Privacy Policy

Last updated: August 13, 2026

The short version: we collect what's needed to run ListDrop, plus analytics to understand how it's used so we can make it better. No ads, and we never sell your data.

ListDrop is operated by Ideas Blu SA de CV (Mexico), the data controller for everything described here. Reach us any time at hello@listdrop.co.

What we collect

• Account basics: email address, handle, password (stored only as a bcrypt hash), and the optional bio and avatar you add. If you sign in with Google, we store your Google account identifier and the email Google verifies; we never see your Google password.
• Your content: lists, items, notes, comments, suggestions, reactions, follows, and your personal checkmarks.
• Email follows: if you follow a list by email without an account, we store that address and the follow, activated only after you click the confirmation link (double opt-in).
• Shared-list guest lists: a list's creator can share a private list with specific email addresses. We store those addresses with the list, and, when you verify one at a list's unlock page (via Google or a one-time email link), a browser cookie remembering that verification for 90 days. Removing an address from a guest list ends its access immediately.
• Feedback you send: if you use the feedback box (or an AI assistant sends feedback on your behalf), we store your message, the page you sent it from, the coarse type of client you used, and the email address you optionally give us for a reply. Claim links, tokens, and passwords are stripped from the message before it is stored. Nothing is published: it goes to a private queue only the ListDrop team can read, and we use it to fix and build things. Ask us and we'll delete yours.
• Technical basics: IP addresses in server logs and rate-limit counters (abuse prevention), aggregate daily view counts per list, and aggregate counts of API calls we refused (which endpoint, which error, which field names were sent, no values and no IPs), so we can see where our API is failing the agents that use it.
• Usage analytics: we use PostHog and Google Analytics to understand how people find and use ListDrop: pages viewed, and product actions like signing up, creating a list, following, and sharing. This includes standard technical data these tools collect, such as device and browser type, approximate location (from IP), and the site that referred you. PostHog may also replay individual sessions (clicks, scrolling, and what the page showed) to help us find bugs and confusing UX; anything you type into a form is masked before it leaves your browser. The same analytics run on ListDrop lists embedded on other sites. We use all of it to improve the product, not to sell or advertise to you.
• Cookies: first-party cookies only for the site itself: your session (so you stay signed in), your language preference, a 7-day attribution cookie that remembers which shared link brought you here, one that remembers your cookie choice, and one that keeps the same version of a page you saw when we are comparing two designs (no analytics in it, just a word like "form" or "sheet"). Our analytics providers (PostHog and Google Analytics) also set cookies to recognize returning visitors and measure usage. If you're visiting from the EU or UK, analytics stay off until you accept the cookie banner. Declining keeps them off entirely. Everyone can switch analytics off in Your controls below.

What's visible to whom

• Public lists are public: anyone can see them, including search engines.
• Private lists are visible only to you and people you explicitly share them with.
• Unclaimed drafts (claim links): when an AI assistant or our paste page creates a list for you, it starts as an unclaimed draft reachable only through a secret claim link, like an unlisted video: anyone who has that link can view the listuntil it's claimed. Claim links are never listed on the site, are excluded from search engines, and we strip the secret part out before anything reaches our analytics tools. Unclaimed drafts are deleted after 30 days. Saving (“claiming”) a draft turns it into a normal private list in your account. It is never published unless you choose to make it public.
• Personal checkmarks are private to you.Nobody else sees what you've checked, and checking never notifies anyone. Profiles show one anonymous roll-up, the total number of check-offs a person's public lists have received, never who checked or which items.
• Your profile (handle, bio, avatar, public lists) is public. Your email is not.

How we use it

To run the service, to send email you asked for (sign-up verification, password resets, and list digests you opted into; every recurring email has one-click unsubscribe), and to keep the service safe (rate limiting, spam and abuse prevention). That's the whole list.

Who else touches it

Service providers only, and only to do their job for us: Railway (hosting), Resend (email delivery), PostHog and Google Analytics (usage analytics), and Google (only if you choose Google sign-in). We never sell your data, and we don't share it beyond the providers listed here. We'd disclose data if legally compelled to, and we'd tell you unless prohibited.

Retention and deletion

We keep your data while you have an account. Deleting your account (avatar menu → Edit profile → Delete account) removes your content immediately and permanently: lists, comments, follows, checkmarks, email subscriptions on your address. Residual copies may persist briefly in server backups before rotating out. One thing we deliberately keep: if you've opted out of ListDrop email, your address stays on the suppression list so we never email you again.

Your controls

• Edit your profile and content any time.
• Every list is public or private. Your call, changeable any time.
• Unsubscribe links in every recurring email; a global stop-all option too.
• Self-serve account deletion, no support ticket needed.
• Anything else (a copy of your data, a correction, a question): email hello@listdrop.co. If you're in the EU or UK, these are your GDPR rights (access, rectification, erasure, portability, objection) and you can also complain to your local data-protection authority.

Children

ListDrop isn't for children under 13, and we don't knowingly collect their data.

Changes

If this policy changes in a way that matters, we'll say so on the site before it takes effect. See also our Terms of Service.