Privacy Notice.

Last updated: October 19, 2026

BODE GAME STUDIOS LLC operates Fair Drop. This notice covers our website, business accounts, tests and support. Questions? support@shopfairdrop.com.

Information we use

• Accounts: name, email, password hash for password accounts, sign-in provider ID, verification status and signup agreement records.
• Business: the store, contact and address details you choose to save, plan choice, workspace and API-key records. Business profile fields are optional for exploring the app.
• Security: sessions, IP addresses, browser information, sign-in events and verification methods. We do not ask for your Google password.
• Support: requests, replies and the information you include in email. Do not send passwords, keys, full payment details or shopper addresses.
• Billing: payment-provider and subscription references, checkout terms accepted, acceptance time, and cancellation status. Paid plans are not open yet. Stripe handles card entry when billing is available; Fair Drop does not store full card numbers.

How we use it

We use information to run accounts, provide checks and support, send account emails, manage billing, prevent abuse and meet legal obligations. We do not sell personal information, add advertising profiles or send shopper records to an AI model for detection decisions. Household and known-bot matching stays within the retailer’s workspace; we do not run a shared shopper blacklist.

Google sign-in

Google supplies your account identifier, name, email and verification status. We use these to create or access your account. Sign-in does not request Gmail, Drive, contacts or calendar access. We do not retain Google access or refresh tokens. Google handles its service under its own privacy policy.

Support email and tickets

Cloudflare routes support email to our Google support inbox. Replies to a ticket’s private reply address can also appear in that ticket after checks. The app stores a plain-text excerpt of up to 4,000 characters, message fingerprints and timing information. It does not import attachments or email HTML. The full email and any attachments may remain in the support mailbox. Keep ticket reply addresses private.

Providers and sharing

Providers include Render for the app and database, OpenAI Sites for the public website, Cloudflare for web delivery, security and email routing, Resend for account and support email delivery, Google for the support mailbox and optional sign-in, and Stripe for billing when enabled. Authorized staff and providers access information as needed for their work. Processing may take place outside your country.

We may disclose information when legally required, to protect rights and security, or during a business transfer with appropriate safeguards. Approved retailer integrations need separate data-processing terms, including any required international-transfer safeguards.

Cookies and browser storage

We use storage for sign-in, security and actions you request, such as keeping a plan choice while signing in. The app does not add advertising or audience-tracking scripts. Read our Cookie Notice for details and controls.

Retailer data and tests

Test shoppers are generated data. For approved integrations, retailers may send protected household or payment identifiers and available account, purchase, browser, device and connection signals. Protected identifiers can still be personal data. Retailers must collect and share data lawfully, explain the checks and provide a way to review mistakes. No raw card numbers, security codes, passwords, bank details, identity documents, health information, biometric identifiers or precise location should be sent. Do not use the pilot for child-directed stores or known children’s data without a separate approved review. Live shopper scope and retention must be agreed before activation.

Shopify development pilot

The current Shopify connection is limited to approved development stores. Shopify sends signed order notifications. We keep store and product identifiers, order references, quantities, review reasons, and keyed matching identifiers made from shipping addresses and customer IDs. Raw shipping addresses are discarded after matching. Different apartments are treated separately when that information is present. These identifiers can still be personal data.

Order reviews happen after purchase; they do not automatically cancel, refund or fulfill an order. Cart quantity limits are a separate Shopify checkout rule. Order review records expire after 90 days, delivery fingerprints after seven days, and privacy-request tombstones after 90 days. Shopify customer redaction and store-uninstall controls follow the pilot’s supported privacy workflow. Shopify handles its own records under its terms.

Retention and security

App support tickets and their linked replies are scheduled for removal 180 days after the original request was created. Mail queue records expire within seven days or sooner; delivered message bodies are cleared from that queue. Copies in Google, Resend, provider logs and backups follow separate retention and deletion processes. We do not promise that deleting an app ticket instantly removes every copy.

We retain account and business records while needed to provide and secure the service, subject to legal and dispute requirements. Account closure and deletion are handled through support. We use access controls and encrypted connections, but cannot guarantee absolute security.

Ask for your data or deletion

Email support@shopfairdrop.com to ask for a copy, correction, account closure or deletion. You can also use the links in Account → Security. You do not need a paid plan or access to your account to contact us.

Tell us the account email and what you want us to do. Do not send passwords, verification codes, identity documents or card numbers. We will verify the request using information appropriate to the risk before releasing data or deleting an account. An email alone does not authorize deletion.

We will explain any records we must keep for legal obligations, security or disputes and respond within the period required by applicable law. Depending on your location, you may have rights to object, restrict processing, receive a portable copy or complain to a data-protection authority. Contact the retailer first about a purchase decision or its shopper records.

Adults and changes

Fair Drop accounts are for people aged 18 or over acting for shops and businesses. We do not offer accounts for children. If you believe a child’s information was submitted, contact us so we can investigate and take appropriate action. Retailers must review children’s privacy obligations before sending shopper data.

We will publish a dated notice when practices change and give notice or seek consent where required. Read the previous notice.

Version 2026-10-19.