Privacy Policy

Effective date: November 12, 2026

HotDrop Technologies, Inc. ("HotDrop," "we," "us") operates the HotDrop website at joinhotdrop.com, the web app at app.joinhotdrop.com, the HotDrop mobile and desktop apps, creator Sites and media kits, and the HotDrop bot for Twitch, YouTube and Discord (together, the "Service"). This policy explains what we collect, why, who we share it with, and the choices you have.

HotDrop is a public professional network for creators and their communities. Your profile, your posts, your Circle memberships and your badges are public or visible to other HotDrop users by design. There is no anonymous mode. Direct messages are private.

If you do not agree with this policy, please do not use the Service.

1. Information we collect

When you sign in. You sign in with Apple, YouTube (Google), Twitch or Discord. We never see or store a password. From the provider you choose we receive:

• Apple: a unique Apple user identifier, your name and your email address (or Apple's private relay address if you hide your email).
• YouTube (Google): your name, email address and profile picture. We do not request access to your YouTube channel at sign-in.
• Twitch: your Twitch user ID, login name, display name, email address, profile picture and broadcaster status (affiliate or partner).
• Discord: your Discord user ID, username, display name and avatar. We use your Discord email address only if Discord reports it as verified. We do not request your server list or your connections.

When you connect a creator channel. To be verified as a creator, or to show your platform badges in a creator's Circle, you can link a YouTube channel or Twitch channel to your account. When you link a channel we collect its channel ID, name, handle, profile picture, description, subscriber or follower count, upload or stream counts, and whether channel memberships or subscriptions are enabled. For YouTube we request the scopes described in section 4. For Twitch, signing in asks only for user:read:email. Connecting Twitch in Settings also asks for user:read:follows, which we use only to show when you started following a creator, on that creator's community card. A creator who opts in to badge sync grants the read-only scopes listed in section 5.

Supporter and badge data. HotDrop shows a member's standing with a creator — subscriber, channel member, moderator, VIP, founder — as a badge in that creator's Circle. To do this we store, for each creator and supporter pair: the platform, the supporter's platform ID and username, the type of standing, the tier or level, how long it has been held, when we last confirmed it, and where we learned it. Section 5 explains where this data comes from. We do not store payment amounts, and we never learn your payment details.

Information you provide. Your display name, bio, custom avatar, platform links, Site and media kit content, posts, comments, Stories, Stacks, Circle messages, direct messages, group chats, reactions, uploaded images, video and audio, custom emotes and stickers, reports you file, and messages you send to support.

Voice calls. When you join a voice call in a group chat, your voice and any screen you share are carried live to the other people in the call. HotDrop does not record calls.

When you contact us from our website. The form on joinhotdrop.com asks for your email address and your message, and for a brand inquiry also your name, company, website and what you're interested in. You don't need a HotDrop account to use it. We use what you send to reply to you and, only if you tick the box, to send you HotDrop updates.

Information collected automatically. Device type, operating system and app version; push notification tokens if you enable notifications; IP address, access times and the pages or screens you use (on the web, the address of each page you open, which can include the profile handle of a creator whose page it is); crash and performance diagnostics; and product analytics events (for example, that a post was created or a Circle was opened) tied to your account ID. We do not use advertising identifiers.

Information from other users. Other users may mention you, reply to you, invite you to a Circle, add you to a group chat, or report your content. We keep those records.

Date of birth. We ask your date of birth once to confirm you are old enough to use HotDrop (section 9). We do not store the date itself.

2. How we use information

We use the information above to:

• Create and secure your account, sign you in, and keep you signed in across devices
• Verify creator status and show creator credentials on profiles, Sites and media kits
• Show your supporter and moderator badges in the Circles of creators you support
• Deliver the Service: feeds, Circles, Stories, Stacks, direct and group messages, live-stream notifications, creator Sites
• Send notifications you have turned on, and transactional email such as sign-in, security and account notices
• Send product updates and digests by email, which you can opt out of at any time
• Review reported content, enforce our Terms and Community Guidelines, and keep banned users off the Service
• Detect spam, fraud, automated abuse and security incidents
• Understand how the Service is used, in aggregate, to improve it
• Comply with law and respond to lawful requests

We do not use your information to serve targeted advertising, and we do not use the content of your messages or Google user data to train artificial-intelligence models.

