Your details in Dropsee

Location helps you find tracks and camera helps you embed them in your surroundings. Below we explain what happens to this and other data in the current beta.

1. Administrator and contact

The administrator of data processed within Dropsee is DIY Spice & Tea Jakub Binkowski, Piaskowo 56A, 64-500 Szamotuły, Polska, NIP 7872089960, REGON 526238361. In matters of personal data, write to info@dropsee.eu. Dropsee is the name of this company's service.

2. What data and for what purpose

Data	Purpose and legal basis
Profile and access	Name, random ID, access token and recovery code hashes, membership, and policy acceptance. They are used to maintain the account, retrieve and share content - performance of the contract, Art. 6 section 1 letter b GDPR.
Works and location	Text, graffiti, geometry, model colors and textures, title, author, space, coordinates, time, anchor ID and AR parameters. They are needed to save and display your publication - art. 6 section 1 letter b.
Current location	Location measurements and their accuracy for selecting nearby works and publishing - Art. 6 section 1 letter b. We do not create a separate route history from search queries in the database. The coordinates of the published work remain part of it.
Reporting and safety	Reporter, indicated job, reason, decision, blocks, counters and IP address to limit abuse. Legitimate interest: user protection and services - Art. 6 section 1 letter f; compliance with a specific legal obligation, where applicable - letter c.
Correspondence	E-mail address, message content and data voluntarily submitted in the application. Support and contractual matters - lit. b; requests for rights and obligations regarding complaints - letter c; other contact, security and defense of claims - letter f.
Error report	Dropsee version, phone model, Android and limited last crash trace if you upload it yourself. Purpose: diagnosis and improvement of stability - legitimate interest, lit. f. We do not send it automatically.

Profile, location and content data are required to use the relevant features. Failure to provide them prevents you from creating a profile, discovering or publishing. Contacting us and sending an additional report is voluntary. System permission for a camera or location is a phone access control and does not replace information about processing or the legal basis.

The source is your activities, your device and - for invites, works and reports about you - other users. Invitation data may relate to your membership. We do not require an email address to create an existing Dropsee profile.

Activity map

See shows approximate areas and counts of active works in the selected space. Global users, or members of a private space, can see these clusters without opening the camera. The map does not expose content, authors or the exact positions of individual works. Works without a GPS location do not appear on the map.

Your phone obtains your position while you view the map. Dropsee receives the visible map bounds to count works; this feature does not record a movement history. You can browse manually without granting location permission.

If you enable the OpenStreetMap basemap, your phone downloads tiles directly from the OpenStreetMap Foundation. The provider receives your IP address, technical connection information and the area covered by the requested tiles. We do not send your profile token or work content to this provider. You can disable the basemap in map settings. Processing and retention details: OSMF privacy policy.

3. Camera and Google ARCore

Camera and sensors help recognize surfaces and recreate a common place. The Dropsee server does not accept video recordings from the camera. This doesn't mean that the camera data stays only on the phone: Cloud Anchors and Google Play Services for AR process the data needed to recognize the surroundings, including data from the camera and sensors.

Before starting the session, the application shows information about ARCore. Details: how Google processes AR data, Google privacy policy i Google Cloud privacy notice. Revoking camera or location permissions on Android disables or restricts AR.

Be careful of people and private interiors in the frame. When you publish a track, you also reveal its location. Do not include other people's private data without proper basis.

4. Who has access

Users of the selected space can see your work and author name. Global is available to Dropsee users; private spaces - to their members. Private access does not prevent screenshots from being taken.
Authorized space administrators and the operator handle notifications and security matters to the extent necessary.
OVHcloud — serwer aplikacji w Warszawie, Polska - site infrastructure, API and databases. Contact mail is handled by Hostido. Providers may process connectivity and infrastructure security data in accordance with their role and terms of service.
Google - ARCore and Cloud Anchors features and distribution via Google Play. Your own Google account data and its services are also subject to Google's policies.
Authorized authorities and advisors, if disclosure is required by law or necessary to conduct a specific matter.

We limit access to the needs of providing the service. We do not sell data and do not use location for advertising. The application server is in Poland; Google services may involve processing outside the European Economic Area. Google describes the transfer rules and mechanisms data transfer information. Appropriate contractual provisions and protection mechanisms apply to data entrusted to the supplier, e.g. an adequacy decision, where applicable, or standard contractual clauses. You can ask us for information about the security measures appropriate to your data.

