Privacy Policy

DropPerch monitors the lifecycle of domain names you choose and tells you when their registry status changes. This policy explains what personal data the service handles, why, and what you can do about it.

The service is operated by the individual trading as WebVogue Technologies, a sole proprietorship based in India. For the purposes of the Digital Personal Data Protection Act, 2023 and the UK and EU GDPR, the operator of WebVogue Technologies is the data fiduciary and controller of the data described below.

A question about your data is answered directly by the people who build the code that handles it, not passed to a third-party support desk. The operator is an individual rather than a registered company, and their name is given on request to the address below — ask and you will be told who you are dealing with.

Questions about this policy go to support@dropperch.com.

It covers the DropPerch website, the signed-in application, the monitoring engine that performs the registry checks, and the emails we send you.

It does not cover the domain registries, registrars, or marketplaces we link out to. Following a link to a registrar to buy a domain puts you on their site under their terms, and we have no part in that transaction.

We collect what the service needs to work and nothing speculative. There is no advertising pixel and no session recorder on this site, and Google Analytics runs only if you allow it in the cookie banner.

We never see or store your password. Firebase Authentication holds it as a hash, and it is not readable by us.

We do not collect special category data, we do not profile you, and we make no automated decisions about you that have a legal effect.

This is inherent to how the service works, so it is stated plainly rather than buried. When you add a domain to your watchlist, that domain name leaves our systems as part of every subsequent check:

• Domain registries and registrars (RDAP) — We query the authoritative registry for each domain you watch, over RDAP (RFC 9083). The query contains the domain name and nothing about you.
• IANA bootstrap registry — We fetch IANA’s public list of which RDAP server is authoritative for which top-level domain. This request contains no domain name and nothing about you.
• Open PageRank (DomCop) — On the Portfolio plan only, we send the domain name to DomCop to retrieve the authority figures shown in your watchlist. On the free plan this request is never made.

None of these requests identify you. They contain the domain name, not your account. A registry cannot tell from our query who asked, or that anyone is watching.

Where the GDPR applies, we rely on the following:

• Performance of a contract — Running your account, storing your watchlist, performing the checks, and sending the alerts you configured. Without this we cannot provide the service you signed up for.
• Legitimate interests — Keeping the service secure and working, responding to your messages, and contacting people who asked to be told when paid plans open. We have weighed these against your interests and consider the impact minimal.
• Legal obligation — Retaining records where the law requires it, and responding to lawful requests from authorities.

Under the Digital Personal Data Protection Act, 2023 we rely on your consent (section 6) for your account and watchlist, given when you create an account after seeing the notice on the sign-up form, and separately for analytics cookies, given or refused in the cookie banner. Where you send us something yourself, such as a contact-form message, we use it for the purpose you sent it for, which that Act treats as a legitimate use (section 7). You can withdraw consent at any time, as easily as you gave it — see your rights. Withdrawing does not affect processing that happened before.

We use a small number of service providers. Each is bound to process data only on our instructions, and none of them is permitted to use your data for their own purposes.

We use one email provider at a time, not both. We do not sell personal data, we do not share it for advertising, and we have never done either.

We may disclose data if we are legally compelled to, or where it is necessary to establish or defend a legal claim. If the service is ever sold or transferred, your data would move with it and you would be told before that happened.

Our infrastructure runs on Google Cloud, and our email provider is in the European Union or the United States depending on which is active. Your data will therefore be processed outside India.

For transfers out of the UK and EEA we rely on the European Commission’s Standard Contractual Clauses, which are part of our agreements with these providers. Google Cloud is additionally certified under the EU–US Data Privacy Framework.

Under section 16 of the Digital Personal Data Protection Act, 2023, personal data may be transferred outside India except to countries the Central Government restricts. None of the countries our providers operate in is restricted, and we will move away from any provider whose location becomes restricted.

We set no advertising cookies. Analytics cookies are set only if you choose “Allow” in the cookie banner; “Decline” is the same size and just as easy, and nothing is loaded from Google Analytics until you decide. If your browser sends Do Not Track or Global Privacy Control, we treat that as a refusal and do not ask.