3. How we share information

We never sell your personal information, share it with advertisers or data brokers, or use it for targeted advertising. We never give another company access to your data except as described here.

With other users. Your profile, creator credentials, Site, media kit, posts, Stories, Circle messages and badges are visible to other HotDrop users, and some of them (profiles, Sites, media kits, public posts) to anyone on the web. Direct messages are visible only to their participants. Circle owners and moderators can see who is in their Circle and act on messages there.

With the platforms you connect. When you connect a platform, we send requests to that platform on your behalf using the token it gave us. Your use of those platforms is governed by their own terms and privacy policies.

Service providers. We use companies that process data for us, under contracts that limit them to providing the service:

GIF search. When you search in the GIF picker, the app sends your search words and your IP address directly to GIPHY or KLIPY to fetch results, under their own terms.

Legal and safety. We disclose information when the law requires it, to respond to valid legal process, to protect the rights, property or safety of HotDrop, our users or the public, or to investigate fraud or abuse.

Business transfers. If HotDrop is acquired, merges, or sells assets, your information may transfer to the successor. We will notify you before your information becomes subject to a different privacy policy.

4. Google user data and YouTube API Services

HotDrop uses YouTube API Services. By connecting a YouTube channel you also agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy.

HotDrop's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the user-facing features described in this policy: verifying your channel, showing your channel on your profile and Site, showing your videos in your Circle's content carousel, showing member and moderator badges, and detecting when you are live.
• We do not transfer Google user data to anyone except the service providers in section 3 as needed to run the Service, for security, or as required by law.
• Humans at HotDrop do not read Google user data except with your consent, for security or abuse investigation, or when the data is aggregated and anonymized.
• We never sell Google user data, never use it for advertising, and never use it to train general-purpose or personalized artificial-intelligence models.

Scopes we request. Sign-in asks only for your Google name, email and profile picture. Linking a channel asks for youtube.readonly, which lets us read your channel details, your videos and your live-chat messages during a live stream or premiere. It also shows us which of your videos are private or unlisted; we use that only to keep them off HotDrop. Connecting the channel for analytics in Settings asks for youtube.readonly, yt-analytics.readonly; with yt-analytics.readonly we read your channel's audience breakdown (age, gender and country, as percentages) for your media kit. We do not request the ability to upload, edit or delete anything on YouTube, or to see your revenue.

Google user data retention. Channel details are refreshed while the channel stays linked and deleted when you unlink it or delete your account. OAuth tokens are stored encrypted and revoked when you disconnect or delete your account. Badge data learned from your live chat is confirmed at least every 30 days and deactivated if it cannot be confirmed; it is deleted when the creator disconnects YouTube or when you delete your account.

Revoking access. You can disconnect YouTube in Settings → Linked Accounts, or remove HotDrop at Google Account Permissions. Either way we delete the Google user data associated with the connection, as described in section 7.

5. Data creators share about their communities

Badges in a Circle depend on data that the creator, not the supporter, authorizes. This section is written for both.