5. How long we store data

Profile, memberships, locks and approvals: to delete your account or earlier when you remove the association.
Active jobs: until deletion or expiry, initially no more than 7 days after publication and no longer than the anchor remains valid. The author may extend an active work to up to 7 days from each confirmed renewal, within the anchor’s available validity. In that case, the active work is retained longer at the author’s request. Expired work records are removed from the active database after an additional 30 days by the running server process.
Republished confirmations: may contain a copy of your saved work data and remain until you delete your account or space to prevent duplicates. Simply expiring a job does not remove all of its technical data; you can separately request the deletion of your data.
In-app reports and decisions: to delete the associated account/space to the extent covered by the deletion operation or prior justified deletion by the operator. They are used to handle violations and appeals. The expiration of a job does not automatically remove its reporting.
Daily limit counters: cleaned after 32 days; deleting an account deletes it sooner.
Last item: if you use the share feature in a compatible private space client, the server keeps the last entry, not the route history. Entries older than one minute are deleted cyclically by the running server. Global does not provide current positions.
Support correspondence: by handling the case, then up to 12 months from its closure. Materials necessary for legal obligations, the pursuit or defense of a specific claim may remain for an appropriate statutory period or until the final conclusion of the case. We limit them to the necessary scope.
Local data: model library, sketches and last crash information remain on the device until they are deleted, replaced or the application data is cleared. External file originals have their own copies.

We perform automatic database copies every day, with a 7-day rotation during subsequent successful launches. A separate daily copy of the entire VPS in the OVHcloud Standard variant has a 24-hour rotation and may also contain older copies of the database. With properly functioning daily tasks, the total expiration time of such copies is up to approximately 9 days from removal from the active database (7 days of retention, the next rotation start and the VPS copy cycle). Therefore, the 7-day retention for the database does not mean deleting all copies within 7 days of the request: the nested copy remains until the last VPS recovery point containing it is replaced. A copy job failure can delay rotation and requires operator intervention. Copies are for disaster recovery purposes and are not a regular source for sharing works. When restoring, we repeat previous deletion requests before making the data available again.

The IP address is processed on connection and in short-lived request throttling mechanisms. The current site and API configuration does not enable a separate log of all visits. System diagnostics and supplier security data may be processed until the diagnosis or incident is completed and legal obligations are met; they do not serve the history of marketing activity.

The processing by Google, including the retention of its service data, is described in the documents indicated above. Deleting your Dropsee account is not deleting your Google account.

6. Website, cookies and purchases

We use optional Google Analytics only with consent. Refusing does not limit the website; withdraw consent in the footer. Details of data, cookies, recipients, retention and transfers: Cookies and analytics.

Payments are disabled in the current beta. We do not collect card data. Before the sale starts, we will update information about purchase confirmations and Google Play Billing. If the profile has previous test permissions, their associations are removed with the account.

7. Your rights

You have the right to access the data and their copies, rectify, delete, limit and - in cases specified by law - transfer the data. You can object to processing based on legitimate interest. If specific processing is based on consent, you can withdraw it without affecting the lawfulness of previous processing.

Write to info@dropsee.eu. We respond without undue delay, no later than within one month; a statutory extension of up to two months requires notification of the reasons in the first month. We may request proportionate information confirming your data entitlement. Do not send your password, recovery code or ID card without prior arrangement.

You can submit a complaint to the President of the Personal Data Protection Office: uodo.gov.pl. Deleting an account in the app or without the app.

We do not use advertising profiling or solely automatic decisions that produce legal effects or similarly significantly affect you. Technical safeguards may reject excessively frequent requests or invalid files.

8. Minors and changes

The service is for people aged 16 and over. For persons aged 16-17, the regulations require the consent of a parent or guardian to use. We handle reports regarding a child's data and safety under info@dropsee.eu. Child Protection Standards.

When changing the processing method, we will update the date and content of the document, and we will inform you about a significant change before its implementation via the available service channel. Changing the policy does not constitute automatic consent to a new processing purpose.

Beta applications

Controller: DIY Spice & Tea Jakub Binkowski, Piaskowo 56A, 64-500 Szamotuły, Polska. We use these details only for beta recruitment and invitations, for up to 180 days or until consent is withdrawn. No marketing newsletter. Write to info@dropsee.eu to withdraw or correct your application. The legal basis is your consent (GDPR Article 6(1)(a)). Providing both fields is voluntary but necessary to register. We also record the consent notice version, submission date and language. No exact address or GPS is collected. Selection is made by the organiser, primarily by city, not by an automated decision. We do not verify email ownership at signup; an invitation is sent later to selected applicants. Duplicate submissions do not replace an existing application.

