droppın
Discord Open the map

Legal

Privacy Policy

Last updated 16 October 2026

DRAFT. This policy is waiting for a legal review and may change before launch.
The short version. If you are 13 or over, the map needs a free account: we keep your email, a username and a scrambled password, plus anything you choose to link (like Discord). We only send news emails if you tick a box and then confirm your email, and every one has a one-click unsubscribe. Droppin is for players 13 and up. When you ask for a route we keep a short record of the request for 30 days, to keep things fair and stop misuse. We don't sell personal information, run ads or use trackers.

1. Who is responsible

Summit Esports LLC, doing business as Droppin ("we", "us"), runs Droppin. Contact: legal@wherewedroppin.com.

2. What we collect, and why

  • The age question. On your first visit we ask for your birth month and year. Only the result (13 or over, or not) and the date we asked are kept, on your device, and with your account if you make one. The month and year themselves are never sent anywhere.
  • Your account (13 and over): your email address, a username, your password (stored only as a one-way scrambled hash, so nobody can read it), when you signed up and last signed in, and which version of the Terms you agreed to. We use these to sign you in, run your account and send the account emails you ask for.
  • Your email choices: whether you want (a) app updates and new-season announcements and (b) promotions and special offers. Each time you make or change a choice we record your email address, the choice, the exact wording you saw, the time, the app version and the version of this policy, so we can show what you agreed to.
  • Your Spot Lab spots: the spots you build in Spot Lab (where they are, what you land on, the drop points you mark, such as a door, window, roof or ledge, and the names you give them) are saved with your account so you have them on every device. If you share them, anyone with the share code can see a copy of those spots and your username; you can turn a code off at any time.
  • The Spot Lab gallery: if you publish a spot, every Droppin player can see it with your username, look at it on the map and copy it, and we count how many players copied it. If you report a gallery spot, we keep your report (the reason, any note you write, your username and when) so we can look into it; the spot's maker is not told who reported it. Names have to pass a word check before they can be published or shared.
  • Two-step sign-in, if you turn it on: the secret key your authenticator app uses (stored encrypted), when you turned it on, and your backup codes, stored only as one-way keyed hashes so nobody can read them. The codes your app shows are checked and never stored.
  • When we help with your account: if you ask us for help and we act on your account (for example, sending a password reset link, changing your email after checking it is you, signing you out on every device or turning off two-step sign-in), we keep a note of what was done, which of our team did it and when. These notes are included when you download your data.
  • From Discord, if you sign in with or link Discord: your Discord user ID, username, display name, avatar and the email address on your Discord account, through the identify and email permissions and nothing else. We use them to sign you in and show your name. We never post, message or act on your behalf.
  • From Epic Games, if you choose to link your Epic account: your Epic account ID and display name, through the basic_profile permission and nothing else. We use them only to show your Epic name on the map. They are kept in a signed cookie on your own device for up to 30 days, not on our servers. Epic's sign-in token is used once to read them and then discarded. We never see your Epic password, email or friends.
  • Drop requests (accounts only): if you request a drop, we receive the map point, the spot name and note you type, what it is near, your username and, if you linked Discord, your Discord name. It is posted to a private channel in our Discord so we can plot it; we do not keep it on our own server. To stop spam, each account can send only a few requests an hour.
  • Route requests (accounts only): the routes, spot details and Zones predictions are worked out on our route server, not in your browser. For each request we keep your account, what you asked for (a route, a spot or Zones) and when, a device code (see below) and a scrambled code made from your IP address (a keyed hash, which cannot be turned back into the address; the address itself is never kept). We keep these for 30 days to count the free trial fairly, to limit how quickly routes can be asked for, and to spot an account shared by many people or a program copying routes. If an account or device asks in a way that looks automated or shared, routes can be paused for it for a while. The spot, bus and circles you ask about are sent to the route server to be worked out; it keeps answers for a short time so the same route comes back faster, without your name or email.
  • Pro Unlock (when it launches): Stripe processes payments and holds your card details; we never see your card number. We give Stripe your email address and username, and we keep your Stripe customer number, your plan (monthly or yearly), whether it is active, cancelled or has a failed payment, the date it is paid up to, and a short billing history (such as "paid $7.99" with the receipt number) to run your subscription and help you with it. Stripe sends your receipts. On the free trial we count how many free routes and Zones uses you have used.
  • Stored in your browser, not on our servers: your map settings, favourites and timer, the age question's result, a cookie that keeps you signed in, a small cookie that tells our pages you are signed in, a random device code (a cookie set when you sign in, used only with route requests as above; it lasts up to two years, and we keep only a scrambled copy of it).
  • Emails you send us: whatever you include, to answer you.
  • Server logs: our host, DreamHost, keeps standard web-server logs (IP address, browser type, pages requested, time) for security and operation. Our own records never store your IP address itself; route requests keep only the scrambled code described above.

