Privacy Policy
Last updated: September 2026
KudosDrop is a no-account collaborative greeting card and gift-pooling platform designed with privacy as a foundational principle. We believe celebrating colleagues, friends, and loved ones should never require creating tracking accounts, remembering passwords, or trading personal data.
Our Privacy Commitments
No user accounts or cross-site profiling
We do not create persistent user profiles, sell advertising, or track your browsing activity across other websites.
Capability-based authorization
Access to greeting cards is controlled through private links and organizer PINs hashed with PBKDF2-SHA256 (100,000 iterations).
Strict data minimization
We only request the minimal personal details necessary to deliver greeting cards and process voluntary gift contributions.
Personal Data We Process
- ✓ Organizer and Recipient Email: Used exclusively to deliver receipt confirmations, PIN recovery links, and scheduled card deliveries. We never send unsolicited marketing emails.
- ✓ Card Messages and Media: Greetings, notes, photos, and animated GIFs submitted to collaborative boards. Messages are visible only to people possessing the card link.
- ✓ Payment Information: Contributions to group gift pots and card fees are processed directly by Stripe. KudosDrop never sees, stores, or transmits full credit card numbers.
- ✓ Technical & Security Telemetry: IP addresses and browser headers are processed by Cloudflare Turnstile solely to mitigate DDoS attacks and spam, and are not retained for profiling.
Subprocessors & Service Providers
We partner with industry-leading infrastructure and payment processors under strict Data Processing Agreements (DPAs):
Stripe
Stripe Payments Europe: Payment gateway for credit cards, Apple Pay, and Google Pay.
Tremendous
Tremendous Inc: Global digital gift card catalog and payout distribution.
Cloudflare
Cloudflare Inc: CDN, edge proxy, Turnstile bot verification, and R2 media storage.
Google Cloud (EU)
Google Cloud Platform (GCP): Cloud Run serverless API and Firestore database hosting in EU regions.
Resend
Resend Inc: Transactional email delivery for PIN recovery and card notifications.
Data Retention & Deletion
Card messages and media remain accessible to recipients via their private link. Organizers have the capability to archive or delete their card and all associated messages at any time. Local drafts saved on your device expire automatically after 7 days.
Your Rights Under GDPR (EU & UK)
Under European and UK data protection regulations, you retain full rights regarding your personal data:
Right of access to the information held about you.
Right to erasure ("Right to be forgotten") of your submitted messages or cards.
Right to rectify incorrect or incomplete details.
Right to object to or restrict processing.
Contact Us
For privacy inquiries, data subject access requests, or deletion requests, contact our privacy team at:
privacy@kudosdrop.com