#Overview
BrassDrop collects the minimum we need to track prices and send you alerts. We do not sell your personal information, and we do not share what you track with retailers or advertisers.
We know your email, what you've asked us to watch, and basic usage data. Retailers only learn that a visitor came from BrassDrop — never who you are.
#What We Collect
| Data | Examples | Source |
|---|---|---|
| Account | Email, hashed password | You, at sign-up |
| Tracking | Watched products, calibers, price alerts | You, in the app |
| Billing | Plan, billing history (card details stay with our payment processor) | Stripe, our payment processor |
| Sessions | IP address and browser type of each signed-in device, for security and to limit abuse | Automatically |
| Usage | Outbound deal clicks (linked to your account if you're signed in), browser type, and page views counted in aggregate | Automatically |
We do not collect firearm serial numbers, purchase receipts, or government ID.
#How We Use It
- Run your account and deliver the alerts you set up
- Process subscriptions and refunds
- Measure which retailers and features are useful so we can improve them
- Attribute affiliate clicks — counted in aggregate, not tied to your identity on the retailer's side
- Prevent abuse, scraping, and fraud
#Who We Share It With
We share data only with service providers that help us run BrassDrop, under contracts that limit their use of it:
- Payment processing — Stripe, to handle subscriptions and card payments
- Email delivery — Resend, to send alerts and account messages
- Hosting and backups — OVHcloud, which runs our servers and stores our encrypted backups
- Network, security and analytics — Cloudflare, which delivers the site, blocks bots and attacks, and counts page views without cookies
- Support email — Proton, which hosts our support inbox when you write to us
We may also disclose information when the law requires it. We will notify affected users where we are legally allowed to.
#Retention
We keep account and tracking data while your account is open. When you delete your account, we delete your email, password, sessions, alerts and alert history right away. We keep backups, so copies of your personal data are kept for up to 5 weeks after you delete your account, until those backups expire.
Three kinds of records are kept after that, detached from your account:
- Billing records: the plan, its dates and status, and the payment processor's reference. We keep these for up to seven years, as tax and accounting law requires. Deleting your account deletes your Stripe customer record and saved cards; Stripe keeps its own record of your charges under its privacy policy.
- Usage records, such as outbound deal clicks, counted in aggregate.
- Issue reports you sent us: what you wrote and the page you sent it from, without your email or browser details.
#Your Choices and Rights
- Edit or delete your watchlists and alerts any time from your account
- Unsubscribe from non-essential email with the link in any message
- Request a copy of your data, or deletion of your account, by emailing [email protected]
- Control cookies as described in our Cookie Policy
Depending on where you live (for example, California), you may have additional rights. We honor those requests regardless of your state.
#Security
Passwords are hashed, connections use TLS, and access to production data is limited to staff who need it. No system is perfectly secure. If we learn of a breach affecting your data, we will notify you without undue delay.