Privacy Policy

Overview

This policy covers drate.app, the Drate dashboard, and the websites creators run on Drate, including sites on a creator’s own domain. It applies alongside our Terms of Service. The data controller is Drate.

On a creator’s site, the creator decides what to publish and sell and is responsible for their relationship with their members. Drate processes member data to operate that site on the creator’s behalf.

What we collect

Information you give us.

• Account details: name, email, password (stored hashed), a phone number if you sign in with one, or your Google or Apple account identity if you sign in that way
• Billing details: handled by Stripe; we never see or store your full card number
• Creator details: payout information collected by Stripe when a creator connects their Stripe account
• Patreon details: if you connect Patreon, your Patreon identity and membership tier, so the right access can be granted
• YouTube and TikTok details: if a creator connects YouTube or TikTok to share their videos, the channel or account name and picture, and encrypted access that lets Drate upload the videos they choose
• Content: sites, pages, posts, media and files creators publish; posts, replies and likes in a community; messages between a creator and their members; and anything you submit through forms such as a contact request
• Orders: if you buy a physical product from a creator’s shop, the shipping details needed to deliver it

Information collected automatically.

• Device data: browser type and operating system, used for compatibility and debugging
• Logs: server logs and error reports, which may include your IP address and the request that failed
• Playback position: where you stopped in audio or video on a creator’s site, so you can pick up where you left off
• Visit statistics: when a page on drate.app or on a creator’s site loads, the page’s address, the site that linked to it, your country and your kind of device (desktop, phone or tablet). On a creator’s site these are recorded without cookies, IP addresses or account details and shown to the creator only as totals
• drate.app visit records: on Drate’s own pages (drate.app, not creator sites) we also record your IP address, the approximate location (city and region) and network it belongs to, and your browser’s user agent. This shows Drate how people find and use drate.app, page by page, and helps us spot abuse. Only Drate staff can see these records. They use no cookies and aren’t linked to your account
• How drate.app is used: on those same pages, we also record which links and buttons you use, how far down each page you scroll, and whether a visit goes on to the sign-up form and a new account. This shows us which pages help people get started, so we can make them better. We never record what you type. These records are part of your drate.app visit records and follow the same rules
• Paid content records: when you open a members-only post, picture, file, video or episode on a creator’s site or app, we record what you opened and when, your IP address, the network and country it came from, and your browser’s user agent. We also note the network, address and browser each signed-in session began from, until that session ends. This protects creators from account sharing and leaks: it lets us sign out a session that is used from a server, from many places at once, or reads like a script, and lets the creator check whose copy a leaked file came from. The creator of that site can see what their members opened and when, from which network, country and device. Records of what you opened, and of unusual activity on your account, are kept for 90 days
• Copy identifiers: members-only pictures, files, videos, audio and post text you open on a creator’s site or app carry an invisible identifier linked to your account. PDFs also print your name and a code on every page, and pictures and videos show them if the creator turns that on. This lets the creator trace a copy that’s shared outside their site

Visit statistics and drate.app visit records are kept for three months.

On Drate’s own pages, including sign-up and setup, we also use PostHog (PostHog Inc., in the United States) to understand how visitors use them: what they click, how far they scroll, which pages they move between, and recordings of their visits. Those recordings include visible page text and information entered into forms, such as your name, email and creator setup details. Password fields are masked. Inside the dashboard, PostHog records only which product steps a creator completes, and makes no recordings. If you message us through the chat on those pages, PostHog keeps your messages, and your email if you give it, so we can reply. PostHog processes this data under its privacy policy. Creators’ sites don’t use PostHog.

How we use it

• To provide the Service: host creator sites, deliver member content, process memberships and purchases, and grant the access each plan includes
• To keep the Service safe: detect fraud, abuse, and attacks
• To improve the product: understand where things break, and which of Drate’s own pages help people get started
• To communicate: transactional email such as sign-in links, receipts and security notices, and messages a creator sends to their own members
• To comply with legal obligations, including tax and accounting requirements

We don’t sell your personal information, and we don’t show third-party advertising. Drate does advertise itself on Google, and measures those ads as described under Cookies and sessions below.

Who can see what

A creator can see the members of their own site: name, email, membership status and the activity members take on that site, such as community posts and messages to the creator. To protect their paid content, they can also see their members’ signed-in devices and paid content records, described above. Creators don’t see members’ passwords or full card details, and they don’t see what you do on other creators’ sites.

