Privacy Policy
Effective 7 July 2026 · OakDrop is a WinterBluff project.
OakDrop lets a host create a shared photo album and lets guests add photos by scanning a QR code or opening a link — no guest account required. This policy explains what we collect, why, and what we do with it. Questions: [email protected].
Who this covers
- Hosts — people who create an account and set up albums.
- Guests — people who open an album link and upload photos. Guests do not create an account and we do not ask guests for personal details.
What we collect
- Host account: your email address and either a securely hashed password or, if you use “Sign in with Google,” your Google account identifier and verified email. We never see or store your Google password.
- Connected storage: if you connect Dropbox or Google Drive, we store the access token that lets us place photos into your account. We request the narrowest access possible (an app folder / files created by OakDrop) and never read the rest of your storage.
- Albums & photos: album titles, dates, welcome messages, and settings you enter; the photos uploaded to an album, plus the optional display name and optional caption a guest chooses to attach to a photo.
- Membership & payments: if you subscribe, your payment is handled by our payment provider, Stripe. Stripe processes your card details — OakDrop never sees or stores your full card number. We keep a Stripe customer/subscription identifier and your plan status so we know what your account is entitled to.
- Technical data: we briefly use the uploader’s IP address to rate-limit uploads and prevent abuse. We keep basic server logs. We do not use third-party advertising or cross-site tracking.
Where your photos live & how long we keep them
- OakDrop-hosted (free tier and members without connected storage): full-size photos are stored on our servers. A free album is a trial — its hosted photos are deleted about a week after its 14-day window ends. A member’s hosted photos are kept while the membership is active, and become eligible for deletion after a grace period if the membership ends. The hosted tier is a convenience, not a long-term backup — download anything you want to keep.
- Your own storage (members): full-size photos are stored in your connected Dropbox or Google Drive. We keep only small thumbnails and the album’s metadata on our servers so the gallery and slideshow load quickly. Those originals remain in your account under that provider’s privacy policy, and are never deleted by OakDrop — if an album expires or a membership ends, we simply stop serving them through OakDrop.
How we use it
Only to run the service: authenticate hosts, store and display album photos, generate QR codes and slideshows, and keep the service secure and working. We do not sell your data or the photos in your albums.
Who we share it with
- Storage providers you connect (Dropbox, Google) — to store your photos where you asked us to.
- Our payment provider (Stripe) — to process membership payments and manage your subscription. Stripe handles your card details under its own privacy policy.
- Infrastructure we run on — the servers that host OakDrop.
- Legal — if required by law or to protect the service and its users.
Anyone with an album’s link or QR code can view and add photos — that is how sharing works. Treat the link like a key and only give it to people you want in the album.
Cookies
Hosts get one signed session cookie to stay logged in. The Google sign-in flow uses a short-lived security cookie. That’s it — no advertising or analytics cookies.
Security
Passwords are hashed (scrypt), traffic is encrypted in transit, and connected-storage tokens are treated as confidential and never sent to any browser. No system is perfectly secure, but we aim to hold only what we need.
Your choices
- Hosts can delete individual photos or an entire album at any time from the dashboard.
- Deleting an album removes its photos from our servers and, where applicable, from your connected storage, along with our thumbnails and metadata.
- To delete your account or ask what we hold, email [email protected].
Children
OakDrop is intended for adults creating albums for their events. It is not directed to children under 13, and hosts are responsible for the content of their albums.
Changes
We may update this policy as OakDrop evolves. We’ll change the effective date above and, for significant changes, do our best to notify hosts.