Privacy Policy

This policy explains what information YesDrop collects when you use the service, how we use it, and the choices you have. By using YesDrop you agree to the practices described here.

Information we collect

We collect the account details you provide when you sign up (your name and email address), and the content of the approval requests you create, including approver email addresses, titles, messages, and any files you attach. We also record basic activity such as when a request is sent, viewed, or decided.

How we use it

We use your information to deliver approval requests by email, send reminders you schedule, show you the status of each request, and keep your account secure. We do not sell your personal information.

Email to approvers

When you send a request, we email the approver on your behalf so they can approve or reject it. Approvers do not need a YesDrop account and we only use their address to deliver that request and any reminders.

Google user data

YesDrop lets you sign in with Google and send approval requests from your own Gmail account. This section explains what Google user data we access, how we use and store it, and with whom we share, transfer, or disclose it.

What we access. When you sign in with Google or connect Gmail, Google shares your name, email address, and profile picture with us. With your permission, we also receive an authorization token for the Gmail send scope (gmail.send), which lets YesDrop send email from your Gmail account. This scope only allows sending. YesDrop cannot read, search, change, or delete the messages in your mailbox.

How we use it. We use your name and email address to create and secure your account, to show them to you in the app, and to identify you as the sender of your approval requests. We use the Gmail token only to send the approval requests and reminders that you create or schedule, from your Gmail address, to the approvers you choose. We keep the Gmail message and thread IDs of those emails so that reminders stay in the same conversation.

How we store and protect it. Your account details are stored in our database. The Gmail token is encrypted before it is stored and is decrypted only on our servers at the moment an email is sent. Data is encrypted in transit between your browser, our servers, and our providers.

With whom we share, transfer, or disclose it. We share Google user data only as needed to run YesDrop, and only with the following parties:

• Google, which delivers the emails you send through YesDrop using the Gmail API.
• Your approvers, who see your name and email address as the sender of each request you send them, along with the request content you write. Their replies go to your own inbox.
• Supabase, which hosts our database and sign-in service, and stores your account details and the encrypted Gmail token.
• Render, which hosts the YesDrop servers that process your data to send email.
• Vercel, which hosts the YesDrop website and app interface.
• Brevo, our email delivery provider, which receives your name and email address to send you account and status notification emails, and to deliver approval requests that are not sent through Gmail.

These providers receive Google user data only so they can provide their service to YesDrop. We may also disclose Google user data when the law requires it, when it is necessary to protect the security of YesDrop and its users (for example, to investigate abuse), or as part of a merger, acquisition, or sale of assets, and in that last case only after obtaining your explicit consent first. We do not share Google user data with anyone else.

What we never do. We do not sell Google user data. We do not use or transfer it for advertising, and we do not give it to data brokers or information resellers. We do not use Google user data, including data obtained through Google Workspace APIs, to develop, improve, or train generalized or non-personalized AI or machine learning models. The AI features in YesDrop receive only the text you type into them, never your Google user data. No person at YesDrop reads your Google user data unless you give us permission, it is necessary for security purposes, or the law requires it.

Retention and deletion.We keep your Google account details for as long as your YesDrop account exists. You can disconnect Gmail at any time in Settings, which deletes the stored Gmail token. You can also remove YesDrop's access from your Google Account permissions page. When your YesDrop account is deleted, your Google account details and the Gmail token are deleted with it.

Limited Use.YesDrop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data storage and security

Your data is stored with our infrastructure providers and protected with industry-standard safeguards, including encryption in transit. Access is limited to what is needed to run the service.

Your choices

You can update or delete your requests at any time, and you can request deletion of your account from your account settings. Some records may be retained where required for security or legal reasons.