Privacy

The short version

Your exact coordinates never leave your device. When Droog needs a location, it sends a geohash — a grid square about 747 × 611 metres at Dutch latitudes. The server keeps one square per device and overwrites it when you move to another, so there is no route and no list of places. There is no account, no sign-in and no advertising identifier. The only email address Droog holds is one you leave on the waitlist, if you live somewhere it does not reach yet. The app has no analytics SDK and no crash reporting SDK. This website does count its visits; the end of this page says exactly how. Nothing is sold or shared with a data broker.

What Droog collects

A rough location

Two separate things, which are worth keeping apart:

• For rain alerts — one geohash square (747 × 611 m), stored with a randomly generated device identifier and Apple's push tokens so an alert can be started and stopped. One square per device, overwritten whenever you cross into another.
• When you tap "raining right now?" — a coarser square, roughly 5 km across, with no identifier attached at all. No device id, no token, nothing that ties it to you or to the square above. The server does not keep the individual report; it adds one to a daily counter for a region about 150 km across.

Your precise coordinates are used on your own device — to work out which square you are in, and to search for place names. Place searches go to Apple, which handles them under Apple's own privacy policy. They never reach Droog.

Identifiers

A random identifier generated by the app, Apple push notification tokens, a Firebase messaging token and an anonymous Firebase sign-in id. None of these is Apple's advertising identifier, none is shared, and none means anything outside Droog.

Support conversations

If you write to us in the app, we receive your message, any photo you attach, and your device model, OS version, app version and language. Photos are re-encoded before sending, which strips the original file's embedded data including any location. Nothing here happens unless you start a conversation.

The waitlist

If you live somewhere Droog does not reach yet, the app lets you leave an email address to hear when it does. We store four things: the address, the country you chose, the language to write to you in (English or Dutch) and the date you signed up. Nothing else is stored with them: no device identifier, no location square and no push token, so the address is not connected to anything else Droog holds.

We use it for one thing: email about Droog. First the news that it reaches your country, and after that, rarely, an update. You consent to that by signing up, and you can withdraw it at any time. Every email has an unsubscribe link, and unsubscribing deletes your address. The list is not sold, rented or shared.

What Droog does not collect

Worth spelling out rather than listing, because "we don't collect it" only means something if you know what it would have done.

• No advertising identifier. Apple's IDFA is the number that lets an app recognise you inside other apps and websites — it is how pieces of behaviour get assembled into one profile. Droog never asks for it. That is also why you have never seen Droog show you the "allow tracking?" prompt: iOS only shows it to apps that request the identifier.
• No analytics in the app. There is no third-party code in Droog counting what you tap, how long you stay or which screens you visit. There is no dashboard with what you do in the app on it, because the app sends nothing of the kind. (This website is different: it counts page visits, as described below.)
• No crash reporting service. When Droog breaks we find out from Apple's aggregated reports, which carry no identifier of you.
• No precise location off your device, ever — only the coarse square described above.
• No name, contacts, photo library, health data or browsing. There is no account to attach them to. The one email address Droog can hold is the one you choose to leave on the waitlist.
• The widgets and the Apple Watch talk only to Droog's server. They ask it for the forecast for the same square, with no identifier attached, so they keep working when the app is closed.

Droog's privacy manifest ships inside the app in Apple's own format, so the App Store listing and this page are describing the same thing. If they ever disagree, one of them is a mistake and we want to hear about it.

Don't take our word for any of this

Your iPhone can audit us, and it is better at it than a policy page is. Turn on Settings → Privacy & Security → App Privacy Report. It records every domain an app contacts and every sensor it touches over seven days — measured by your own device, not reported by us.

Watch Droog in it. Then watch everything else on your phone.

Who else is involved

How long anything is kept

• Your square: one at a time, overwritten when you move.
• Your registration: deleted automatically about two weeks after the app stops checking in, or immediately if you turn alerts off, or as soon as Apple tells us the push token is dead.
• Rain reports: kept only as a regional daily count, for about a year. There is no individual report to delete.
• Support conversations: kept until you or we delete them.
• The waitlist: kept until you unsubscribe or ask us to remove you. It does not expire on its own, because we may write again after the launch.
• Server request logs: our servers keep short-lived operational logs, as any server does. They are not used to build a profile and are not shared.