To change your mind, use “Cookie settings” at the bottom of any page. Declining after allowing deletes the analytics cookies and stops analytics on that page straight away.

• Analytics cookies (only with your consent) — Google Analytics sets _ga and _ga_<id>, holding a random identifier so repeat visits can be counted. They expire after two years, or when you decline.
• Your cookie choice — Stored in your browser as dp_consent so we do not ask on every page. This is necessary to respect a “no”, so it is not itself asked about.
• Your sign-in session — Firebase Authentication keeps a token in browser storage so you stay signed in between visits. Signing out removes it. Without it there is no way to remain signed in.
• A dismissal flag — If you skip the setup prompt, we remember that in your browser so it does not reappear on every page.

The fonts on this site are loaded from Google Fonts, which receives your IP address in order to serve the font files, as any file request necessarily does.

You can exercise the following at any time:

• Access and portability — The Account page has an export button that downloads everything your account holds as a JSON file, immediately and without asking anyone.
• Correction — Edit your display name and alert preferences in the app. For anything else, email us and we will correct it.
• Deletion — Delete your account from the Account page. This removes your profile, your watchlist, and the lifecycle history recorded against it. Sign-in credentials are removed from Firebase Authentication at the same time.
• Objection and restriction — You can object to processing based on our legitimate interests, including the upgrade-interest list. Email us and we will stop.
• Withdrawing consent — You can turn off any category of alert on the Alerts page, withdraw analytics consent from “Cookie settings” on any page, or withdraw consent entirely by deleting your account — each as easy as the step that gave it.
• A summary of what we hold and who else has it — Ask, and we will send a summary of the personal data we process about you, what we do with it, and the name of every service provider listed below that has received it. The export above covers the data itself.
• Nominating someone — Under the Digital Personal Data Protection Act, 2023 you can nominate another person to exercise these rights for you if you die or become unable to. Email us from your account address with the nominee’s name and email address.
• Grievances — If something we did with your data is wrong, tell us. See contact and complaints.

Deleting your account also cancels the checks on every domain you were watching. We keep no shadow copy of a deleted watchlist. Backups taken before deletion are overwritten on their normal cycle, within 30 days.

To make a request by email, write to support@dropperch.com from the email address on your DropPerch account — that address is how we confirm the request is yours, and we will not ask for identity documents. We answer within 30 days, and do not charge for this.

The database enforces access at the document level: rules on the server, not checks in the browser, decide that a watchlist can only be read by the account that owns it. The paid-only authority figures are held in a separate collection that a free account is not permitted to read at all, rather than being sent to the browser and hidden there.

Lifecycle history is append-only — no client can write or alter it, including you. Traffic is encrypted in transit, and data is encrypted at rest by our infrastructure provider.

No system is perfect. If we discover a breach affecting your personal data, we will email you without delay at your account address, saying what happened and when, what it means for you, what we have done about it, what you can do to protect yourself, and who to contact. We will report it to the Data Protection Board of India straight away and in full within 72 hours, as the Digital Personal Data Protection Rules, 2025 require, and to any other authority the law requires.

The service is for business use and is not directed at children. You must be 18 or over to create an account, and the sign-up form asks you to confirm that. We do not knowingly collect personal data from anyone under 18, and we do not track or target advertising at anyone. If you believe a child has created an account, tell us and we will delete it.

If we change how we handle your data, we will update this page and move the “last updated” date. For a change that materially affects your rights, we will email account holders before it takes effect rather than relying on you to notice.

Privacy questions and rights requests: support@dropperch.com. Anything else: the contact form.

Grievance Officer. Under the Digital Personal Data Protection Act, 2023, questions about how your personal data is processed, and grievances, are answered by the operator of DropPerch, who reads this inbox personally: support@dropperch.com. We respond within 30 days. Every reply to a rights request will repeat this contact.

You must raise a grievance with us first. If we do not resolve it, you can complain to the Data Protection Board of India.

If you are in the UK or EEA, you also have the right to complain to your local data protection authority. We would rather you came to us first, but that is your right and not conditional on doing so.