Privacy policy

Who we are, and who is responsible

Rajesh Kumar (sole proprietor) operates Dripost. Under the Digital Personal Data Protection Act 2023 we are the Data Fiduciary for your account data, which means we decide why and how it is used and we answer for it.

For personal data inside the content you process through Dripost — a customer's name in a caption, a face in a video — you decide why and how, and we process it on your instructions. The data processing terms set that relationship out.

Address: Whitefield, Bengaluru – 560048, Karnataka, India. Email: rajesh411232@gmail.com. Phone: +91 85278 77979.

What we collect, why, and who else sees it

Everything in this table comes from you, or from a network you connected, or from the request your browser makes. There is no fourth source: we buy no data and we take none from data brokers.

What we do not collect

• No advertising or analytics trackers. There is no Google Analytics, no advertising pixel and no third-party script following you around this site.
• No advertising cookies.
• No sale of your data, and no sharing of it for anybody else's advertising. We do not, and will not.
• No IP address against your consent record. The law lets us keep one; we decided the country is enough.
• The free tools run entirely in your browser. What you type into them is never sent to us.

How the AI features work

When you ask Dripost to write, adapt or enhance a post, we send the text you wrote — and, where the feature works from a video, that video — to a model provider. The request goes through OpenRouter, which routes it to the model we have chosen: today Google's Gemini models, with DeepSeek as a fallback when Google is unavailable. The answer comes back and is shown to you. It is not used to train anything of ours.

We have not been able to secure a contractual opt-out from retention or training with those providers on the plan we are on. So we say it plainly rather than implying otherwise: treat the AI features as you would treat a supplier you have not signed an NDA with, and do not paste anything into them that you would not want a service provider to see.

AI output can be wrong, dated, or wrong for your audience. Nothing an AI feature produces is published on its own — you read it, edit it and schedule it. You are the author of what goes out.

Who else handles your data

These are every processor and sub-processor we use today. If we add one that handles personal data, we will update this list before it starts.

• Cloudflare — hosting, the database (D1), file storage (R2) and network protection. Data is stored on Cloudflare's network, which spans several countries.
• OpenRouter — routes an AI request to a model provider. Used only when you use an AI feature.
• Google (Gemini, through OpenRouter) — the primary model provider for AI features.
• DeepSeek (through OpenRouter) — the fallback model provider when the primary is unavailable.
• Resend — sends our email: login codes, sign-in alerts, approval requests and account notices.
• Razorpay — takes and manages subscription payments.
• Google and YouTube, Meta and Instagram, and X — the networks you choose to connect. Each receives what you publish and holds it under its own terms.

We use no advertising networks, no data brokers and no analytics vendors.

Where your data goes, outside India

Our hosting is Cloudflare's global network, so your data may be stored or processed outside India. AI requests go to model providers who operate outside India. Our email and payment providers may process outside India as well.

The DPDP Act permits transfers outside India except to a country the Central Government restricts; if such a restriction is notified and it affects a provider we use, we will change the provider or stop the transfer.

Cookies and what we keep in your browser

• A sign-in cookie, so you stay logged in. Without it you would log in again on every page.
• A short-lived cookie during a two-step sign-in, so the second step knows the first one succeeded. It is signed, cannot be read by any script, and dies in five minutes.
• A short-lived cookie recording that you ticked the agreement boxes, so the account we then create can be created with your consent on record. Thirty minutes, signed, and deleted once the account exists.
• A short-lived cookie while you connect a social account, which protects that connection from forgery.
• A cookie naming the workspace you are currently working in.
• In your browser's own storage, not ours: whether you chose light or dark, and whether you left the menu open or closed.

That is the whole list. There are no advertising or tracking cookies, so there is no consent banner to dismiss.

How long we keep things

We keep your account and its content while your account is open, because that is the service.

• Delete your account and we delete it then and there: your posts, your uploaded files, your connected-account tokens, your settings. It is not a queue and not a 30-day grace period.
• Emailed login codes die 10 minutes after they are issued, and are deleted the moment they are used.
• Links that let somebody review a post without an account expire after 7 days, and you can revoke one sooner.
• Links to your video and image files are signed and expire after 15 minutes. The file stays private; the link is what expires.
• Rate-limit counters last minutes, not longer.
• Payment and tax records are kept for as long as Indian tax and company law requires, which is longer than your account. They are financial records, not content.
• Your agreement to these policies is kept for as long as your account exists and for a reasonable period after, because it is the proof that consent was given.

Backups: Cloudflare's database keeps a short rolling history that lets us restore after a mistake or an incident. A deleted row can therefore survive in that history for a brief period before it ages out. We do not read backups except to recover the service.

Your rights, and how to use them

Under the DPDP Act you have the right to know what we hold about you and who we have shared it with, to have it corrected or completed, to have it erased, to nominate somebody to exercise your rights if you cannot, and to have a grievance answered.

