Our approach to your data

Access & authentication

• Accounts use email/password sign-in provided by our managed auth backend.
• Sessions are tied to a signed token; signing out invalidates the session client-side.
• Only the signed-in account can view or edit its own releases, scheduled posts, smart links, and analytics.

Data we store

• Release metadata you enter (titles, links, artwork references).
• Generated promo copy, scheduled posts, and analytics events.
• Connected social account identifiers (handle and provider user ID) — never your social passwords.
• Uploaded audio and image assets, stored in private buckets and served via short-lived signed URLs.

Row-level security policies scope every record to the owning account. Service-role credentials are used only by trusted server functions and webhook handlers, never shipped to the browser.

Platform connections

When you connect TikTok, YouTube, or other platforms, DropKit Studio receives only the tokens needed to post on your behalf. You can disconnect any platform at any time from the Accounts page; we stop using the token immediately and remove the stored credentials.

Retention & deletion

You can delete releases, scheduled posts, and uploaded assets from the app at any time. Deleted records are removed from the active database; backups follow our hosting provider's standard retention windows.

Reporting a security issue

If you believe you have found a security vulnerability, please contact the DropKit Studio team so we can investigate and remediate. Include steps to reproduce and any relevant logs or screenshots.