It is not used for tracking. Signing out deletes it.
Who processes it for us
| Service | What it does |
|---|---|
| Cloudflare, Inc. | Hosts the website and stores account data, content and uploads. |
| Resend | Delivers our emails (sign-in codes and account notices). |
| Anthropic, PBC | Powers DropClockAI. It only receives the topic, name and notes you type when you ask DropClockAI to build something, never your account details. |
Some of these providers process data outside the EEA (for example in the USA). Where they do, the transfer is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework. Each provider is bound by a data processing agreement.
How long we keep it
| Your account and content | Until you delete your account (or ask us to). Deleting removes your account, screens, history and uploads straight away. |
| Earlier published versions of a screen | 60 days, then deleted automatically. |
| Sign-in codes | 10 minutes, stored only in scrambled form. |
| Sign-in sessions | 30 days, or until you sign out. |
| Abuse-prevention counters | 1 hour. |
| Repeat-trial codes | While your account is open, and for 12 months after you delete it (the code for your email only). |
| Contact form messages | In our inbox for as long as the conversation needs, and no longer than 2 years. |
If you leave an account unused for a long time, we may email you and then close it.
Your rights
Under the GDPR you can ask to access your data, correct it, delete it, restrict or object to how we use it, and take it with you. Two of these you can do yourself in Account & plan: Download all my data and Delete my account. For anything else, email info@thedropclock.com and we’ll reply within one month.
If you’re unhappy with how we handle your data, you can complain to the Data Protection Commission in Ireland at dataprotection.ie, or to the authority where you live.
Age
Accounts are for people aged 16 and over, and are meant for businesses, venues and creators.
Security
Everything travels over HTTPS. There are no passwords to leak: sign-in codes are single-use, expire after 10 minutes, are stored only in scrambled form and lock after 5 wrong tries. Sessions use a secure, HTTP-only cookie. Each account can only see and change its own screens and uploads.
Changes
If we change this notice in a way that matters, we’ll tell you by email or when you next sign in.