• To see and download everything: Settings has an export. It hands you a JSON file with your profile, posts, versions, library, posting times and activity. Password data and connection tokens are deliberately left out of it.
• To correct something: change it in Settings, or write to us for anything you cannot reach.
• To erase everything: Settings, Delete account. It removes your posts and files and revokes every network connection at once. It refuses in two cases we cannot resolve for you — while other people are in your workspace, and while you have an active paid plan — and it tells you which. Or write to rajesh411232@gmail.com and we will do it.
• To disconnect one network without deleting anything else: Channels, Disconnect. We delete our copy of the token, and you can also remove Dripost's access at the network's own settings.
• To nominate somebody, or to ask anything the product cannot do: email rajesh411232@gmail.com from the address on your account.

We act on a verified request without undue delay, and in any case within 30 days. We may need to check that the request is really from you; we will not use that check to delay you.

Consent, and changing your mind

We ask for your agreement to this policy and to the Terms when you create an account, in two separate unticked boxes, and we record what you agreed to and when. Marketing email is a third, optional box, unticked, and we record your answer either way — including when it is no.

You can withdraw consent at any time. Withdrawing consent for the processing that runs the service means closing your account, because there is no version of Dripost that publishes your posts without processing them; Settings does that in one step. Withdrawing consent to marketing email is separate and costs you nothing — write to us and we will record it.

Withdrawing consent does not undo what was lawfully done before you withdrew it.

We send no marketing email today. The record exists so that if we ever do, it has a truthful answer to work from.

Children

Dripost is for people aged 18 and over. We ask you to confirm it when you create an account, and we do not knowingly collect data from anyone younger.

If you believe a child has an account here, write to rajesh411232@gmail.com and we will delete it.

How we protect your data

This is what is actually in place, not a wish list:

• Connected-account tokens are encrypted with AES-256-GCM before they are stored, and are never sent to your browser. There is an automated test whose whole job is to fail if one ever leaks into a response.
• Passwords, where set, are stored only as bcrypt hashes.
• Your uploaded files are private. They are reached only through signed links that expire in 15 minutes.
• Every request is checked against the account and workspace that owns the data, and there is a test that fails the build if a new route forgets.
• Optional two-factor authentication and passkeys are available on every account.
• We email you when your account is signed into from a country or a browser we have not seen before.
• Sign-in, code and password routes are rate limited, and login codes expire in 10 minutes with 5 attempts.
• An append-only activity log records what happened on your account.

No system is perfectly secure, and we will not pretend otherwise. What we commit to is the list above, and telling you quickly when something goes wrong.

If something goes wrong

We have a written breach plan and we follow it. If personal data we hold is exposed, lost or accessed without authorisation:

• We contain it first, which may mean rotating secrets, revoking network tokens so you have to reconnect, or taking a route offline.
• We tell the Data Protection Board of India, and every person affected, with what happened, what data, what we have done and what you should do. Under the DPDP framework this is without delay and within 72 hours of becoming aware, and we will not wait to be sure it was serious before telling you.
• Where the incident is also a reportable cyber incident, we report it to CERT-In within the 6 hours their directions require.
• We tell the networks and our payment provider if their tokens, app secrets or payment identifiers were involved.
• Afterwards we write up the cause and the fix, and add a test that would have caught it.

We will not minimise, and we will not make you find out from somebody else.

The networks you connect

Connecting a network is you giving us permission, at that network, to act for you in specific ways. What we get and what we may do with it is set by the network, not by us.

• Google and YouTube: Dripost uses YouTube API Services. By using Dripost's YouTube features you also agree to the YouTube Terms of Service, and Google's own handling is described in the Google Privacy Policy. You can revoke Dripost's access to your Google and YouTube data at any time at the Google security settings page.
• Dripost's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that data only to provide the features you can see in the product. We do not transfer it, sell it, or use it for advertising, and no human at Dripost reads it except with your explicit permission for support, to comply with the law, or where it is aggregated and anonymised for a security or operations reason.
• Meta, for Instagram: you can remove Dripost's access in Instagram's own settings, under apps and websites.
• X: you can remove Dripost's access in your X settings, under connected apps.

We keep only what those permissions give us, and we delete our copy when you disconnect or delete your account.

If you are outside India

Dripost is built and operated from India, and Indian law governs it. We apply the protections in this policy to everyone, wherever you are.

If you are in the UK or the European Economic Area: we process your data to perform our contract with you, and on your consent where this policy says consent. You have the rights you would expect — access, correction, erasure, portability, objection, restriction — and the way to use them is the same as above. Since we have no establishment in the EEA or the UK, complaints come to us first, and we will answer them properly.

If you are in a US state with its own privacy law: we do not sell personal information or share it for cross-context behavioural advertising, and you may ask us to access or delete your data by writing to us.

Complaints

If anything here worries you, tell us first — most things are a misunderstanding we can fix the same day.

Changes to this policy

If we change this policy in a way that matters, we will tell you inside the product before it takes effect, and we will ask you to agree again. Each version carries its date, and the record of what you agreed to names the version, so it is always possible to say which text you accepted.

This version is dated 2026-09-21.

How to reach us

For anything about this policy, or about data we hold: