Privacy Policy

1. Who is responsible

The controller of personal data in the Drips service at drips.gg is Drips Technology SRL, a Costa Rican limited-liability company (“Drips”, “we”). Privacy requests go to [email protected]. Security and account help go to [email protected].

Faucets you connect, and the providers that deliver a reward you choose, are separate controllers of what happens on their own systems. This policy covers Drips. It does not cover a faucet's site or a game page the faucet hosts.

If you are in the EEA, the United Kingdom, or Switzerland, you may also complain to your local supervisory authority. We would rather hear from you first, at the privacy address above.

2. How we decide what to collect

Three rules govern every category below.

• We collect what the fraud requires, and we say so. A rewards balance that can be redeemed for a real reward will be farmed unless we can relate accounts. Email, device, network, phone, and face data exist for that reason. We do not collect them to advertise to you.
• We do not collect a government ID. There is no passport, driver's licence, or national identity number in this product, and we will not add one without changing this policy first.
• We minimise what other people see. A faucet you connect receives your public identifier, username, and display name. It does not receive your email, your phone number, your face data, or your redemption address.

3. What we collect

Account and sign-in. Your email address, in the form you typed and in a canonical form so that a plus-tag or a Gmail dot-variant cannot open a second account. If you use a social sign-in, the provider's subject identifier, the email they assert, and, where they send it, a handle and the date they say the social account was created. A username and an optional display name. A public account identifier. Session records: when you signed in, your IP address, and your user agent. The country our edge reports for the connection, which we use to decide whether a new account may be created. Whether the address of each visit is a VPN, proxy, Tor exit, or hosting network, which we use to refuse it. We do not set a tracking cookie. The cookies we set are the session itself and, during email sign-in, a short-lived binding cookie so the code only works in the browser that asked for it. Both are strictly necessary, httpOnly, and not used for advertising.

Device. A key your browser generates and that never leaves it. We store only a fingerprint of the public half, so we can recognise the same browser across sessions without holding a hardware identifier. We also store a coarse device signal from account creation. When you are signed in, the app computes a browser fingerprint once a day: screen size, time zone, languages, graphics and font characteristics, and whether the browser is automated. It goes to our fraud-prevention service (below). Your browser stores preferences, a profile cache, and, while you are mid-flow, a pending verification or address, in its own local storage. That stays on your device.

Phone. When you verify a phone number, you give us the number. We send it to our SMS provider, which generates and checks the code. We never see the code. We send it to a phone-intelligence provider, which tells us whether the number is a real mobile line, on which carrier, and whether it is disposable or virtual. We store the number as a keyed hash and as encrypted ciphertext. In the clear we keep only the country and the last four digits, plus the intelligence result. A number that fails, or that is proved by two accounts, is placed on an internal denylist as a hash.

Face. When you take a live face check, your camera captures a short sequence of frames on your device and sends them to us. We check them in memory, on our own servers, and we drop the frames as soon as the decision is made. We do not keep the video. We do keep a face template, which is a list of numbers derived from the face, encrypted, and used to compare later checks and other accounts. We also keep a small still from the check, encrypted to keys that live only on reviewers' own machines, so a person can look at a disputed match. The server that stores that still cannot open it. We keep a hash of the face region for a limited time so the same capture cannot be replayed.

Rewards, redemptions, and games. Every credit, maturation, reversal, redemption, and game play is a ledger entry: amounts, timestamps, the faucet it came from, and the state of the entry. If you redeem, we store the destination you give us. That is a PayPal account, the details a gift-card order needs, or, if you choose a crypto reward, a blockchain address, plus a label if you set one, the screening result, and a delivery reference once it is sent. A crypto reward is then public on a network we do not control and cannot erase. A PayPal or gift-card reward is not. If you use points in a promotional game, we store the play, the outcome, and the faucet. The faucet stores its own record of the play.

Connected faucets. Which faucets you approved, which permissions you granted, and when you revoked them. Revoking stops further use of that grant.

Support and abuse. If you email us, we keep the correspondence and the reference number. Risk decisions store the rule that fired, a snapshot of the signals it used, and enough to replay the decision later. We do not store unbounded dumps from our providers.

What we do not collect. Government identity documents. Precise GPS. Contacts. A photo roll. Advertising identifiers. Analytics profiles for sale. The contents of a faucet page beyond the claim we are asked to credit.

4. Why we use it, and the legal basis

Where the GDPR or a similar law applies, the basis is in the right-hand sense of each row. Where it does not, we use the data for the same purposes under this policy and the Terms of Service.

