Privacy policy
What we keep, and why.
DropSlop checks and rewrites writing. This page says what that means for your text and your details, in plain words.
The short version
- Checking a draft doesn't save it. Drafts are saved only when you press Save, and only you can open them.
- Checks and standard rewrites run on DropSlop's own servers. Your text goes to another company only for a certificate, the stricter "verified" rewrite, or an app you connect.
- We don't sell your data, show ads, or use your drafts to train our models.
- Site audit reports can be opened by anyone with their link.
- You can delete your account and everything in it at any time.
What we collect
- Your email address, to send sign-in links. There are no passwords.
- What you save: drafts and their versions, voices, API key names, and connected apps.
- Usage counts: how many words you checked or rewrote, and when, so we can apply your plan's allowance. We keep the counts, not the text.
- Without an account: a one-way hash of your IP address, to apply the free daily limit. We don't keep the address itself.
- If you pay: Stripe handles your card. We keep your Stripe customer number, your plan and your invoices, never your card number.
- Messages you send to our email addresses.
Your text
Text you check is read, scored and sent back to you. It isn't stored, unless you save it or the task needs to keep it:
- Saved drafts stay in your library until you delete them.
- Rewrites are kept for a short time so you can come back to a running or finished job.
- Certificates keep the certified text and its scores, so anyone with the certificate link can check it.
- Site audits keep the pages they read and the report. Reports are public by link, and the pages are public already.
We don't use your text to train or tune our models. When we test our models, we use texts we collected or wrote for that purpose.
Who else sees it
These companies process data for us, only to provide the service:
| Company | What for | What they receive |
|---|---|---|
| Cloudflare | Delivering the website, our email addresses, and storing a daily backup copy | Web traffic, messages sent to us, and the backup copies |
| RunPod | The rented GPU server that runs rewrites | Text you rewrite, while it runs |
| Resend | Sending sign-in emails | Your email address |
| Stripe | Payments and invoices | Your payment details and billing email |
| GPTZero and Pangram | Certificates, and the "verified" detector and rewrite modes | The text being certified or verified |
| OpenAI | The "verified" rewrite mode only, to restore facts and handle lists | The text being rewritten |
| Composio | Connecting Google Docs, Notion and HubSpot | The access you grant, and the drafts you import or send |
When you connect WordPress, Ghost, Webflow or Shopify, we store the token you give us and use it only to import drafts or send drafts back. We may also share information if the law requires it.
How long we keep it
- Your account and saved work: until you delete them.
- Rewrite jobs: a few days.
- Usage counts and invoices: as long as tax and accounting law requires.
- Hashed IP addresses for free limits: a few days.
- Backups: hourly copies on our server, and one copy a day stored privately with Cloudflare. Both roll off within 30 days.
Your choices
- Delete your account from the Account page. That removes your drafts, voices, keys, connected apps and account details.
- Get a copy, or correct something: email [email protected].
- Stop paying from the Account page. Your plan runs to the end of the period you paid for.
Depending on where you live (for example the EU, the UK or California), you have rights to access, correct, delete and move your data, and to object to how we use it. Email us and we'll act on any of them. We don't sell or "share" personal information as California law defines it.
Security
Sign-in links work once and expire after 30 minutes. Each person's drafts can be opened only by that person. API keys are stored hashed, so we can't see them after you create them. Traffic is encrypted. No system is perfectly secure, and if something goes wrong that affects your data, we'll tell you.
Children
DropSlop isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has given us their details, email us and we'll delete them.
Changes
If we change this policy, we'll update the date below. For changes that matter, we'll email account holders before they take effect.
Contact
Questions or requests: [email protected]. See also the terms and the contact page.
Last updated 7 November 2026.