Privacy policy

last updated october 30, 2026

Who we are

refDrop (refdrop.to) is run by REFERN LABS INC. This policy says what refDrop collects, why, where it is kept, and for how long. refDrop accounts are refern online accounts; the refern privacy policy covers refern itself.

We do not sell your data, and we do not use it for advertising.

What we collect

From artists (account holders):

Your email address, used to sign in with a code and to send you service emails.
Your username, and your public page if you make one: display name, picture, banner, bio, links, prices, terms, and example images.
Your boxes: titles, notes, tags, statuses, delivery dates, templates, and every file in them.
Invite codes, who invited you, and the kind of place your signup came from: an invite, a client page, a public page, a request, a search engine, or direct. We do not keep the address of the page that sent you.

From clients (no account needed):

The files and notes you add to a box, at full size, with their names, sizes, and upload times.
Your email address, only if you leave one on a box, a request, or a "Notify me" list.
Requests you send: your idea, budget, deadline, use, email, and reference images.
Reviews and answers to work-in-progress updates, with the display name you choose.

From everyone:

Page view counts for public pages. We count views per artist per day. We do not store your IP address, a cookie, or any visitor ID for these counts. To count a visitor once per 30 minutes, the server keeps a scrambled form of the address in memory only, and drops it when the 30 minutes end.
Technical logs that our hosting providers keep for security and to fix errors, which can include IP addresses. [Log retention periods, to be confirmed with each provider.]

How we use it

To run refDrop: store and show your boxes and files, make image previews, build zip downloads, and show your public page.
To send emails you need: sign-in codes, new files and deliveries, warnings before files are removed, request codes and replies, and the "commissions open" email you asked for.
To keep refDrop safe: limits on uploads and requests, bot checks, and reviewing reports of abuse.
To understand how people find refDrop, through signup sources and Google Analytics on marketing pages (see below).

Who can see your content

A box and its files can be seen by the artist and by anyone with the box link. Treat a box link like a password.
A public page and its examples can be seen by anyone. Adult examples show only after the visitor clicks through a notice.
Requests are seen only by the artist they were sent to.
A review shows on the artist's public page only after the artist approves it.

Where it is stored

We use these providers to run refDrop:

Cloudflare: file storage (R2), hosting of the online service, and Turnstile bot checks.
Supabase: sign-in and our PostgreSQL database.
Vercel: hosting of the refdrop.to website.
Resend: sending emails.
Google Analytics: visit statistics on marketing pages only.

Your data may be stored and processed in the United States and other countries where these providers run. [Data regions and transfer safeguards, to be confirmed before launch.]

How long we keep it

Open boxes keep their files until the box is closed.
A closed box keeps its original files for the hold period (now 3 months on the free plan). We email warnings 30 and 7 days before. The originals are then deleted, and the box becomes an archive that keeps small image previews and the names and sizes of other files. An archive stays until the artist deletes it.
A client's email on a box is kept for that box and can be removed from the box page at any time.
An unconfirmed request expires after a day, and an unanswered one after 30 days. Files of declined and expired requests are deleted 30 days after that.
A "Notify me" email is removed once the "commissions open" email is sent, or when you unsubscribe.
Account data is kept until you delete your account.

Cookies and browser storage

refDrop uses only these cookies. None of them track you across other websites.

Sign-in session cookies (sb-...): keep you signed in.
refdrop_dashboard: remembers your dashboard view and filters in this browser, for a year.
refdrop_checklist: remembers that you hid the setup checklist, for a year.
refdrop_join: remembers an invite code or the artist whose page sent you, until you sign in (at most 30 days).
refdrop_ref: remembers the website name that first sent you to refDrop, until you sign in (at most 30 days).
refdrop_visit: on a box link only, remembers that this visit passed the bot check, for an hour. It is the only cookie a box link sets.
refdrop_name: holds the display name you typed while picking your link, until you set up your page (at most 30 days).
refdrop_link: holds the link name you typed on an artist's page under "Get this link", to fill it in when you pick your link (at most 30 days).
refdrop_checkout: holds the paid plan you chose before signing in, so checkout opens with it after sign-in (at most an hour).

When you choose to see adult examples on a public page, that choice is kept in your browser's session storage and is gone when you close the tab.

Google Analytics sets its own cookies (_ga, _ga_...) on marketing pages only: the home page, pricing, help, and artists' public pages. It never runs on box links, sign-in, the app, unsubscribe pages, or these legal pages. Advertising features, ad personalization, and Google Signals are off.

Bot checks

Some forms use Cloudflare Turnstile to check that a person, not a bot, is using them. Turnstile works without tracking cookies and sends Cloudflare technical details about your browser.

Your choices and rights

You can see and change most of your data in the app.
You can delete a box's client email, an archive, or your public page content at any time.
To get a copy of your data, or to delete your account and all its data, write to us at [support email]. We answer within [response time, to be decided].
A client can ask the artist to delete a box or archive, or write to us.
Depending on where you live, you may have more rights, such as to correct your data or to object to how we use it. [Region-specific rights (GDPR, UK, California), to be completed with legal review.]

Children

refDrop is not for children. [Minimum age, to be decided.] If you believe a child has given us personal data, write to us and we will delete it.

Changes

We may change this policy. If a change matters, we will tell signed-up artists by email or in the app before it takes effect. The date at the top shows the latest version.

Contact

REFERN LABS INC. [Postal address, to be added.] Email: [support email].