• To run your account and credit rewards — email, username, sessions, ledger, connected faucets. Contract.
• To redeem points you asked us to redeem — address, screening result, transaction reference. Contract.
• To decide whether a new account may be created where you are — country reported by our edge. Contract, and legal obligation where sanctions require a refusal.
• To refuse VPNs, proxies, Tor, and hosting networks — the IP address of each visit. Legitimate interests: hidden connections are how farms run many accounts from one place.
• To stop farms, multi-accounting, and bonus abuse — device fingerprint, network, email canonicalisation, phone intelligence, face template, shared-number and shared-address matches, velocity. Legitimate interests. Our interest is that a reward paid to a farm is a reward taken from a real person, and that a reward balance will otherwise be drained by farms. You may object; if you do, we may have to close the account, because we cannot run the balance without the control.
• To screen redemptions against sanctions and the stablecoin blacklist — address, country. Legal obligation, and legitimate interests in not sending value to a prohibited person.
• To investigate, freeze, and ban — the signals above, support mail, audit records. Legitimate interests, and legal obligation where a preservation duty applies.
• To tell you about your account — expiry warnings, verification requests, security notices, sent to your verified email. Contract, and legitimate interests in keeping you from losing points you did not know were expiring.
• A live face check is also special-category biometric data where that concept exists in your law. We process it on your explicit consent, given in the check itself before it starts, and, where the law allows, on the substantial public interest and legal claims involved in preventing fraud. You can refuse. If you do, you simply cannot complete a check we have required, and redemptions may stay paused.

We do not use your data to train a public model, to build an advertising audience, or to score you for anyone else's marketing. We do not make solely automated decisions that produce a legal effect, other than the refusals described in the terms: a country we do not support, a connection through a VPN, proxy, Tor, or hosting network, a sanctions hit, a denylisted number, a velocity limit, and a failed screening. Those are the product rules. A ban that depends on judgement goes to a person.

5. Who we share it with

We share personal data with the following categories of recipient, and no others.

• Email and SMS. Maileroo sends sign-in codes, magic links, and account notices, and generates and checks SMS codes. It receives your email address or phone number and the message. It does not receive the SMS code back to us.
• Phone intelligence. NumCheckr receives the phone number and returns whether it is a real mobile line, the carrier, and whether it looks disposable or virtual. We send a number only when you start a phone verification.
• Edge and bot checks. Cloudflare proxies the site, so it sees connection data, including IP address, as any content-delivery network does. We trust its country header for the sign-up gate. Cloudflare Turnstile may run on a phone verification or a face check to reject scripts. It is not an advertising pixel.
• Network check. proxycheck.io receives the IP address of a visit and returns whether it is a VPN, proxy, Tor exit, or hosting network. We keep that answer for at most an hour, against the address, not against your account.
• Fraud prevention. FPShield, FaucetPay's fraud-prevention service, receives your public account identifier with your sign-ins, faucet rewards, redemptions and their address, the outcome of each phone or face check, IP addresses, user agents and the browser fingerprint. A phone number, a face and a device key reach it only as keyed one-way tokens, never in the clear. It tells us when an account should verify again. It never bans anyone; a ban that depends on judgement goes to a person.
• Sign-in providers. If you choose Google, X, or Discord, you authenticate with them under their terms, and they send us the identity claims described above. Only the providers we have switched on are offered.
• Faucets you connect. The public identifier, username, and display name, and the permissions you approved. Not your email, phone, face, or redemption address.
• Reward providers. The records needed to attribute a faucet reward, reverse a mistaken one, and deliver the reward you chose. PayPal receives the account you named when you redeem for PayPal credit. A gift-card provider receives what it needs to issue the card. If you use points in a promotional game, the faucet sees a player identifier and a username, not your email.
• Screening, and crypto rewards only. A destination is checked against sanctions lists, and a crypto address is also checked against the relevant blacklist. If you choose a crypto reward, the address and the amount are published on a public network. Anyone can read that. Choosing PayPal or a gift card does not publish anything there.
• Price data. We use a price source to value what a faucet paid. That source receives no personal data.
• Reviewers and infrastructure. A small number of staff and operators can access production systems under access controls. Face stills can be opened only by a reviewer who holds the key, on their own machine. We use a hosting provider for the servers.
• The law. We disclose data if a lawful demand requires it, and we may preserve it when we reasonably anticipate one. We may also share it with a payment partner or a sanctions authority where the alternative is sending value we are prohibited from sending.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. If a law where you live treats the blockchain publication or a faucet connection as a “sale” or a “share”, you may email [email protected] and we will treat the request as the statute requires. Disconnecting a faucet is the control for the faucet.