We do not use advertising, analytics trackers, tracking cookies or fingerprinting. The device code and the scrambled IP code are used only for the security and fairness purposes above.

3. Emails

  • Account emails (the confirm link, password resets, security notices when two-step sign-in is turned on or off or your email is changed, and messages about your spots in the gallery, such as one being hidden) are sent only when needed and never contain news or offers. If your email is changed, the notice goes to the old address too.
  • News emails come in two separate lists: updates and new-season announcements, and promotions and special offers. Both are off unless you tick them, and nothing is sent until you click the link in the confirmation email we send you.
  • Every news email has a one-click unsubscribe that works without signing in and takes effect straight away. Stopping one list does not stop the other. You can change both at any time on your account page.
  • Every news email shows who it is from and our mailing address.

4. Children under 13

Droppin is for players 13 and up. We do not knowingly collect personal information from children under 13. The site asks every visitor's age before anything else. If the answer is under 13, it says Droppin is for 13 and up and goes no further: no account, no map, nothing to type in. If we learn that we have collected personal information from a child under 13, we delete it. Parents and guardians can contact us at legal@wherewedroppin.com.

5. Services that handle data for us

DreamHost hosts the site and our account database. Our email service receives your email address and the message so it can deliver our emails. Discord and Epic Games are involved only if you sign in with or link them. Our route server (a server we rent to run the route maths) receives the spot, bus and Zones circles you ask about, never your name or email. Pages also load Google Fonts (the typefaces) and fortnite-api.com (the current location names), each of which receives your IP address and browser details when your browser contacts it, and, when Pro launches, Stripe (checkout). Their own privacy policies apply to what they receive.

6. Sharing

We do not sell or share your personal information for money or for cross-context behavioural advertising. We disclose information only to the service providers above to run the site, when the law requires it, to protect our rights or users' safety, or as part of transferring the business.

7. How long we keep it

  • Your account stays until you delete it. Accounts nobody has signed in to for 24 months are deleted automatically.
  • Deleting your account removes your account, your Spot Lab spots, share codes, gallery spots and reports, your email choices and their records, your two-step settings and backup codes, and our notes of any help with your account. We keep only a scrambled code made from your email address (a keyed hash, which cannot be turned back into the address) so we never email you again.
  • Route request records, with their device and IP codes, are kept for 30 days; notes about unusual use (for example, one account on many devices) for up to 90 days. Deleting your account removes them too. They are included when you download your data.
  • Sign-ins last 60 days from your last visit. Confirm links work for 48 hours and password reset links for 1 hour.
  • The Epic account cookie lasts 30 days or until you press Unlink. Deleting your account cancels any Pro Unlock subscription; Stripe keeps its own payment records as long as tax and accounting law requires. Host logs follow DreamHost's retention.

8. Your choices and rights

  • On your account page you can change your email choices, change your email, username and password, turn on two-step sign-in, sign out of all devices, download your data (as a JSON file) and delete your account and data.
  • Ask us to access, correct or delete anything we hold about you by emailing legal@wherewedroppin.com. We will not treat you differently for asking.
  • If you live in California or another place with privacy laws that give you further rights, those rights apply, and the same address is how to use them.

9. Security

The site is served over HTTPS. Passwords are stored only as one-way hashes, sign-in attempts are limited, you can turn on two-step sign-in so a password alone is not enough, and sign-in links and cookies are random and expire. We keep email addresses out of our logs and hold as little as we can. No system is perfectly secure: sign out on shared computers.

10. International visitors

Droppin is run from the United States and information is processed there.

11. Changes

If we change this policy we will post it here with a new date, and for material changes give notice on the site (and by email to account holders) before they apply.