Privacy Policy

This Privacy Policy explains how UDrop, LLC (“UDrop”, “we”) collects, uses and shares information when you use udrop.co, app.udrop.co and related services (the “Service”). It is part of our Terms of Service.

UDrop is not a university and is not a “school official” under FERPA. We never receive student records from any school. Verification uses only what you give us.

Account. Email address, a hashed password (we cannot see it), display name, home campus, the campus and intent you chose on udrop.co when signing up, and sign-in timestamps.

Listings and activity. Photos, titles, descriptions, prices and condition of items you list; items you save; searches; offers and counteroffers, including Smart Sell settings (your private minimum is visible only to you and to our systems that enforce it); messages you send through the Service; ratings you give and receive; reports and blocks.

Transactions. What was bought and sold, amounts, fees, status, timestamps and a hashed pickup code. Card details are collected and stored by our payment processor, not UDrop. Sellers’ payout details are held by the processor; we store only its account identifier and onboarding status.

Student verification. If you verify by email, the school email address you enter. If you verify with a student ID photo, the photo you submit, which is analyzed by an automated model that returns a short assessment (school name, whether it appears to be a current student ID, whether it appears altered, and a confidence score). We instruct the model not to extract ID numbers or dates of birth, and we strip number sequences from its output. The photo itself is kept only if a UDrop administrator needs to review it; photos from automatically approved or rejected submissions are not stored.

Safety signals. When our contact-sharing filter blocks a message, listing text or display name, we log that an attempt happened, the kind of information blocked, and the text, so we can tune the filter and act on abuse.

Technical data. IP address, browser and device type, pages viewed and actions taken, error reports, and approximate location derived from IP. On udrop.co we record marketing events such as which campus you selected and which buttons you clicked. [Analytics provider to be confirmed.]

Waitlist and campus requests. If you ask us to come to your campus, the school, email and role you enter.

• to run the marketplace: show listings to your campus, deliver messages and offers, process payments and payouts, and confirm pickups;
• to generate listing drafts and SmartPrice suggestions from your photos and to run Smart Sell under your settings;
• to verify students and display the verified badge;
• to keep the community safe: block contact-sharing, review reports, detect fraud, enforce our Terms;
• to send transactional email such as confirmation links, password resets and transaction updates;
• to understand how the Service is used and improve it, including which campuses are ready to launch;
• to comply with law, including payment and tax rules.

We do not sell your personal information and we do not show third-party advertising.

Other users. Your display name, verified badge, rating, campus and your listings are visible to other users. The buyer and seller in a transaction see each other’s display name and the messages between them. Your email and phone number are never shown to other users.

Service providers that process data on our behalf under contract:

• a PCI-compliant payment processor: payments, payouts and seller identity checks (its privacy policy, shown at checkout and payout setup, applies to what you give it directly);
• Supabase: database, authentication, file storage and server functions;
• Netlify: website hosting and the campus waitlist forms;
• Resend: transactional email delivery;
• an AI model provider configured by UDrop (currently [Anthropic / OpenAI / other]) that analyzes listing photos and student ID photos to produce the assessments described above; images are sent for processing and are not used to train their models under our agreement;
• Sentry: error monitoring;
• [analytics provider].

Legal and safety. We may share information to comply with law, respond to lawful requests, protect the rights and safety of users and others, or in connection with a merger, acquisition or sale of assets, in which case this policy continues to apply.

Universities. We do not report your activity to your school. We may share information with campus or local law enforcement when required by law or when we believe someone is in danger.

• Account and profile data: for as long as your account exists, then deleted on request or deletion.
• Student ID photos: not stored for automatically approved or rejected submissions; for submissions sent to human review, deleted within [30] days of the decision.
• Verification records: a verified status lasts 18 months, after which you may re-verify.
• Transaction records: retained for [7] years after the transaction for payment, tax and dispute purposes, even if the account is deleted. When an account with transaction history is deleted, the account is anonymized: sign-in is disabled, email and password are removed, the profile is scrubbed and listings are deleted, while the transaction ledger keeps an anonymous reference.
• Messages and offers: kept while the related account and conversation exist; messages from a deleted account lose their sender reference.
• Safety and audit logs: up to [24] months.

You can edit your display name and home campus in your profile, change your email and password, block other users, and stop using the Service at any time. You can delete your account yourself from Profile → Delete account in the app. To access, correct or export your personal information, email support@udrop.co from the address on your account. We respond within the time the law requires.

Depending on where you live, including under the Texas Data Privacy and Security Act and the California Consumer Privacy Act, you may have rights to know, access, correct, delete and port your information, to opt out of sale or targeted advertising (we do neither), and not to be discriminated against for exercising these rights. You may appeal a decision we make on your request by replying to our response.

Transactional emails are part of the Service and cannot be turned off while you have an account. Marketing email, if we ever send it, will include an unsubscribe link.

Essential cookies keep you signed in and remember your campus; they are always on. Analytics cookies are optional: when you first visit we ask you to Accept or Decline, and we store that choice for six months in a cookie shared by udrop.co and app.udrop.co.

If you accept, we use PostHog and Google Analytics (loaded through Google Tag Manager) to understand how the Service is used, with IP anonymization and without listing text, messages or ID data, and we may use advertising pixels from Google, Meta (Facebook and Instagram) and TikTok to measure whether our ads led to a sign-up or a sale and to show UDrop ads to people who have visited. If you decline, none of those tools load and nothing is sent to them. You can change your choice at any time from “Cookie settings” in the footer or on your Profile.

All traffic is encrypted in transit. Data is stored with access controls that limit each user to their own records; secrets such as payment and AI provider keys are held in an encrypted vault and never sent to browsers. Student ID photos, when stored, live in a private bucket accessible only to you and UDrop administrators. No system is perfectly secure; if we learn of a breach affecting your information we will notify you as the law requires.

The Service is for adults aged 18 and over, or the age of majority where you live. We do not knowingly collect information from anyone under 18 and will delete it if we learn we have.

We will post changes here and update the effective date. For material changes we will notify you through the Service or by email before they take effect.

UDrop, LLC
[Mailing address]
support@udrop.co