Privacy Policy

Effective October 7, 2026

This policy explains what personal information No Gimmicks Media LLC (“Leafdrop”, “we”, “us”) collects when you use Leafdrop at app.leafdrop.studio, why, who we share it with, and the choices you have. There are two kinds of people on Leafdrop: Studios, who have an account and upload music, and Clients, who open a link a Studio sent them.

1. What we collect

From Studios

Account details: your email, your name if you give it, your studio name, and your password (stored only as a salted hash, never in plain text).
Studio details you add: branding (logo, colors, website, contact email) and payment settings such as a PayPal.me username or Stripe Payment Link.
Your content: the audio you upload and information about it (format, waveform, loudness), project and client names, notes, comments, prices and payment status.
Billing: Stripe handles your card. We receive and store only references (customer and subscription IDs) and your subscription status; we never see or store your full card number.
Connected Stripe account: if you connect Stripe to take client payments, we store your Stripe account ID and whether it can accept payments. Stripe collects your identity and bank details directly under its own privacy policy.
Messages you send us through Contact us or Send feedback.

From Clients

The name you type when you leave a comment, and your comments.
If you pay by card, Stripe processes the payment on behalf of the Studio; we only learn that the payment succeeded.
Link activity: when a share link is opened, which tracks are played and for how long, and when files are downloaded. This is shown only to the Studio that sent you the link, so they know you’ve heard their work. It isn’t tied to your identity beyond the link itself and any name you type.

From everyone, automatically

Technical data: your IP address, browser and the pages you request appear in our hosting provider’s server logs and are used briefly in memory to limit repeated sign-in attempts.
Cookies and similar: one essential cookie keeps Studios signed in. The app also remembers small preferences in your browser (like your name on comments or a collapsed sidebar). We don’t use analytics cookies.
Visit counts, without cookies: we count visits to our website’s public pages (such as the homepage) and the steps toward signing up, along with the site or campaign a visit came from, the kind of device (phone, tablet or computer), how long the page was in use, how far down it was scrolled, which parts of it were shown and which buttons and links were clicked. Nothing typed into the page is recorded. To tell visitors apart for a day, our server turns your IP address and browser type into a scrambled code using a key that is replaced every day, so you can’t be recognised from one day to the next. Your IP address isn’t stored, and the counts are kept for up to 400 days.
Ad measurement, only if you accept: our website asks before using advertising cookies. If you accept, our homepage and the sign-up and Studio pages load the Meta Pixel, which sets Meta’s cookies (such as _fbp) and tells Meta about page visits, sign-ups and trials. When a Studio that accepted signs up, starts a trial or pays for a plan, our server also tells Meta, with the email address in hashed (scrambled) form, the IP address, browser type and those cookies, so we can see which of our ads work. If you decline, none of this happens. Client pages (share links) never load the Pixel. You can change your choice at any time in cookie settings.

2. How we use it

To run Leafdrop: store and stream your files, show them to the people you share them with, and keep projects, comments and payments working.
To bill subscriptions and apply promo codes, through Stripe.
To send service emails, like password resets and storage warnings. We don’t send marketing emails without your consent.
To keep Leafdrop secure: prevent abuse, investigate problems, and enforce our Terms of Service.
To answer your messages and improve the product.
To measure and improve our own ads on Meta (Facebook and Instagram), as described above.

We don’t sell your personal information, and we don’t use your audio to train AI models.

If you’re in the EEA or UK, our legal bases are: performing our contract with you (running your account), our legitimate interests (security, improving the Service, answering messages), your consent where we ask for it (such as advertising cookies and ad measurement), and legal obligations (for example keeping billing records).

3. Studios and their Clients

A Studio decides what to upload and whom to share it with. For information a Studio puts into Leafdrop about its Clients, the Studio is responsible for it (the “controller”) and Leafdrop processes it on the Studio’s behalf. Clients with questions about their information in a project should contact the Studio first; we’ll help where we can.

Clients can also make their own account, to keep the projects they’re sent in a library. For that account we store the Client’s email address, the name they give, and which share links are in their library and when they last opened them; Leafdrop is responsible for this information. When a Client opens a link while signed in, the Studio that sent it sees the Client’s name on that visit, and that the link is in their library, but not their email address. We email Clients when a Studio uploads a new version of a project in their library; they can turn this off from the email or their library. Clients can delete their account at any time from their library.

4. Who we share it with

Only with service providers that help us run Leafdrop, under contracts that limit their use of it:

Railway: hosting the app and its database (United States).
Cloudflare (R2): storing audio files and database backups (Asia-Pacific).
Stripe: subscriptions and Client card payments.
Resend: sending emails.
Meta: measuring our ads, only for visitors and Studios who accept advertising cookies.
Google Fonts: loading the typeface on some pages, which shares your IP address with Google.

We also share information when the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business (in which case this policy keeps applying to your information).

5. International transfers

We and our providers may process information in the United States and other countries. Where required, transfers are protected by safeguards such as the EU Standard Contractual Clauses.

6. How long we keep it

Account information and content: while your account is open. When you delete files, or we delete your account at your request, they’re removed from the live service right away and from backups within 30 days.
Billing records: as long as tax and accounting laws require (we keep them 7 years).
Server logs: 30 days. Messages to us: as long as needed to help you.

7. Your rights and choices

You can see and change most of your information in the app. You can also ask us to access, correct, export or delete your personal information, or object to or restrict how we use it, by emailing hello@leafdrop.studio. We’ll respond within 30 days and may need to confirm it’s you. Depending on where you live (for example in the EEA, the UK or California), you may have additional rights, including the right to complain to your data protection authority. We don’t sell or share personal information for cross-context behavioral advertising.

8. Security

We use encryption in transit (HTTPS), hashed passwords, private storage with short-lived access links, and keep each Studio’s data separate from other Studios. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.

9. Children

Leafdrop isn’t for children under 16, and we don’t knowingly collect their information. If you think a child has given us information, contact us and we’ll delete it.

10. Changes

If we change this policy in a way that matters, we’ll tell you by email or in the app before it takes effect.

11. Contact

No Gimmicks Media LLC, 8 The Green, Ste B, Dover, DE 19901, United States · hello@leafdrop.studio