Privacy Policy

Creator addresses

A creator's delivery address is encrypted, and it is never included in any page or response a fan can see. It is decrypted only to ship a specific order, and every time that happens we record who looked and why.

The honest limit of that promise: to deliver a parcel, the address has to reach the shop we buy from and the carrier who brings it. They receive the delivery details for that one order and nothing else. What we guarantee is that the fan who paid never sees it, and that it never appears on a public page.

What we collect

From a creator: an email address, an optional display name, bio and photos for the wishlist page, and a delivery address once they want to receive items. Signing in with Google gives us the name and email your Google account shares, and nothing more.

From a fan: an email address for the receipt, and a display name and message if you choose to add them. As a guest, that is all we ask for.

At checkout we also record the IP address and browser information the request came from. This is kept to answer card disputes and chargebacks, where a payment network expects that kind of evidence, and is not used for anything else.

We do not store card numbers. Card details go directly to Stripe, our payment processor, without passing through our systems.

Anonymous and secret gifts

Sending a gift anonymously or secretly hides it from a creator's public page, and also leaves it out of their supporter totals and rankings. Hiding the name while still counting the money can identify somebody by arithmetic, so we do neither.

Email and cookies

We send receipts, shipping updates, and account or security notices, because those are part of the service you asked for. We send marketing email only to people who have separately opted in.

We set cookies only to sign you in and keep that sign-in secure. Browsing signed out sets none. We run no analytics, advertising, or tracking of any kind, so there is nothing here to opt out of.

Security and sharing

Passwords are stored hashed, never in plain text. Two factor authentication is available on any account, and you can see and revoke your active sessions at any time.

We share only what is needed to run the service: Stripe processes payments and payouts, our hosting and storage providers hold the data described above, and our email provider delivers the messages described here. We do not sell your data, and we do not share it for anyone else's advertising.

Your data, and contact

Write to us and we will tell you what we hold about you, correct it, or remove what we are not required to keep. We keep records while your account is open, and afterwards for as long as we need them to meet tax, accounting, and payment dispute obligations.

WrenDrops is operated by the WrenDrops team in the United States. Privacy questions and data requests go to privacy@wrendrops.com.

We may update this policy as WrenDrops changes, and we will change the date at the top of this page when we do.