AI features and your data

When a feature uses AI to generate a draft, the relevant context (for example a creator’s public brand details and the direction they typed) is sent to our model provider to generate the result. We use providers under terms that prohibit them from training their models on this data. Drate doesn’t use your private content or conversations to train AI models either.

Cookies and sessions

We use a small number of first-party cookies: a session cookie that keeps you signed in, a cookie that remembers you unlocked a password-protected site, and preferences such as light or dark appearance. Blocking cookies will break sign-in but leaves public browsing intact.

On Drate’s own pages (drate.app and the Drate dashboard), we use Google’s ad measurement tag to learn whether our ads on Google lead people to sign up. It sets Google advertising cookies and tells Google when a Drate account is created, so Google can match sign-ups to clicks on our ads. It reports which page you’re on without its query string, apart from the ad details Google added to the link. We don’t use it for personalized ads. It stays off for visitors in the European Economic Area, the United Kingdom and Switzerland, and whenever your browser sends a Global Privacy Control signal. You can also manage Google’s ad settings at myadcenter.google.com. Creators’ sites don’t use advertising or cross-site tracking cookies.

Creators can embed video from services such as YouTube or Vimeo. When you play an embedded video, that service may set its own cookies under its own privacy policy.

When we share data

We share data only with the providers needed to run the Service:

• Stripe: payment processing and creator payouts
• Cloudflare: hosting, storage, and content delivery; your data is processed on Cloudflare’s network
• Email and text message delivery providers: to send sign-in links, receipts and other transactional messages
• AI model providers: to generate drafts for AI features, as described above
• Fulfillment providers: to print and ship physical products ordered from a creator’s shop
• Google: to measure whether Drate’s own ads lead to sign-ups, on Drate’s own pages only, as described under Cookies and sessions
• PostHog: to understand how people use Drate’s own pages and the dashboard, and to answer messages sent through the chat on those pages, as described under What we collect

Beyond that, we share data when you direct us to (for example, when you connect Patreon or a booking calendar), with the creator whose site you join as described above, when required by law, or as part of a merger or acquisition, in which case this policy continues to apply to data collected before the change.

YouTube and TikTok

Creators can connect a YouTube channel or a TikTok account to share their own videos from Drate.

• Drate uses YouTube API Services. When you connect YouTube, the Google Privacy Policy also applies, and you agree to the YouTube Terms of Service.
• Drate reads the channel or account name and picture, uploads only the videos you choose to share with the title, description and settings you choose, and reads their processing status to show you progress. It doesn’t read your other videos, comments or analytics.
• Access is encrypted and used only for these uploads. We don’t share it, or anything we receive from YouTube or TikTok, with anyone else.
• Disconnecting in Drate removes Drate’s access and deletes what we stored about the account within seven days. You can also remove Drate’s access in your Google account’s security settings or in TikTok’s app permissions. Videos you’ve already shared stay on YouTube or TikTok until you remove them there.
• Questions go to support@drate.app.

Data retention

We keep your data while your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except records we’re legally required to keep (such as transaction records for tax purposes) and residual copies in backups, which expire on their normal rotation.

You can delete your account yourself at any time: in the Drate app under Settings › Account › Delete account, or at drate.app/account/delete. You’re signed out everywhere right away. A space you own goes to one of its team admins if they accept, or closes: it takes no new members, current memberships end at the end of their paid period, and then it closes for good. Posts and messages you left in other creators’ spaces stay, shown as “Deleted account” without your name or picture.

Security

Data is encrypted in transit and at rest. Passwords are hashed, never stored in plain text. Access to production data is restricted. No system is perfectly secure. If we learn of a breach affecting your personal data, we’ll notify you without undue delay.

Found a vulnerability? Report it to support@drate.app.

Your rights

Depending on where you live (including under GDPR and CCPA), you may have the right to:

• Access a copy of the personal data we hold about you
• Correct inaccurate data
• Delete your data
• Export your data in a portable format
• Object to or restrict certain processing

To exercise any of these, email support@drate.app and we’ll respond within 30 days.

Children

Drate is not directed at children under 16, and we don’t knowingly collect their personal information. If you believe a child has created an account, contact us and we’ll delete it.

Changes to this policy

We’ll update this policy as the Service evolves. Material changes get notice by email or in-product before they take effect, and the date at the top always reflects the latest revision.

Contact

Questions about privacy at Drate? Email support@drate.app.