Privacy Policy

1. Scope and who is responsible

This policy applies to the official Drocsid website, hosted application, and related services at drocsid.app and drocsid.cc. “Drocsid,” “we,” and “us” mean the maintainers operating those services.

Drocsid is open-source software. Anyone can run a separate instance. A third-party or self-hosted instance controls its own data and must provide its own privacy information; this policy does not cover it.

2. Information we collect

Account and profile information

We collect your email address, display name, username, profile photo, bio, activity text, presence choice, preferences, and account creation and update times. If you use GitHub or Discord to sign in, we receive the account identifiers and profile information that provider shares under the permissions shown during authorization. Authentication records may include provider tokens needed to maintain the connection.

Content and relationships

We store messages, replies, reactions, attachments, saved messages, community and channel information, memberships, roles, invitations, friendships, message requests, blocks, read state, and notification state. Other people can see content according to the community, channel, and direct-message access rules in the product.

Technical and usage information

We process session identifiers, IP address, browser user agent, request and security-limit records, WebSocket connection state, diagnostics, performance traces, page views, and product interaction events. Sentry session replay is configured to mask text, block media, and omit cookies, request bodies, query parameters, database query data, and user details.

3. How we use information

• Provide accounts, authentication, communities, messaging, uploads, search, and realtime delivery.
• Apply your preferences, permissions, blocks, moderation decisions, and privacy choices.
• Secure the service, prevent abuse, enforce rate limits, and investigate faults.
• Understand reliability and feature usage so we can improve Drocsid.
• Send requested sign-in codes and necessary service communications.
• Comply with law and protect users, the public, and the service.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing the service, compliance with legal obligations, and consent where the law requires it. You may withdraw consent without affecting earlier lawful processing.

4. When information is shared

We share information with other users when the feature requires it. For example, community members see channel content and participants see direct messages. Public community names, descriptions, icons, and member counts can appear in discovery when an administrator enables discoverability.

We also use service providers to operate Drocsid:

• PostgreSQL and hosting infrastructure for application data and service delivery.
• Byteship for private file storage and image transformation.
• Sendbyte for delivery of email verification codes.
• PostHog for product analytics and error signals.
• Sentry for error monitoring, traces, and privacy-masked session replay.
• GitHub and Discord when you choose their sign-in options.

We may disclose information when required by law, to respond to valid legal process, to protect safety or rights, or as part of a reorganization of the hosted service. We do not sell personal information.

5. Storage, retention, and deletion

We retain account data and user content while your account is active and as needed to provide the service. Messages remain available until they are deleted by an authorized user or the relevant conversation is removed. Deleted messages become unavailable in the product; related stored files are queued for removal. Short-lived verification, security, and delivery records expire or are periodically cleaned up.

Residual copies may remain temporarily in backups, logs, or systems that protect service integrity. We may retain limited records when reasonably needed for security, dispute resolution, legal compliance, or enforcement. To request account access, correction, export, or deletion, contact us at hello@drocsid.app from the email connected to your account.

6. Cookies and local storage

Drocsid uses a session cookie to keep you signed in and browser storage for preferences and service operation. Analytics may also store a device or session identifier. See our Cookie Policy for details and controls.

7. International processing and security

Drocsid and its providers may process information in countries other than yours. Where required, we use appropriate safeguards for those transfers. We use access checks, private object storage, signed delivery links, encrypted network connections, hashed one-time codes, and other technical and organizational safeguards. No online service can guarantee absolute security, so protect your account and report suspected compromise promptly.

8. Your choices and rights

You can update your profile, notification settings, activity visibility, direct-message preference, community discoverability where you are an administrator, and blocked-user list in the app. You can disconnect an OAuth provider through that provider and control cookies through your browser.

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to complain to a data-protection authority. Contact us to exercise a right. We may verify your identity before completing a request.

9. Children

Drocsid is not intended for children under 13. If local law requires a higher age to use an online service without parental consent, that higher age applies. Contact us if you believe a child provided personal data in violation of this section.

10. Changes to this policy

We may update this policy as Drocsid changes. We will revise the effective date and provide additional notice when a change materially affects your rights or how we use personal data.