Making Droog forget you

Turn rain alerts off in the app and the registration is deleted. Delete the app and it expires on its own within about two weeks. Because there is no account, there is no second copy of it under your name. There is no name.

The waitlist is kept apart from all of that. If you left an email address on it, unsubscribe from any email we send, or write to privacy@growpixel.com, and it is deleted.

If you want a support conversation deleted, or want to ask what is held, write to privacy@growpixel.com.

What this does not protect you from

Worth saying plainly, because a page like this is easier to trust when it admits its limits.

• A square is not anonymity. In a city one holds thousands of people; in the countryside it can hold a few dozen. The protection is real but it is not the same everywhere.
• Droog's servers cannot produce a history, because none is stored. But anyone who compromised the server and watched it continuously over time could observe squares changing. No amount of coarsening fixes that; the only thing that would is sending no location at all, which would mean no rain alerts.

Your rights, and why most of them have nothing to grip

If you are in the EU or the UK, the law gives you the right to ask what personal data is held about you, to have it corrected, to have it deleted, to take it elsewhere, and to complain to a regulator — in the Netherlands, the Autoriteit Persoonsgegevens.

Here is the honest position on the first few. There is no account, so there is nothing to look you up by. A rain-alert registration is identified by a push token that lives on your device and a random number the app invented. If you wrote to us tomorrow asking what we hold about you, we could not find out — not because we would not look, but because there is no name, address or email anywhere in it to match you against.

That situation has a name in the law: Article 11, processing that does not require identification. Where a controller genuinely cannot identify someone, the rights of access, correction and portability have nothing to attach to. It is not a dodge. It is the thing you get instead of those rights — data that cannot be handed over because it cannot be found.

Three places where this does not apply

• Support conversations. If you have written to us in the app, that conversation is tied to you by whatever you chose to tell us. Ask and we will send you a copy or delete it.
• The waitlist. An email address is something we can look you up by. Write to privacy@growpixel.com from that address and we will tell you what the list holds about you, correct it or delete it.
• Deletion needs no request at all. Turn rain alerts off, or delete the app, and the registration goes — immediately in the first case, within about two weeks in the second. That is the one right here you can exercise without asking anyone, including us.

If you think we hold something and this page has it wrong, write to privacy@growpixel.com and we will look properly. "We could not find it" is an answer we have to be able to defend, not a way of avoiding the question.

Shapes & Stories LLC is the data controller. Write to privacy@growpixel.com.

This website

droog.is is hosted by Netlify, which, like any web host, sees every request and keeps logs of them. The pages themselves load nothing from anyone else: no outside scripts, fonts or trackers.

We count visits without the page's help. Each time a page is served, Netlify's server tells TelemetryDeck afterwards which page it was, which site linked to it, the country, region and city the request came from as Netlify estimates them from the IP address, your browser's preferred language, and what kind of browser and device asked. Your IP address is not sent. So that one person reading three pages counts once, it also sends a one-way code made from the IP address, the browser, the date and a secret of ours. The code is different every day, so visits on different days cannot be linked, and TelemetryDeck cannot work back from it to an address. If your browser sends Global Privacy Control or Do Not Track, the visit is not counted at all.

The site sets one cookie, droog_lang, and only when you choose a language: with the switch on this page, or by following a link that picks one. It holds en or nl for a year, so the next page comes in that language. Without it, the site follows your browser's language.

The home page opens on a view from your country. In Belgium that is Dinant. In the Netherlands it is the place nearest you on a first visit, and a random Dutch one after that. Anywhere else, it is any of them. Netlify works out your country and the nearest place from the IP address and hands the page only the country and that place's name. Whether you have been before is remembered in your browser's own storage and is not sent anywhere.

Changes

If what Droog collects changes, this page changes with it and the date at the foot of it moves. See also the terms.