1. Scope
This policy describes DROP YOR ART’s browser tools, private account services, public creator profiles and public gallery listings when those features are enabled. It distinguishes data kept on your device, private cloud data, and the limited metadata you explicitly choose to publish. It does not describe a live payment marketplace: bookings, payment processing, payouts and checkout are not connected.
2. Identity and onboarding information
For account access, the app receives an identity identifier, email address, trusted email-verification status and a name when supplied by the account provider. Google sign-in requests only basic identity scopes: openid, email and profile. It does not request Gmail messages, contacts, calendars or Drive files. Passwords are handled by the identity provider, not stored in DYA project records.
Required onboarding records an 18-or-older confirmation, the accepted Terms version, the acknowledged Privacy Policy version and the time of acceptance. It does not ask for a date of birth or identity document. An expiring onboarding ticket does not activate a DYA account. The upstream identity service may have its own identity record before DYA onboarding finishes.
3. Browser-local work
Drafts, preferences, saved previews and local profile details use browser storage. Original files added to Creator Studio or creative labs can be kept in IndexedDB on that device. Selecting a file or recording locally does not by itself publish it. Local data can be lost when site data is cleared, storage is unavailable or the browser profile changes. Clearing a local copy does not delete an independently saved cloud project.
4. Private cloud projects and media
When you request an account save, the app uploads the relevant project details, original media and editor previews to private AWS storage. Subsequent edits can automatically save after you explicitly save or open a connected account project; check the workspace’s save status. Project information is stored in DynamoDB and media in private, encrypted, versioned S3 storage. Account ownership checks control reads and writes. Downloads use short-lived links; do not share these links with others.
Data you choose to save may include artwork, photos, audio recordings, writing, project titles and service-brief information such as a budget, location or reference. Only provide what you need for your project. Current private uploads are not malware-scanned or certified safe for public distribution.
5. Public creator profiles and gallery listings
Saving, cloud autosave and Proof of Creation do not publish anything. To publish, you must make a rights declaration, prepare one exact saved project version and choose the separate publish action. A published record can show the project title, category, public creator name, optional public description, date, and an optional link to a Proof of Creation verifier. The app does not publish private project JSON, private S3 originals, original file names, email addresses, account identifiers, sessions or private media URLs through this flow.
Public media previews are not currently part of the publishing flow. Archive, moderation or a valid report can remove a public listing while preserving the private project and required safety or audit records. Do not place personal, confidential or third-party information in a public title or description.
6. Proof of Creation and public verification
Proof of Creation is a DROP YOR ART platform record, not an official copyright registration. A public verifier shows only minimized record metadata: certificate status, work type, saved and record version, recording date and an abbreviated integrity marker. It does not reveal creator identity, project title, private file name, file type, file size, full SHA-256 value, private media or storage information. The full certificate PDF is available only to the issuing signed-in account.
7. Reports, blocks, cookies and service providers
If you report content or copyright, the app stores the report details, target public-record version, status and review notes in a private moderation system. If you block a creator, that preference is private to your account. Server-authorized reviewers use those records to review reports; ordinary users cannot see another person’s reports or block list. Necessary cookies support sign-in, temporary onboarding, session validation and security.
Hosting and identity providers may process technical connection data, request metadata and operational logs to run and protect the service. Relevant service providers include AWS for hosting, identity and storage; Google when you choose Google sign-in; and ElevenLabs when you request voice playback. They may process information in countries other than yours. The app’s current AWS infrastructure is in the United States. Information may also be handled as required by law or to investigate abuse and protect users.
8. Microphone, camera and Merry
The browser asks for camera or microphone permission when a feature requires it. Local recordings become cloud files only if you request the relevant account save. Permission can be withdrawn in your browser or device settings.
When you ask Merry to speak, the narration text is sent through DYA’s server to ElevenLabs, which generates the authorized voice audio. This does not send your microphone recording to a voice-cloning service. Provider processing is subject to ElevenLabs’ own practices. Merry is not an always-listening assistant, and no alternate voice is substituted automatically.
9. Retention and deletion
Temporary onboarding and session access expires according to server checks. Expiry of access is not a promise that physical database cleanup occurs at that exact moment. Private projects and versioned originals remain stored until removed through an implemented deletion process or a verified support request, subject to backup, security and legal-retention needs. Published listing history, Proof of Creation and moderation records may be retained where necessary for integrity, safety, disputes or legal obligations. Self-service account deletion and automated orphan-file cleanup are not yet complete.
Contact support to request access, correction, export or deletion. We may need to verify ownership before acting so another person cannot erase your work. Backup copies, service-provider records and legally required records may have different retention periods. We will explain applicable limitations rather than promise deletion that has not happened.
10. Adults, choices and questions
DYA accounts are intended for people 18 or older. If you believe a child has supplied personal information, contact support. You can use available local tools without activating an account, decline optional device permissions, stop requested voice playback, sign out, archive a published listing, or request deletion. Privacy rights can vary by location; contact us about a request or concern.
Policy changes will be identified with a new version. Review the current version before saving sensitive material or publishing work. No internet service can guarantee absolute security; keep independent copies of important work and report suspected unauthorized access promptly.