Privacy policy
Last updated: 29 September 2026
1. Who is responsible
The controller of your personal data is Buinsoft Technology s.r.o., Na Folimance 2155/15, Vinohrady, 120 00 Praha 2, Czech Republic, company ID (IČO) 19795319, registered in the Commercial Register kept by the Municipal Court in Prague, file C 391716. Write to info@prahapp.cz about anything in this policy.
This policy covers the Drop app for iPhone and Android, the web version at chat.prahapp.cz and this website.
2. What we collect
Your account
Your username, display name, profile photo (if you add one), app language, the date the account was created and when you accepted which version of the terms. We do not ask for your phone number, email address or real name.
When you first open Drop on a phone, the app creates your account with a random password that is kept only in the phone's protected storage. When you open someone's Drop link in a browser, the web version creates an account the same way and keeps its details in that browser. If you set your own password, we store it only as a hash.
What you send
Messages and everything in them: text, photos, videos, voice messages, video messages, files, reactions and edits. Also stories and replies to them, group names and photos, debt records and payment notes, and shared tasks. For each message we store who sent it to which chat and when, and when it was delivered and read.
When you send a link, your phone opens the page to build a preview and saves the title, a short description and the address of the preview image with the message. The phones of the people in the chat then load that image directly from the website it comes from, so that website can see their IP address.
Things only you see
Nicknames you give your contacts, saved messages, chat lock codes (stored only as a hash) and your translation settings. Other users cannot see them and they are not shown to administrators.
Calls
Voice and video calls pass through our own call server. We do not record calls. For every call we keep a record of who called whom, when, whether it was a voice or video call, whether it was answered and how long it lasted. For a translated call we also keep the two languages and how long the translation ran.
Translation and transcription, only with your permission
These features use Google's artificial intelligence (Gemini). Drop asks for your permission before you use them for the first time, and you can withdraw it at any time.
- Messages, voice messages and videos. When you translate a message, or have a voice message or video transcribed or translated, its text or audio is sent to Google Cloud in the EU. We store the result (the translation, the transcript and, if you play the translation, the generated audio) so that it does not have to be produced again. To pick a fitting voice for that audio, the AI also estimates whether the speaker sounds female or male, and we store this estimate with the transcript.
- Translated calls. During a translated call, what both people say is streamed through our translator server to Google's live translation service, which sends back the translated voice and captions. Neither the audio nor the text of the conversation is stored or logged.
If someone you chat with translates one of your messages, its content is also sent to Google for this purpose, even if you have not turned on these features yourself.
Device and usage data
- Device: phone model, operating system version, app version and build number. We use them for support and troubleshooting.
- Notification tokens: identifiers from Apple, Google and Expo that let us deliver notifications and ring incoming calls.
- Usage statistics: while the app is open it sends an "active" signal once a minute. From it we store when you were last active and, for each day, how many minutes you used the app, in how many separate sessions and how many messages you sent. The content of your messages is never part of these statistics.
- Online status and typing: you can hide them from other users in Settings. Administrators still see them.
Reports and moderation records
Reports you make and reports about you, with a text copy of the reported message (for a reported story: the story itself and its caption) and the usernames involved. Also blocks, screenshot notices and permission requests, messages marked by our word filter and a log of administrator actions.
Technical data
When your app or browser connects to our servers, our hosting providers record technical data such as your IP address and the time of the request. When you sign in on a computer with a QR code, we keep a short description of that browser for a few minutes.
Emails
If you write to us, we receive your email address and what you write.
What we do not collect
We do not collect your phone number, contacts or address book, location or advertising identifiers. Drop shows no ads and contains no analytics or advertising tools from other companies. The camera, microphone and photo library are used only when you use a feature that needs them, such as a call, a voice message or sending a photo.
3. Why we use your data and on what legal basis
| Purpose | Legal basis under the GDPR |
|---|---|
| Running Drop: your account, delivering messages, calls, groups, stories, the debt ledger, tasks, notifications and signing in on other devices | Performance of our contract with you (Article 6(1)(b)) |
| Translation and transcription that you ask for | Your consent (Article 6(1)(a)). For other people's messages that you translate: the legitimate interest in understanding messages sent to you (Article 6(1)(f)) |
| Moderation: reviewing reports, the word filter, administrators viewing content to enforce the rules, preventing abuse and fraud | Our legitimate interest in preventing abuse and protecting Drop's users (Article 6(1)(f)) and our legal obligations, for example under the EU Digital Services Act (Article 6(1)(c)) |
| Support, troubleshooting and improving Drop using device data and usage statistics | Our legitimate interest in running and improving the service (Article 6(1)(f)) |
| Answering authorities and meeting other legal obligations | Legal obligation (Article 6(1)(c)) |
| Answering your emails | Performance of the contract or our legitimate interest (Article 6(1)(b) or (f)) |
You can object to processing based on legitimate interest at any time (see section 8).