Twitch badge sync and stream moments. A creator can opt in to badge sync for their Circle. Doing so grants HotDrop these read-only Twitch scopes: channel:read:subscriptions, channel:read:vips, moderation:read, bits:read, channel:read:hype_train, moderator:read:shoutouts, channel:read:polls, channel:read:predictions, moderator:read:followers, alongside user:read:follows from connecting Twitch. None of them lets HotDrop post, change or delete anything on the channel, and HotDrop never asks for or reads a stream key. With them, HotDrop reads the creator's current subscriber list (with tier), VIP list and moderator list once a day, and receives events from the channel: subscriptions and resubscriptions (with the months and the message a subscriber chooses to share), gifted subs, cheers and power-ups, hype trains, polls, predictions, shoutouts, raids, new followers (counted, never named) and VIP and moderator changes. We use them for badges and for stream moments in the creator's Circle, and store only what a badge or a moment needs (section 1). For a supporter who is not a HotDrop user we store their Twitch ID and Twitch username with the badge record; that badge is not shown anywhere, but a stream moment about them (for example, a gifted sub) shows their Twitch name and profile picture in that creator's Circle, as Twitch shows them in the creator's own chat. A badge record is deactivated when Twitch stops listing the supporter and deleted 30 days later; it is deleted at once when the creator disconnects Twitch, when the supporter disconnects or unlinks Twitch, and when either of them deletes their HotDrop account.

Twitch and YouTube live chat. While a creator is live, HotDrop reads their Twitch chat over an anonymous, read-only connection (it is signed in as no one and cannot post), and reads their YouTube live chat with the creator's own YouTube connection. From chat we learn which viewers are subscribers, members or moderators and record that standing for badges. If the creator has chat attendance on, we also record which viewers chatted during each stream (their Twitch ID and username, and when they were first and last seen) so the creator can recognize regulars. We do not store chat messages, except the message a viewer attaches to a resubscription or a cheer, which is part of that stream moment.

HotDrop bot. A creator can enable the HotDrop bot in their Twitch chat. The bot posts only as itself, only in channels where the creator enabled it, and only the messages described in Circle settings (for example, a stream recap or an invite to the creator's Circle). If the creator turns names on, its roll call can welcome first-time chatters by their Twitch name in that chat. It stores a record of what it sent and when.

Discord bot. HotDrop's Discord bot, HotDropRollCall, joins a server only when someone allowed to manage that server adds it. If a creator adds it, it posts a short recap after each of their streams to the channel they choose. The recap includes the stream's length, how many people chatted, the Twitch names of first-time chatters if the creator has names turned on, and a link to the creator's Circle. It does not read messages or member lists. A creator can remove it at any time. Recaps it has already posted stay in the creator's Discord server; deleting a HotDrop account deletes our record of them, not the posts in Discord.

Creator-approved claims. Where a platform gives us no automatic signal, a supporter may ask a creator to confirm their standing by hand. The creator's decision and the resulting badge are stored like any other badge.

Badge art. Creators may upload their platform's badge artwork so their supporters' badges look familiar. That artwork is public.

6. Messages and moderation

Direct messages and group chats are private. We do not scan, read or run automated moderation on them. We see a message only if a participant reports it, in which case our team reviews the reported message and the messages around it.

Public content is moderated automatically. Posts, comments, Circle messages, Stories, uploaded images, and custom emotes are checked by automated systems when they are posted: text by OpenAI's moderation service, images by Amazon Rekognition (AWS). Content the system flags may be held for human review before it is shown, or removed. We tell the author when content is held or removed; we do not share the system's scores or categories.

Reports. When you report content or a user, we keep the report, review it, and may act on it. We do not tell the reported user who reported them.

Enforcement records. When we remove content, suspend or ban an account, we keep a record of the action and the identities involved (including the platform IDs, such as a Twitch ID, and the email address used to sign in) so a banned person cannot simply sign up again. These records are kept even if the account is deleted.

