Privacy Policy

MightDrop is run by Suddenly Dawn, LLC ("we," "us"). This page covers what we collect when you use mightdrop.com, why we collect it, who else touches it, and how to get it deleted. We wrote it to be read, so if something here doesn't make sense, email hello@mightdrop.com and we'll explain it (and probably fix the wording).

What we collect

Your email address. We need it to send you price-drop emails and sign-in links. When you track your first item, we email you a code to prove the address is yours.

What you watch. The product links you paste, the products and prices we pull from the store, the alert price you pick, any notes you add to an item, and, for Costco, the warehouses you choose.

A password, if you set one. Passwords are optional. If you set one, we store a one-way hash of it and never the password itself.

Your location, only if you ask us to use it. On the warehouse step there's a button to find stores near you. If you use it, your browser asks for permission and sends us your coordinates. We turn them into the nearest ZIP code to search warehouses and don't save the coordinates. The ZIP code ends up in the page address, so it can show up in our analytics like any other page you visit.

Push notification details, if you turn them on. When you allow notifications, your browser gives us an address to send them to and the keys to encrypt them, and we store those with your browser's user agent so you can tell your devices apart. Turn notifications off in your browser settings at any time.

Technical details. When you create an item, verify your email, or sign up, we record your IP address and browser user agent. We use them to stop abuse, like one person creating thousands of items or hammering the email-code form.

Analytics. We run our own analytics on our own servers. It records visits and the pages and buttons you use, along with your IP address, browser, operating system, device type, the site that sent you to us, any campaign tags in the link, and an approximate location (city, region, and country). We work out that location from your IP address using a MaxMind database that lives on our servers, so your IP isn't sent anywhere to do it. If you're signed in, those visits and some actions (like confirming or deleting an item) are tied to your account.

Billing details, if you buy a paid plan. Stripe handles checkout. Your card number goes to Stripe and never touches our servers. We keep the Stripe customer ID, which plan you're on, and its status and renewal dates.

How we use it

To check the prices you asked us to check, send the emails you asked for, keep you signed in, keep the site working and free of bots, figure out what's working and what isn't, and answer you when you email us. If you're on a paid plan, also to bill you for it.

We don't sell your data. We don't share it with advertisers, and there are no ad trackers on the site. We don't email you marketing you didn't ask for.

How price checks work

When we check a price, the request goes from our servers to the store, sometimes through a proxy provider. The store sees a request for a product (and a warehouse, for Costco). It doesn't see your email, your IP address, or anything else about you.

Who else handles your data

A few companies help us run MightDrop. Each one gets only what it needs to do its job.

• Postmark sends our emails, so it gets your email address and the contents of the emails we send you.
• Cloudflare Turnstile runs the "are you a person" check on some forms. It gets your IP address and some details about your browser to make that call. Cloudflare's own privacy policy covers what it does with them.
• Stripe processes payments for paid plans. It gets your payment details, your email address, and whatever else you enter at checkout.
• Sentry collects error reports when something breaks. A report can include the page you were on, your IP address, your browser, and your account's email address if you're signed in.
• Your browser's push service (Apple, Google, or Mozilla, depending on your browser) delivers push notifications if you turn them on. It carries the encrypted notification to your device.
• Google Fonts serves the fonts on this site, so your browser asks Google for them and Google sees your IP address.
• Our hosting provider runs the servers and database where all of this is stored.

We'll also share information if the law requires it, to protect people or the service from harm or fraud, or as part of a sale or merger of the business (in which case this policy still applies to your data unless you're told otherwise).

Cookies

We use cookies to keep you signed in (the "remember me" cookie lasts 30 days), to protect forms from forgery, and to tell one visit from another in our analytics. Cloudflare Turnstile may set its own cookies when it runs. We don't use advertising cookies.

How long we keep it

We keep your account and items until you delete them or ask us to. When you stop watching an item, whether from My items or the link in a price-drop email, we delete it along with its alert settings.

If you ask us to delete your account, we delete your account, your items, your push notification details, and the actions tied to your account. Analytics visits and anti-abuse records (things like IP addresses on blocked requests) can stick around after that. Stripe keeps its own payment records as the law requires.

If you start tracking an item and never finish confirming your email, we keep what you entered (including the email address) so you can pick up where you left off. Email us and we'll delete it.

Your choices

You can see and edit your items and alert prices from My items, and change your email or password from your account page. To get a copy of your data, correct something you can't change yourself, or delete your account, email hello@mightdrop.com from the address on your account. We'll handle it within 30 days, and usually much faster.

Depending on where you live (California and the EU, for example), you may have extra legal rights over your data, like the right to know what we have, to have it deleted, or to object to how we use it. Email us to use any of them. We won't treat you differently for doing it. We don't sell or share personal information as California law defines those terms.

You can block cookies in your browser. You'll get signed out, but the site will still work.

Security

The whole site runs over HTTPS, passwords are hashed, and sign-in links expire after 30 minutes. No system is perfectly secure, though, and we can't promise yours will never be exposed. If we find out your data was compromised, we'll tell you.

Kids

MightDrop isn't for anyone under 13, and we don't knowingly collect data from them. If you think a kid under 13 signed up, email us and we'll delete the account.

Where your data lives

MightDrop is run from the United States and your data is stored there. If you use it from somewhere else, your data is moved to the US to be processed.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change makes a real difference to how we use your data, we'll email you before it takes effect.

Contact

Questions, requests, or complaints go to hello@mightdrop.com.

Suddenly Dawn, LLC