Privacy Policy

Last updated: October 2, 2026

ServerDrop ("we", "us", or "our") is a Discord server discovery service. This Privacy Policy describes how we collect, use, and share your information when you use ServerDrop.

Information we collect

When you sign in with Discord, we collect your Discord user ID, username, email address, and avatar URL via Discord OAuth. We use this to authenticate your account and display your profile. When you open the submit flow, we also read your Discord server list so we can show you the servers you manage; we check it live and don't store the list.

When you submit a Discord server, we collect the server's metadata (name, description, member count, icon, banner) from Discord's public invite API. We store this so users can browse and discover the server through ServerDrop.

We log your swipes (server, direction, timestamp) and your tag preferences to run your feed: they decide which servers you've already seen and which categories you want.

If you claim a profile handle, we store the profile content you add (bio, links, cosmetic choices) and the activity tied to your account: your Drops and XP history, who you follow, your notifications, and your quest and giveaway records.

If you upload profile media (backgrounds, audio, fonts), the files are stored on Cloudflare R2. Every upload passes an automated safety check before it's published: images and video are scanned, the characters of an uploaded font are drawn and scanned, and a song is transcribed so its words can be checked.

Before paid promotion opened, some people joined a waitlist to hear when it launched. For each signup we kept the email address that was typed in, the IP address and the browser's user agent: the email to tell that person when promotion opened, the other two to spot the form being abused. The waitlist is closed and takes no new signups.

For giveaway entries and signed-out profile views we store a salted one-way hash of your IP address to limit duplicates. We never store the raw IP, and the hash can't be turned back into one.

Public profiles show a view count. For signed-in viewers a view is keyed to the account so repeat visits don't inflate the number; for signed-out viewers we use the daily IP hash above. Only the total is ever shown: nobody can see who viewed a profile, yours included.

When something on the site breaks, your browser or our servers send us an error report: the error's message, the page it happened on (as its general route, never with a name, an ID or the rest of the address) and a few lines of the code that failed. Anything that looks like personal data, such as an email address, an ID, a token or an IP address, is removed before the report is stored, and a report is kept for at most 30 days after that error last happened.

To count how many people use the site, your browser keeps two dates in its own storage, the day it first visited and the day it last visited, and tells us once a day. We add one to that day's counts; nothing that identifies you or your browser is sent or stored. When you're signed in, we also note which days your account used the site, to count active accounts. Those notes are deleted with your account and after 60 days.

A small sample of page loads also reports how fast the page drew and responded: the page's general route and three timings, with nothing about who loaded it. They are kept for 35 days.

When you use the ServerDrop bot in Discord, we log which command, button or form was used, whether it worked, how long the answer took and which server it was in. Your Discord ID and the server's are kept only as salted one-way hashes, used to count how many different people and servers use the bot; if your Discord account is linked to ServerDrop, the log also notes your ServerDrop account. This log is never shared with an analytics company and is deleted after 90 days.

How we use your information

We use your information to operate ServerDrop, run your server discovery feed, communicate with you about the service, and analyze aggregate usage to improve the product.

We do not sell your personal information to third parties.

AI processing

Some features send content to third-party AI providers. Smart search sends your query to Anthropic (Claude) for ranking and to OpenAI to build a search embedding. Listing text (server names and descriptions) is processed the same way, for tagging and for matching a search to a server. Uploaded images and video are scanned by Anthropic's vision models before they're published, as part of the moderation step above. A song you upload is transcribed by OpenAI and its words are checked by Anthropic; we keep the result of the check, not the words.

If you ask for a style suggestion on your profile, the phrase you type is sent to Anthropic to pick colors and fonts from our own preset lists. We don't store the phrase and it never appears on your profile.

These requests carry only the content needed to produce the result, never your email or credentials, and are subject to each provider's privacy policy.

Spotify

Showing what you're listening to is off unless you turn it on in your profile editor. Turning it on asks Spotify for one permission, to read the track you're playing, and we store the refresh token that grants it. It's kept server-side, is never readable by other users, and is deleted with your account. While it's on, your profile reads the track when someone views it and keeps it in memory for about 20 seconds; the track is never written to our database. Turn it off and your profile stops asking Spotify at once. If you paste a Spotify link on a profile or server page, we store only the link's type and id, not your listening data.

Sharing

Your username and any servers you submit are publicly visible to other ServerDrop users. Your swipe history is private: only you can see which servers you swiped on. Server owners see aggregate swipe counts for their listings, never who swiped. Profile view counts work the same way: pages show a total, never the viewers.

Data retention

We retain your account data while your account is active. You can permanently delete your account at any time from your Account page - deletion is immediate and removes your profile, swipe history, submitted servers, reports, and tag preferences. If you need help, reach out via our Discord (linked below).

Third parties

We use Supabase for authentication and data storage, Vercel for hosting and anonymous usage analytics, Discord's public API for server enrichment, Cloudflare R2 for uploaded media storage, Anthropic and OpenAI for the AI processing described above, and Spotify if you connect it.

We also use a Reddit pixel to measure sign-ups coming from Reddit ads. The Reddit pixel does not load for visitors in the European Economic Area, the United Kingdom or Switzerland. If we measure Google Ads, that tag follows the same rule and does not load for those visitors either. If we use PostHog to see which pages and buttons people use, it follows the same rule, knows a signed-in person only by their ServerDrop account ID (never a name, email or Discord ID), and any session recording hides everything typed and all text on the page.

Each of these companies has its own privacy policy.

Cookies and ads

ServerDrop sets a few cookies of its own so the site works: your sign-in session, your interface language, whether the sidebar is folded, where to return after you sign in, and a one-time security check while you connect Spotify. Two more remember the link that first brought you here and the latest one (its tags, the name of the site that sent you, and an ad's click ID if you came from an ad) for 30 days, so we can tell which links and ads bring people who sign up or list a server. When nothing brought you here (no link tags and no site that sent you), another remembers only the address of the first page you opened, for 30 days, so we can see where people start. If you arrive through someone's referral or profile link, their referral code is kept for 30 days. None of these is shared with advertisers. Your browser also keeps a few things in its own storage, such as swipes you made before signing in and which one-time steps have already been counted.

When we run Google Ads, Google's tag measures whether an ad led to a sign-up, a first swipe, a first join or a listed server. It sets Google's own cookies (such as _gcl_au and _gcl_aw) to connect an ad click to that step, sends no page views, is told through Google's consent settings never to personalize ads, and never receives your name, email address or account. It does not load at all for visitors in the European Economic Area, the United Kingdom or Switzerland, or in a browser that sends Do Not Track or Global Privacy Control, and the Reddit pixel and PostHog follow the same rules. You can manage Google's ad settings at adssettings.google.com, and read how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites.

Changes

We may update this Privacy Policy from time to time. The "Last updated" date above will reflect the most recent update.

Contact

Questions? Email us at serverdropapp@gmail.com or join our Discord at discord.gg/serverdrop.