Privacy policy

Get Hot Drop is a play-money site at gethotdrop.com where players take seats in lots for real products and a wheel picks the winner. This policy explains what we collect when you use it, who can see it and what you can ask us to do with it.

Your account. Your email address, which we use to send your sign-in code and link. If you choose Continue with Google, Google tells our sign-in service your email address, name and profile picture; we don't copy your Google name or picture into your Get Hot Drop profile. We also keep the time you confirmed you are 18 or older, and the invite or promo code you signed up with, if any.

Your profile. A username and display name (we make one up for you, and you can change both), your critter, and a photo if you upload one. Your browser crops the photo to a square of at most 512 pixels and saves it as a new image before it is uploaded, so the original file's details, such as where it was taken, are not carried over.

Contacts and prizes. If you add them: a postal address saved on your profile, and a phone number we check with a code sent by SMS. If you win, the name, address and phone number you give for delivery, and the tracking number once the prize ships.

Play and coins. The lots you sit in, your seat number and when you joined, how far you got, the boosts you bought and the coins they cost, your coin balances and every change to them, your daily chest, missions, achievements and relics, your guild, the lots you watch, partner discounts you open, and your in-app notifications. If you ask for a calendar link, we create a private link to your rounds.

Settings. Your notification choices and your time zone (from your browser at first; you can change it in settings), used to show times in your own time zone. If you give a phone number for texts before finals when you join, we keep it with your notification choices (texts aren't sent yet).

What we don't collect. We don't ask for your date of birth or ID, and nothing can be bought for money today, so we hold no card or bank details. There are no analytics or advertising trackers on the site. Our own code doesn't record your IP address or device; our hosting and sign-in providers handle request data such as IP addresses to run the service.

Get Hot Drop is a public game, and draws are meant to be checked by anyone. Anyone, signed in or not, can see:

• your player card: your critter and its name, your photo if you uploaded one, your XP, wins, rank and guild. Your username and display name show only if you turn on showing your name (it is off by default). Your photo shows even when your name is hidden;
• every lot you sit in, your seat on its wheel, when you joined, how far you got and any coins refunded on the seat;
• the boost units on your seat in each round and how wide that makes your slice, live while boosts are on sale and after the draw. We don't show what you spent, but boost prices are public, so it can be worked out roughly;
• the results of every draw, including who went through and who won;
• the relics you hold and wear, and how you got each one;
• whether you are on the site right now: while you have it open and are signed in, your player id is shared with everyone else on the site, which is how we count who is online.

If you joined through a friend's invite, they can tell which player card is yours. Your calendar link is private, but anyone who has it can see your lots and round times, so keep it to yourself.

Other players can't see your email address, contacts, coin balances, coin history, notifications or settings.

• to sign you in and keep you signed in;
• to run lots and draws, keep your coins right, and publish results anyone can check;
• to ship a prize you win and tell you when it is on its way;
• to stop abuse: one welcome bonus per mailbox, invite and promo codes used fairly, and no one taking over a username that just changed hands;
• to send your in-app notifications and reminders;
• to help you when something goes wrong.

We email you only about signing in and your account: codes, links and address changes. Game news goes to your in-app inbox. We don't sell your data or use it for advertising.

Our staff can see your profile, coin history, seats, boosts and prize claims, including the delivery address and phone, to run the game and support you. Staff who handle prizes and support can also see the contacts saved on your profile. Our back-office tools don't show your email address. Changes staff make to an account (adjustments, roles, prize shipping) are logged. Viewing your data isn't logged yet.

• Supabase hosts our database, sign-in, file storage (your photo) and live updates. Everything above is stored there.
• Cloudflare runs the website and handles every request to it, and keeps request logs.
• Resend delivers our sign-in emails, so it receives your email address and the message.
• Twilio sends and checks the SMS code when you add a phone number, so it receives that number.
• Google, if you choose Continue with Google, to sign you in. Our sign-in emails also load a font from Google Fonts, so Google may see your IP address when your mail app shows the email.

Where these providers store data: to be confirmed before launch.

If you open a partner discount, you go to the partner's site; we don't send them anything about you. If you add your calendar link to Google Calendar or Outlook, that service fetches your rounds from it.

We set only our own cookies, all needed for the site to work:

• a sign-in cookie that keeps you signed in, refreshed as you use the site and removed when you sign out;
• lm_ref and lm_promo, the invite or promo code from a link you followed, for up to 30 days or until you sign up;
• lm_age_ok, your 18+ answer while you sign up with Google, for up to 10 minutes.

Your browser also remembers which win celebrations you have already seen, so they don't play twice. There are no analytics or advertising cookies.

We keep your data while your account exists. There is no automatic deletion schedule yet. When you change or remove your photo, we delete the old file. Copies already cached by browsers or our storage provider may stay visible for a while.

There is no delete button in the app yet. Once the contact address above is set, you can write to it to ask us to delete your account and data; until then, deletion can't be requested.

Some records stay after an account is deleted:

• a normalised form of your email address, so the same mailbox can't collect a second welcome bonus;
• draw records, which list the players in each round, so past draws can still be checked;
• the lots you won, which keep you as their winner so the result can still be checked;
• usernames that were given up, with the date;
• our log of staff actions;
• payment records, no longer linked to you.

You can change your username, display name, critter, photo, whether your name shows, your contacts and your notification settings yourself, in your profile.

You can also ask us for a copy of your data, to correct it, to delete it, or to stop using it for a purpose you object to. Once the contact address above is set, send requests there; until then, these requests can't be made yet. You can also complain to your local data protection authority.

Get Hot Drop is for adults only. You must confirm you are 18 or older before you can take a seat or boost. We don't knowingly collect data from children. If you think a child has an account, write to the contact address above once it is set, and we will close it.

We may update this policy and will say so here, with the date at the top, before changes take effect. The official rules cover how the game itself works.