7. Retention and deletion

Deleting your account. Open Settings → Account → Delete account. You will be asked to sign in again with one of your connected providers to confirm it is you. Then:

• Right away we delete your profile, posts, comments, Stories, direct messages and conversations, follows, friends and blocks, notifications, badges, linked accounts and platform connections, analytics events and email history. We revoke HotDrop's access at Twitch, YouTube (Google), TikTok and Instagram, and Sign in with Apple if we hold an Apple token for you (if we don't, you can remove HotDrop yourself at account.apple.com, under Sign in with Apple). We remove your Twitch ID, name and shared messages from other creators' stream moments, ask PostHog to delete your analytics profile and events, and start deleting the photos, videos and other files you uploaded, from Cloudinary and from our AWS storage and its delivery network.
• Within 30 days we permanently erase what is left, such as your Circle chat messages and the anonymized account record.
• What we keep: our records of moderation actions and of reports about your messages, with the platform IDs and email address of an account we banned, so bans hold (see the table above); a file a report points to, as evidence; an attachment you sent that someone forwarded into another conversation, which stays part of theirs; stream recaps already posted in a creator's Discord server; an email address that bounced or complained, on our do-not-email list (stored as a hash) so it is never mailed again; and your Twitch ID, stored only as a keyed hash on our suppression list, so creators' badge sync and chat tools do not record you again. If you later sign up with Twitch or link it again, we remove it from that list.

You can also email support@joinhotdrop.com and we will delete the account for you after confirming your identity.

Disconnecting a platform. Settings → Linked Accounts. Disconnecting Twitch revokes our access at Twitch and deletes your Twitch tokens and connection, your badge records (as a supporter, and, if you are a creator, those from your channel and its badge art), your follow dates, your channel's Twitch analytics, our copy of your Twitch profile and our event subscriptions on your channel; from then on we do not record your Twitch ID until you connect or link Twitch again. It keeps your Twitch sign-in if you use one (removing that deletes the same data), and, until you delete your account, your stream history, chat attendance and your name in other creators' stream moments. Disconnecting YouTube, TikTok or Instagram revokes our token and deletes the connection (for YouTube, also the member and moderator badges from your channel); the analytics we recorded from it stay with your account until you delete it.

If you never joined HotDrop. A creator's tools can still record your Twitch ID, username and standing, for example that you subscribe to them or chatted in their stream. Email privacy@joinhotdrop.com with your Twitch username and we will delete every record that names your Twitch account, remove your name from stream moments, and add your Twitch ID, as a keyed hash, to our suppression list so it is not recorded again.

8. Your choices and rights

• See and edit your profile and connections in Settings at any time.
• Notifications: turn push and email notifications on or off in Settings; every marketing email has an unsubscribe link.
• Delete content or your account as described in section 7.
• Export: email support@joinhotdrop.com and we will provide a copy of your account data in a machine-readable format within 30 days.
• Block any user; blocked users cannot see or contact you on the Service.

Depending on where you live (for example California and other U.S. states, the EU, the UK), you may have legal rights to access, correct, delete, port or restrict the use of your personal information, to opt out of its sale or sharing (we do none), and to not be discriminated against for exercising those rights. Email support@joinhotdrop.com to exercise them; we will verify your identity through your signed-in account and respond within the time the law requires. You may also appeal a decision by replying to our response.

Residents outside the United States. HotDrop is operated from the United States and your information is stored and processed there. By using the Service you understand that your information is transferred to the United States.

9. Age requirement

You must be at least 16 years old to use HotDrop. We ask your date of birth when you sign up and refuse accounts below that age; we do not store the date itself. We do not knowingly collect personal information from anyone under 16; if we learn we have, we delete the account and its data. If you are 16 or 17, you are responsible for using HotDrop in a way your parent or guardian would approve of, and they may contact us about your account. Report an underage account to support@joinhotdrop.com.

10. Security

Data is encrypted in transit (TLS) and at rest. Platform tokens are stored encrypted with a key kept outside the database. Access to production systems is limited to authorized personnel and logged. Every table in our database enforces row-level access rules, and the apps never talk to the database directly for writes. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as the law requires.

11. Changes to this policy

We will post changes here and update the effective date. For material changes we will also notify you in the app or by email before they take effect. Continued use after the effective date means you accept the updated policy.

12. Contact

HotDrop Technologies, Inc. — a Delaware corporation
privacy@joinhotdrop.com (also reaches support@joinhotdrop.com)