4. Who can see your data
People you chat with. Members of a chat see the messages in it. Other Drop users can see your username, display name and profile photo. When you share a story you choose whether everyone on Drop can see it or only the people you chat with. You can see who viewed and liked your stories.
Drop administrators. Our administrators can view every chat and message, including photos, videos, voice messages, files and messages that were deleted in the app. They also see call records, debt records, tasks, stories and who viewed them, device data, usage statistics and your online status even if you hid it. The app's screenshot protection does not apply to them. They use this access for moderation, protecting users, handling reports and support. They can suspend or delete accounts, remove messages and stories and, when you ask for help signing in, set a new password for your account. These actions are recorded in a log.
Service providers. The following providers process data only on our behalf, to provide these services:
| Provider | What it does for Drop | Where |
|---|---|---|
| Supabase, Inc. | Database, file storage, sign-in and server functions | EU (Frankfurt, Germany) |
| Hetzner Online GmbH | Our servers for calls, translated calls and the Android app download | Germany |
| Google (Google Cloud) | AI translation, transcription and generated speech (Vertex AI, Gemini) | EU (Netherlands) |
| Google (Google Cloud) | Live translation in translated calls (Gemini Live) | Google's global infrastructure, also outside the EU |
| Expo (650 Industries, Inc.) | Sending notifications | USA |
| Apple Inc. | Delivering notifications and incoming calls to iPhones | USA |
| Google (Firebase Cloud Messaging) | Delivering notifications and incoming calls to Android phones | USA |
| Cloudflare, Inc. | Hosting and delivering this website, the web version and our admin panel | Global network |
Notifications that pass through Expo, Apple and Google contain the name of the sender or the group. The content of the message is not included.
Authorities. We disclose data to courts, the police or other authorities when the law requires it. We report child sexual abuse material and situations that put someone's life at risk to the competent authorities.
We do not sell your data and do not share it for advertising.
5. Transfers outside the EU
Most of your data stays in the EU. Expo, Apple, Google (for notifications and live call translation) and Cloudflare may process data outside the EU, mainly in the USA. For these transfers we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or on the Commission's standard contractual clauses. For more information, write to info@prahapp.cz.
6. How long we keep data
- Account and profile: until you delete your account.
- Messages and files: until the sender's account is deleted. A message deleted in the app, for yourself or for everyone, disappears from the chat, but we keep it with its files so that administrators can still review it. It is erased when the sender's account is deleted.
- Disappearing messages: erased for good, with their files, shortly after their timer (1 hour, 24 hours or 7 days) runs out.
- View-once photos: the file is erased as soon as the photo is opened.
- Stories: erased with their files 24 hours after posting. A reported story is kept until the report is closed.
- Translations, transcripts and generated audio: erased when the original message is edited or deleted.
- Call records: kept in the call history while the accounts exist. When an account is deleted, the record stays in the other person's history without a link to the deleted account.
- Device data, notification tokens and usage statistics: until you delete your account. Daily totals for the whole service, which do not identify anyone, are kept longer.
- Reports and moderation records: up to 12 months after the review is finished, even if the account has been deleted in the meantime.
- QR sign-in requests: a few minutes.
- Emails to us: as long as needed to handle your request.
We keep data longer only when the law requires it, for example when an authority asks us to preserve it.
7. Deleting your account
In the app, go to Profile › Settings › Session › Delete my account and confirm twice. Your account is deleted immediately. What is deleted, what is kept and how to ask by email if you no longer have the app is described on the account deletion page.
8. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it (Article 15);
- have incorrect data corrected (Article 16); you can also change your name, username and photo in the app yourself;
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive the data you gave us in a machine-readable format (Article 20);
- object to processing based on legitimate interest (Article 21);
- withdraw your consent at any time, without affecting processing that took place before (Article 7(3)). For the AI features: Profile › Settings › Translation › AI permission.
Write to info@prahapp.cz and include your username. We may ask for information that helps us confirm that the account is yours. We reply within one month; if a request is complex, we may extend this by two more months and will tell you why.
You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Praha 7, uoou.gov.cz. You can also contact the authority in the EU country where you live or work.
9. Minimum age
Drop is only for people aged 18 and over. We do not knowingly process data of anyone younger. If we learn that an account belongs to someone under 18, we delete it.
10. Cookies and browser storage
This website does not use cookies. It only remembers your language choice in your browser's local storage. The web version at chat.prahapp.cz keeps your sign-in session, the details of an account created in the browser, your settings and a copy of recent chats in the browser's local storage, so that it works and you stay signed in; you can remove them by clearing the site data in your browser. The phone app keeps your sign-in details in the phone's protected storage. We use no cookies or similar technology for analytics or advertising. Cloudflare, which delivers our sites, may set a strictly necessary cookie to protect them from abuse.
11. Changes to this policy
We update this policy when Drop or the law changes. The date at the top of the page shows the current version. We announce significant changes in the app.
12. Contact
info@prahapp.cz · Buinsoft Technology s.r.o., Na Folimance 2155/15, Vinohrady, 120 00 Praha 2, Czech Republic