vaultdropLast updated 20 September 2026
This policy explains what personal data vaultdrop collects, why, who sees it, how long we keep it and the rights you have over it. We collect what the service needs to work and nothing for advertising profiles.
vaultdrop, operated from Portugal, is the data controller for the personal data described here. Contact for anything privacy-related: [email protected]. This policy is written to comply with the EU General Data Protection Regulation (GDPR) and Portuguese data-protection law.
Account data. Name, handle, email address and a hashed password (we never store the password itself). Optionally: profile picture, banner, bio, display-name colour, and settings such as notification and supporter-list preferences. If you sign in with Google or Spotify we receive your name, email and profile picture from them.
Content you upload. Audio files, artwork, and metadata such as title, artists, genre and album, plus the technical tags embedded in the files you upload (for example ID3 cover art).
Activity.Plays (including a listening history attached to your account when you're signed in), likes, follows, shares, searches you run, direct messages you send and receive, and notifications generated for you.
Payments.When you subscribe or donate we create a customer record with Stripe and store the Stripe customer ID, your membership tier and period, and the total you've donated. Card numbers are entered on Stripe's pages and never reach our servers.
Advertiser inquiries. Name, work email, optional company and budget, your message, and the time you gave consent to be contacted.
Technical data. IP address, browser and device information, the pages and API endpoints requested and timestamps, in our web-server logs, plus the region signals we use to pick a display currency (browser language or a country header from our hosting layer). We also keep an anonymised event log of sign-ups, shares, subscriptions and donations for the admin dashboard.
Correspondence. Anything you send us by email, including copyright notices and support requests.
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running your account, hosting and streaming your uploads, recommendations, search, messaging, notifications, the player and Spotify export | Performance of our contract with you (the Terms) |
| Processing memberships and donations, preventing fraud, keeping accounting records | Contract; legal obligation (tax and accounting law) |
| Security: logs, CAPTCHA, rate limiting, abuse and copyright enforcement | Legitimate interest in a safe, lawful service |
| Product analytics on the admin dashboard (aggregated counts of sign-ups, plays, shares) | Legitimate interest in understanding and improving the service |
| Answering advertiser inquiries | Consent (the checkbox on the form); you can withdraw it any time |
| Notifying you of important changes to the Terms or the service | Contract; legal obligation |
We don't use your data for advertising profiles, we don't sell it, and we don't make automated decisions with legal or similarly significant effects about you.
vaultdropis a public music platform. Your handle, display name, profile picture, banner, bio, uploads, albums, follower and following lists, like counts on tracks and the “Supporters” badge (unless you hide it in Settings) are visible to anyone, including search engines. Your email, password, listening history, direct messages and payment details are private. Public track and profile pages are also rendered into link previews when someone shares them.
Stripe, Google, Spotify and Cloudflare process data in the United States and elsewhere. They rely on the European Commission's Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework, to protect data leaving the EEA. Our own server, database and uploaded files are hosted by Contabo GmbH in Germany, inside the European Union, so they don't leave the EEA.
Under the GDPR you can:
Email [email protected]to exercise any of these. We'll answer within one month and may ask you to confirm your identity. You also have the right to complain to a supervisory authority, in Portugal the Comissão Nacional de Proteção de Dados (CNPD), or the authority in the EU country where you live.
Passwords are stored as salted bcrypt hashes. Payment details never touch our systems. Server access is restricted to the operator, the database is not exposed to the internet, uploaded files are checked for type before being stored, and public forms are protected by a CAPTCHA. No system is perfectly secure; if we learn of a breach affecting your data we'll notify you and the authorities as the law requires.
vaultdrop is not directed at children under 16and we don't knowingly collect their data. If you believe a child has created an account, contact us and we'll remove it.
We'll post any changes here with a new “Last updated” date and, when they materially affect you, notify account holders by email or an in-app notice before they take effect.
Privacy questions and requests: [email protected].