Privacy policy

Dripboard ("Dripboard", "we", "us") provides a scheduling service for Pinterest, available at dripboard.dev. This policy explains what personal data we collect, why we collect it, how long we keep it, and the choices you have.

For the personal data described here, Dripboard acts as the data controller. Our contact address for privacy matters is privacy@dripboard.dev.

This policy covers the marketing site and the Dripboard application. It does not cover Pinterest itself, or any third-party site you reach through a link in a pin — those are governed by their own policies.

This section comes first because it is the part most people want to know, and because it shapes everything else in this policy.

Pinterest's developer guidelines prohibit third-party applications from storing information obtained through the Pinterest API. We follow that rule. Information we read from Pinterest — your boards, your published pins, your metrics — is requested at the moment you ask to see it, used to render the screen you are looking at, and then discarded. It is not written to our database, and it does not accumulate into a history we hold.

Those guidelines do allow one carve-out, for campaign analytics belonging to an account that granted you access. We do not use it. Whether or not that exception could be read to cover the figures Dripboard displays, we keep none of them — it is a simpler promise to make and an easier one to keep.

What we do store is the material you created inside Dripboard and the instructions you gave us. The table below draws the line precisely.

One line in that table deserves saying plainly, because it is the only place a Pinterest identifier touches our storage at all. A pin scheduled for Thursday evening has to know where it is going on Thursday evening, so the board you selected travels with the instruction until then. It is encrypted while it waits, it is deleted as the pin publishes, and it never reaches the permanent record — nothing in our database outlives the instruction that needed it.

Because metrics are read live rather than archived, Dripboard can only show you the periods and figures Pinterest itself will return at that moment. We cannot show you a history that predates your connection, and disconnecting the account ends our ability to show you anything at all.

We request the narrowest set of Pinterest permissions that lets the features you use work. We never see or store your Pinterest password. We do not read your Pinterest messages, we do not follow or unfollow accounts on your behalf, and we publish only the pins you have individually chosen and scheduled.

Account data

• Your name and email address, provided when you create an account.
• A hashed password, or the identifier of the identity provider you signed in with.
• Workspace settings such as timezone, publishing slots, and team member invitations.

Content you create in Dripboard

• Images and videos you upload for scheduling, held until published and then for the retention period below.
• Pin titles, descriptions, destination links, tags, and templates you write.
• Drafts, review comments, and approval decisions in team workspaces.
• The scheduling instruction attached to each item: when it should publish and which board you selected.

Connection data

• Encrypted Pinterest OAuth access and refresh tokens, together with the account identifier and username they belong to, so you can tell connected accounts apart.
• The permissions you granted, and the date you granted them.

Usage and technical data

• Log data: IP address, browser and device type, pages requested, and timestamps.
• Publishing records: what we attempted, when, and whether Pinterest accepted it.
• Product analytics: which features are used and where errors occur, recorded against your account identifier.
• Cookies and similar technologies, described in our cookie policy.

Billing data

Paid plans are billed through a third-party payment processor. Card details are entered on the processor's systems and are never transmitted to or stored by Dripboard. We receive and store the billing name, country, invoice history, and the last four digits and brand of the card.

• To operate the service: holding the pins you scheduled and publishing them to Pinterest at the times you set.
• To display your boards, pins, and performance by retrieving them from Pinterest when you open the relevant screen.
• To authenticate you, keep accounts separate, and apply plan limits.
• To provide support, including reproducing problems you report.
• To send service messages such as publishing failures, security notices, and billing receipts.
• To send product updates and marketing email, only where you have opted in, with an unsubscribe link in every message.
• To improve reliability and detect abuse, using aggregated or pseudonymised usage data.
• To meet legal, accounting, and tax obligations.

We do not sell personal data. We do not use your pins, images, or metrics to train machine learning models, and we do not share your content with other customers.

Where the GDPR or comparable law applies, we rely on the following legal bases.

We share personal data only with service providers that process it on our behalf, under contract, and only for the purposes below.

We may also disclose data where legally required, or to establish or defend legal claims. If Dripboard is involved in a merger or acquisition, data may transfer to the acquiring entity, and you will be notified before your data becomes subject to a different policy.

When you delete your account, the data above is removed from live systems within 30 days. Encrypted backups roll off on their own schedule and are fully overwritten within 90 days.

Depending on where you live, you may have some or all of the following rights over your personal data.

• Access: request a copy of the personal data we hold about you.
• Rectification: correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data, subject to records we must keep by law.
• Portability: receive your data in a machine-readable format, or export it yourself from your account settings.
• Restriction and objection: ask us to pause or stop certain processing, including processing based on legitimate interest.
• Withdraw consent: unsubscribe from marketing, or reject non-essential cookies, without affecting the service itself.
• Complain: raise a complaint with your local data protection authority.

To exercise any of these, write to privacy@dripboard.dev. We answer within 30 days and may ask you to confirm your identity first. Requests about data held by Pinterest itself have to go to Pinterest, since we do not keep a copy of it.

You can disconnect a Pinterest account at any time, either from your Dripboard settings or from Pinterest's own connected-apps screen. Revoking there immediately ends our access, and any pins still waiting in your queue will stop publishing.

Our infrastructure and some of our processors are located outside your country, including in the United States. Where data leaves the European Economic Area, the United Kingdom, or Türkiye, we rely on the European Commission's Standard Contractual Clauses or an equivalent transfer mechanism, together with technical measures such as encryption in transit and at rest.

Our strongest protection is architectural rather than technical: information we never store cannot be exposed by a breach of our systems. Your boards, your pins, and your performance figures are not sitting in our database waiting to leak, because they were never written there.

For the data we do hold, these are the measures in place:

• Traffic between your browser and Dripboard is served over TLS.
• Pinterest OAuth tokens are encrypted before being written to storage.
• Account data and uploaded media sit on infrastructure that encrypts data at rest.
• Access to production systems is limited to people who need it and requires multi-factor authentication.

We will not list certifications we do not hold or audits we have not had. Dripboard is a small operation, and if you need a security review, a data processing agreement, or a list of our subprocessors before adopting it, write to us and we will tell you plainly where we stand.

No system is perfectly secure. If a breach affects your personal data and creates a risk to you, we will notify you and the relevant authority within the timeframes the law requires.

Dripboard is not directed at children. You must be at least 16 years old, or the minimum age at which you can consent to online services where you live, to create an account. If we learn that we hold data about a child below that age, we delete it.

We update this policy when the service or the law changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will email account holders at least 14 days before it takes effect.

Questions, requests, and complaints about this policy go to privacy@dripboard.dev. Postal enquiries can be sent to Dripboard, Istanbul, Türkiye.