6. How long we keep it

We keep data for the purpose that justified collecting it, and then we delete it or cut it down to what the ledger and the fraud record still need.

• Face video. Not kept. Frames are dropped when the decision is made.
• Face template and review stills. Deleted 90 days after your last account activity, or sooner if you delete them yourself in Settings. A failed check's data is deleted after 30 days. If your account is banned for fraud, face data is kept for up to three years so the same face cannot re-enrol, and deleting it yourself does not remove a fraud denylist entry during that period.
• Face-check session details such as IP address and device labels are scrubbed after one year. The decision itself, and the audit that a check happened, remain.
• Network check answers are kept for at most an hour against the address, never against your account.
• Replay hashes of a face region are kept for 90 days. Audit rows of the check are kept for about a year.
• Phone numbers. Kept while the number is on your account and for as long as we need it to prevent the same number being used to open another one. A denylisted number is kept as a hash. We do not keep the SMS code.
• Sessions, IP, user agent. Kept for the life of the session record and for a limited period afterwards so we can investigate an incident. Sign-up IP and the device signal are kept with the account because they are how we relate a later account to this one.
• Ledger, redemptions, and fraud decisions. Kept for as long as accounting, tax, sanctions, dispute, and fraud duties require. Deleting an account does not erase a ledger posting, an amount, a timestamp, or an audit reference. Those are not a profile. They are the books.
• Usernames. A username you used stays reserved, so a faucet's history does not start pointing at someone else.
• Support mail. Kept for as long as the thread might still be disputed, and then deleted.

When you delete face data yourself, that deletion happens. It does not, by itself, lift a review, a freeze, or a ban that the check supported, and it does not delete a fraud denylist entry within its retention period.

7. Your rights

Depending on where you live, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct data that is wrong;
• delete data we do not have a duty to keep;
• restrict or object to processing based on legitimate interests, including the fraud controls;
• withdraw consent to a face check, which you can also do by deleting the face data;
• receive data you provided, in a portable form, where the processing is by consent or contract and is automated; and
• appeal a refusal, and complain to a supervisory authority.

The product already lets you download a copy of your profile, preferences, connected faucets, sessions, rewards, and redemptions, and lets you delete your face data. For anything else, email [email protected] from your verified address. We may need to confirm it is you. We will not delete data we must keep for the ledger, for sanctions, for a legal claim, or for a fraud denylist inside its retention period, and we will tell you when that is the reason.

Closing an account in Settings removes the profile and the face data after a 30-day waiting period in which signing back in cancels it. Closure does not erase the books, and it does not erase a fraud record we are entitled to keep: the sign-in email and social identities stay with the closed account, so they cannot open a new one.

If you are a California resident, you have the rights to know, delete, and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are used in the CCPA. We do not use sensitive personal information (the face template, the phone number) to infer characteristics about you, or for any purpose other than the fraud, security, and account purposes in this policy. An authorised agent may submit a request with proof of authority.

8. Where the data is

We operate the service from servers that are not in every user's country. Providers in section 5 process data in their own countries, which include the United States and the European Economic Area. Where we transfer personal data out of the EEA, the United Kingdom, or Switzerland, we do it under an adequacy decision where one exists, and otherwise under standard contractual clauses or the provider's equivalent safeguard. A redemption published on a public blockchain is not a transfer we can put under a contract. Do not redeem if you cannot accept that.

9. How we protect it

Phone numbers and face templates are encrypted. Face stills are encrypted to reviewer keys that are not on the server. Sessions are httpOnly cookies. Staff access to production is limited and audited. None of that is a promise that a breach is impossible. If we become aware of a breach that puts you at serious risk, we will tell you and, where the law requires, the relevant authority.

You protect the account by controlling the email and the social accounts that can sign in to it. We cannot distinguish you from a person who has both.

10. Children

Drips is not for anyone under 18. We do not knowingly create an account for a child. If you believe we have, email [email protected] and we will close it and delete what we are not required to keep.

11. Changes

If we materially change this policy, we will update the date at the top and, where the change affects a check you have already consented to, we will ask again before we rely on the old consent. Continued use after the date of a change is acceptance of the change, except where your law requires a fresher consent. The current version is always this page.

12. Contact

Privacy: [email protected]. Legal: [email protected]. Support: [email protected]. The terms that sit beside this policy are at drips.gg/terms.