Authorised Dropsee organisers and our hosting provider OVHcloud process applications. When selected, your Google account email will be added to the Google Play closed-test list to grant access. Google’s privacy and international-transfer information is linked above. You may withdraw consent without affecting earlier lawful processing, request access, correction, deletion, restriction or portability, and complain to your data protection authority. Contact: info@dropsee.eu. Active applications expire automatically after 180 days; backup retention is described above. If recruitment ends sooner, we will delete the remaining applications. Invitations concern this beta only, not general advertising.

Events and AR photos

When you request an event, Dropsee prepares candidate locations in the map area you selected. Dropsee and the Overpass service (overpass-api.de, OpenStreetMap data) receive the area centre rounded to 0.01 degrees; your account token is not sent to Overpass. The request and its status are linked to your account for up to 30 days. Location and accuracy submitted when claiming a find are used for proximity checks and are not stored in the finds history. We retain the sculpture ID, event, discovery time and unlocked models until account deletion. Reports of inaccessible event points are linked to your account and erased when the account is deleted. Photos taken with the AR camera button are saved only on your device; Dropsee does not automatically upload them or add coordinates to the file. Separately publishing a photo as a drop remains subject to the rules for published works.

Reusable graffiti tags

Tag designs remain in the library on your phone until you delete them or clear app data. Placing a published copy sends its image and location to Dropsee. Identical tag images share one server file; each placement has its own location, author and expiry date. Deleting the last placement using a file removes it from the active database. Expiry of visibility alone does not delete a publication; the work and backup retention rules above apply. Map filters send your selected categories to count matching works.

Pigment and metallic materials — from version 0.35

To operate profile rewards, we store your Pigment balance, gold and silver paint stock, unlocked sculpture variants, dates and types of rewarded actions, credit history and redemption identifiers that prevent duplicate charges. We also store hashes of tag designs and discovered artwork identifiers to prevent repeated rewards for the same action. These records are linked to your profile and retained until account deletion; backup deletion follows the rules described above.

Tag designs stay on your phone. Saving a design sends only its hash for the reward, not the artwork image. A paint quote sends stroke geometry, material and size, without the image or note text; we do not save the quote as a separate artwork. Publishing uploads the artwork as described elsewhere in this policy. Reward data is used to provide profile features and prevent duplicate credits, not for advertising.

Pigment feature update: 1 October 2026.

Clans, friends and territories — from version 0.37

Shared play stores the clan name, logo, tag, colour, leader, membership, recruitment setting and invitations. Clan identity and owned territories appear on the clan map; the roster is visible to clan members. Friend connections require invitation acceptance. We store profile connections and pending requests, but do not share live friend or clan-member locations.

An attack stores cleared guardian identifiers, painted tag cells and expiry time for the clan and territory. Location and accuracy are checked for proximity without storing a route history. Incomplete attacks expire after 15 minutes; clan invitation codes expire after 7 days and switching cooldowns after 24 hours. Profile and friend records are removed with account deletion. Leadership passes to another member when the leader leaves; the last member leaving deletes the clan and releases its territories. Territory reports linked to an account are deleted with that account. The backup rules above also apply.

Preparing an area sends the selected map centre rounded to 0.001 degrees to Overpass, without the account name or token. We retain public map candidates and their OpenStreetMap sources, not a separate user search history. These records provide the chosen profile and gameplay functions; moderation and abuse prevention follow the rules above.

Territory activation requests — 0.38

At your request, we store the hex identifier, requesting profile, date and an optional description of up to 300 characters. This supports a public-access and safety review and prevents spam. We remove the profile link and description after review or within 30 days; the technical hex status remains. Account deletion removes linked requests. Descriptions are not public. Clans do not record a route or track live location in the background. Favorite and recently used models are stored on the phone.

Demonstration world — 0.39

Optional demo access uses a separate database and shared test accounts. Do not enter private information or publish private photos there. Other testers using the same account can view and change its work and progress. Event and clan simulations use fictional positions; the ordinary AR camera still processes real images and location as explained above. Demo progress and Pigment do not transfer to Global. You can delete the account and its publications; a later sign-in recreates an empty demo profile with sample gameplay. Demo data remains until account deletion or reset of the relevant scenario, subject to the backup retention rules above.