Drop Privacy Notice

Last updated: July 2026

1. Introduction

This notice explains what personal data Drop collects, why, how it's used, who it's shared with, and what rights you have over it. It applies to everyone who uses the Drop app, including the free demo.

Drop is built around a simple idea: you speak or type a task or note, and Drop works out what kind of thing it is. To do that, Drop has to process what you say. This notice tells you exactly how.

2. Who we are

Drop is provided by Drop ("Drop", "we", "us", "our"), and Drop is the data controller for the personal data described in this notice, for the purposes of UK GDPR and the Data Protection Act 2018.

Contact: via our Contact form.

UK GDPR requires a way to identify and contact the controller - a monitored contact form satisfies this, the same as an email address would. A registered postal address isn't strictly mandatory, but it's worth adding here once Drop has one (e.g. on incorporation, or a registered office/mailing address).

3. Information we collect

3.1 Information you provide directly

• Account information: your name, and identifiers from Sign in with Apple (Apple ID relay email if you choose to hide your real email, and a unique Apple identifier).
• Voice and text input: anything you say or type into Drop to create a task, note, or reminder - including audio recordings (processed but not retained by Drop - see Section 5), and the transcribed and classified text that comes from them.
• Household information: your household's invite code, the names of household members, and which members belong to which household.
• Subscription information: your subscription status and renewal date, as provided to us by Apple via StoreKit. We do not receive or store your card details - Apple handles all payment processing.

3.2 Information about your household and partner

Drop is designed for two people sharing a household. When you create a shared item, or address an item to your partner by name, that content is visible to other members of your household. Section 8.2 explains this in more detail.

3.3 Information collected automatically

• Device and technical data: device type, operating system version, app version, and crash or error logs, collected to keep the app working and to fix bugs.
• Usage data: basic interaction data (for example, which features you use) where this is necessary to operate and improve the service.

3.4 Information about other people in your content

Drop is built around tags like "Kids," which means the tasks and notes you create may contain personal data about people who are not Drop users - most commonly, your children. Drop processes this information exactly as it processes the rest of your content, on your instruction, as set out in this notice. You're responsible for making sure you have the right to share information about someone else (for example, your child) through Drop.

4. How we use your information and why we're allowed to

We do not use your data for advertising, and we do not sell your personal data to anyone.

5. Voice recordings and transcription

When you speak a task or note, the audio is:

1. Recorded on your device and sent to OpenAI's Whisper API for transcription into text.
2. Discarded by Drop once the transcript is returned - Drop does not retain a copy of your voice recordings.

OpenAI processes this audio under their API terms. Based on OpenAI's API data usage policy:

• Audio and transcripts sent via the API are retained by OpenAI for up to 30 days, then deleted.
• This data is not used to train OpenAI's models by default.
• OpenAI may retain data for longer only where required to investigate abuse or comply with the law.

See OpenAI's API Data Usage Policy for the current terms: https://openai.com/policies/api-data-usage-policies/ - note this is different from OpenAI's general consumer privacy policy (which covers ChatGPT), since that policy explicitly doesn't apply to API customers like Drop.

Because Drop doesn't keep the audio itself, the only place a recording briefly exists outside your device is on OpenAI's systems, for the retention period described above. The text transcript that comes back is then stored and used as described in Section 6.

6. AI classification of your content

Once your input is in text form, Drop sends it to Anthropic's Claude API (Claude Haiku, and in future Claude Sonnet for features like email parsing and image extraction) to work out:

• Whether it's a task or a note
• Whether it's personal, shared, or addressed to your partner
• Which of Drop's ten tags it belongs to (Shop, Kids, Home, Health, Finance, Social, Holiday, Work, Admin, Car)
• Any due date or reminder you've mentioned

This is automated processing, but it doesn't produce legal or similarly significant effects on you - at most, an item gets the wrong tag, which you can correct yourself in the app at any time. Drop does not use this classification to make decisions about you outside the app.

Based on Anthropic's published API and data retention policy, data sent through the commercial Claude API is automatically deleted from Anthropic's backend within 30 days of being sent, is not used to train Anthropic's models, and is retained for longer only where needed to enforce Anthropic's usage policy or comply with the law.

7. Who we share your information with

We don't sell your data. We share it only with the service providers who help us run Drop, each acting under their own terms:

We may also share information where required by law, to protect Drop's rights, or in connection with a sale or restructuring of our business (in which case you'll be notified).

7.2 Sharing within your household

This is specific to how Drop works, so it's worth being direct about it: anything you mark as shared, or address to your partner by name, is visible to the other member(s) of your household. Anything you keep as a personal task or note is not shared with your partner through the app. Drop is not a substitute for a conversation about what you do and don't want your partner to see - use the personal/shared distinction deliberately.

8. International data transfers

OpenAI and Anthropic may process data outside the UK, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK GDPR (such as Standard Contractual Clauses or equivalent mechanisms) to ensure your data is protected to a UK standard regardless of where it's processed.

9. How long we keep your data

• Account and content data: kept for as long as your account is active, and deleted without undue delay after your account is deleted, except where we need to retain limited records to comply with the law.
• Audio recordings: not retained by Drop at all - see Section 5 for OpenAI's own short-term retention.
• Data with our processors: see Sections 5 and 6 for OpenAI and Anthropic's own retention periods, which apply independently of our own.

If you delete your Drop account, your content is removed from our systems within the period above. Content already shared with your household (for example, a shared task) may remain visible to other household members unless they also delete it, since they hold their own copy of that interaction.

10. Security

We use industry-standard measures to protect your data, including encryption of data in transit and at rest, and access controls limiting who at Drop can see your content. No system is completely secure, and we can't guarantee absolute security, but we take this seriously and will notify you and the relevant authority of any breach where we're legally required to.

11. Children's data

Drop is not directed at children, and you must be at least 18 years old to create a Drop account. Section 3.4 explains how we handle the situation where Drop account holders (adults) enter information about their children as part of normal household organisation - that's not the same as children using the service themselves, and we don't knowingly allow anyone under 18 to register an account.

12. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Restrict how we use your data
• Object to processing based on legitimate interests
• Port your data to another service in a structured format
• Withdraw consent, where processing is based on consent

To exercise any of these rights, contact us via our Contact form. We'll respond within one month, as required by law.

If you're unhappy with how we've handled your data, you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113

13. Cookies and tracking

Drop is a native iOS app. We do not currently use third-party analytics, advertising, or tracking SDKs. If this changes, we'll update this notice and, where required, ask for your consent.

14. Automated decision-making

As described in Section 6, Drop uses AI to classify your content. This is automated, but you remain in control: every classification can be edited or corrected by you, and no automated decision under Drop produces legal or similarly significant effects on you within the meaning of UK GDPR Article 22.

15. Changes to this notice

We may update this notice from time to time, for example if we add new features or change service providers. We'll update the "Last updated" date above, and where changes are significant, we'll notify you in the app.

16. Contact us

Questions, requests, or complaints about how Drop handles your data: