vaultdropLast updated 23 October 2026
vaultdrop is run from Portugal, and is responsible for the personal data described here (the “data controller” under the GDPR). For anything about your data, email [email protected].
When you make an account we store your name, handle, email address, the date you confirmed that email, and your password as a one-way hash (never the password itself). If you add them, we also keep your profile picture, banner, bio, name colour and your settings. Signing in with Google or Spotify gives us your name, email and profile picture from them.
We store what you upload: audio files, artwork, and details like title, artists, genre and album, including tags that were already inside the files (such as cover art).
We record what you do on the site: plays (with a listening history on your account if you’re signed in), likes, follows, shares, searches, the messages you send and receive, and the notifications we create for you.
Donations are sent through PayPal, to the operator’s PayPal account. PayPal shows us the name, email and note the donor gives it. If you wrote your @handle in the note, we add the amount to your donation total on vaultdrop by hand. Card and bank details are typed into PayPal, not into vaultdrop, so we never have them.
If you use the advertising form, we keep your name, work email, company and budget if you give them, your message, and when you agreed to be contacted.
Like any website, our server logs IP addresses, browser and device details, which pages were requested and when. We use the browser language or a country hint from our network provider to pick which currency to show you. For our own dashboard we count plays, sign-ups, shares and payments.
And if you email us (support, copyright complaints, anything else), we keep that correspondence.
The GDPR asks us to name a legal reason for each use. Here they are:
| What we use it for | Legal basis (GDPR art. 6) |
|---|---|
| Running your account, hosting and playing your uploads, recommendations, search, messages, notifications and the Spotify export | Our agreement with you (the Terms) |
| Handling donations, stopping fraud, keeping accounts for tax | Our agreement with you; legal obligation (tax and accounting law) |
| Security: logs, CAPTCHA, rate limits, dealing with abuse and copyright complaints | Legitimate interest in keeping the site safe and legal |
| Counting plays, sign-ups, shares and payments for our own dashboard | Legitimate interest in knowing how the site is used |
| Replying to advertising inquiries | Consent (the checkbox on the form), which you can withdraw whenever you want |
| Telling you about important changes to the Terms or the site | Our agreement with you; legal obligation |
We don’t build advertising profiles, we don’t sell your data, and no automated system makes decisions about you that have legal or similar effects.
vaultdrop is a public site. Anyone, search engines included, can see your handle, display name, profile picture, banner, bio, uploads, albums, who you follow and who follows you, like counts on tracks, and, if you’ve donated, the Donor badge and your donation total on the Donors list (you can hide both in Settings). Your email, password, listening history, messages and payment details stay private. When someone shares a track or profile, the link preview shows that public page.
PayPal, Google, Spotify and Cloudflare also process data in the United States and other countries. They protect it with the European Commission’s Standard Contractual Clauses and, where they’re certified, the EU-US Data Privacy Framework. Our own server, database and uploads are in Germany and don’t leave the EU.
You can ask to see the data we have on you and get a copy of it, including in a machine-readable format. You can correct it (most things you can fix yourself in Edit profile and Settings) or have it deleted (Settings → Delete account does that immediately; for anything else, email us). You can object to what we do under “legitimate interest”, ask us to pause processing while we sort out a disagreement, and withdraw consent wherever consent is the reason we’re using something.
Email [email protected] for any of this. We’ll reply within a month, and we might ask you to prove it’s really you. You can also complain to a data protection authority: in Portugal that’s the Comissão Nacional de Proteção de Dados (CNPD), or you can go to the one in the EU country where you live.
Passwords are stored as salted bcrypt hashes and payment details never reach us. Only the operator can get into the server, the database isn’t reachable from the internet, uploaded files are checked before we store them, and public forms have a CAPTCHA. Nothing is perfectly secure, though. If there’s ever a breach that affects your data, we’ll tell you and the authorities as the law requires.
vaultdrop isn’t meant for anyone under 18, and we don’t knowingly collect their data. If you think a child has made an account, let us know and we’ll remove it.
If we change this policy, the new version goes up here with a new date. If the change really affects you, account holders will get an email or a notice on the site before it applies.
Questions or requests about your data: [email protected].