Privacy
Last updated 19 August 2026.
Who is responsible for your data
The controller of the personal data described on this page is 4Cs BV, Lindekensweg 3, 2160 Wommelgem, Belgium, company and VAT number BE 1014.832.509. We operate the drop.top service and publish its handset app. You can reach us about anything on this page at [email protected].
A channel's operator decides what that channel says and who it is aimed at. We provide the service that carries it. For the content of an alert, the operator is responsible; for the records described below, we are.
Two kinds of person, and they are treated differently
A subscriber is somebody whose phone follows a channel. They have no account with us and we hold no identity for them. An operator is somebody who runs a channel: they signed up, so we hold an email address and, if they pay us, billing details. Almost everything on this page splits along that line.
What we store about a subscriber
All of it belongs to a device rather than to a person, and this is the complete list:
- A device identifier that the app generates on the handset. It is a random string. It is not an advertising id, not a hardware serial, and it is replaced if the app's data is cleared or the app is reinstalled.
- A push token from Google's messaging service, when the phone has one, so a channel can wake the app rather than waiting for it to poll. A device without one still receives everything, just later.
- Platform, app version, language and time zone. The time zone is a zone name such as Europe/Brussels. It is coarse enough that hundreds of millions of people share one, and it is used to show an operator when their audience is awake.
- Which channels the device subscribes to, and which permissions it granted each one.
- Whether an alert was opened or acknowledged, when the handset chose to report it. This is what produces the "reported read" figure an operator sees.
There is no name, no email address, no phone number, no contact list and no advertising identifier in that list, because the app never asks for any of them.
Why we cannot know where you are
A channel can target an alert at a circle on a map: a flooded street, a campus, a festival site. It is worth being exact about how that works, because it is the opposite of how people reasonably assume it works.
The circle travels with the alert. Every subscriber's phone receives the alert, and each phone compares its own position with the circle locally and decides whether to show it. Your position is never sent to us, never compared on our servers, and never written down. There is no column in our database that could hold it.
Two consequences follow, and both are deliberate. A phone that cannot work out where it is shows the alert rather than hiding it, because missing an evacuation is worse than seeing one meant for the next town. And a subscriber who never grants location permission simply sees everything a channel sends, which costs them some noise and costs them no privacy at all.
What we store about an operator
- An email address, a display name and a password hash, or a Google sign-in if that is how you signed up.
- The workspace: its name, its channels, who else is a member, and what role each member has.
- What your channels have sent, and the aggregate daily figures behind the analytics pages.
- Billing details, if you are on a paid plan: company name, address, VAT number, invoices, and the payment provider's reference for your payment method. Card numbers never reach our systems.
- Files you upload to attach to an alert or to brand a channel, and a record of who uploaded each one.
- An audit trail of staff actions taken on an account, so that anything we do to your data is reviewable rather than merely possible.
This website uses Google Analytics, if you allow it
Analytics run on this website only, never in the handset app, and only after you accept them in the banner. If you decline, no analytics script loads and no analytics cookie is set. You can change your mind at any time from the Cookies link in the footer, and doing so changes nothing else about the site.
What we do not do
- We do not sell personal data, and we do not share it for advertising.
- We do not build a profile of a subscriber, and we could not: we hold no identity to attach one to.
- We do not give an operator any way to identify one of their subscribers, or to export a list of them.
- We do not track a subscriber's location, and the design makes that a fact rather than a policy.
- We run no advertising anywhere in the product.
Where your data is kept
Our servers, our database and our object storage are hosted in the European Union. Two named exceptions travel further, both of them limited:
- Google operates the messaging service that carries a wake-up ping to a handset, which means it processes the push token and the fact that a message was sent to it. Google may process that outside the EU under the European Commission's standard contractual clauses. The alert's own content is fetched by the app from us directly.
- Our payment provider processes the payments and the card details for paid plans, under its own policy.
Who else processes it
This is the complete list of third parties that touch personal data on our behalf:
- Cloudflare terminates TLS and carries traffic between your device and our host.
- Google provides push messaging for the handset app, and Google Analytics on this website subject to your consent.
- Our payment provider takes payments and holds the payment methods for paid plans.
- Our datacentre provider in the EU runs the machines our database and storage sit on.
We do not hand personal data to anyone else except where the law requires it of us.
Why we are allowed to hold it
- Performing our contract with you (Article 6(1)(b) GDPR): the device record, the subscriptions it holds and the operator's account. These are how the thing you asked for works. Without the device record a phone cannot be told what it has already seen.
- A legal obligation (Article 6(1)(c)): keeping invoices and their supporting records for as long as Belgian accounting law requires.
- Our legitimate interests (Article 6(1)(f)): the aggregate figures that let an operator see whether an alert was read, and the minimum logging needed to keep the service up and to stop abuse.
- Your consent (Article 6(1)(a)): website analytics, and nothing else. You can withdraw it at any time from the Cookies link in the footer.
How long we keep it
- Your location: we never receive it, so there is nothing to keep.
- The device record, its push token and its subscriptions: 24 months after the last time that handset was in touch, and sooner if you ask us or clear the app's data, which also replaces the identifier.
- Read and acknowledgement records: for as long as the alert they belong to. They are per device, not per person, and they disappear with the device record.
- An operator's account and channels: until you delete them. Deleting a channel also removes its subscriptions.
- Sent alerts: kept as the record of what a channel said, which is the point of having one. Deleting a channel deletes them with it.
- Invoices and their supporting records: seven years, as Belgian accounting law requires, regardless of account deletion.
- The staff audit trail: kept, because a record of who changed what is worth nothing if it can be pruned.
Your rights
Under the GDPR you may ask for access to your personal data, correction of it, deletion of it, a portable copy of it, or restriction of how we use it, and you may object to processing based on our legitimate interests. Write to [email protected] and we will answer within one month.
A subscriber can act without writing to anybody. Unsubscribing from a channel removes the subscription; clearing the app's data replaces the device identifier, which detaches the handset from everything above. There is also a deletion request form at /delete-account.
If you think we have handled your data badly, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussels).
Children
The service is not aimed at children, and it asks nobody for their age because it asks nobody for anything. A school channel is subscribed to by parents and staff on their own phones. If you believe a child has provided us with personal data, write to us and we will remove it.
Changes to this policy
When what the software stores changes, this page changes in the same release, and the date at the top moves. For anything that materially changes what we hold or why, we will say so in the console rather than relying on you to re-read this page.