Privacy Policy.
What personal data Drey processes when you use the website and the web, desktop and iOS apps, why, who else receives it, how long it is kept and how to use your rights.
The short version
- Drey stores your account and the notes, tasks, events and files you put in it so it can sync them across your devices. That's what your data is for.
- We don't sell your data, show ads or use your content to train AI. The apps have no analytics or tracking. This website counts visits with our own analytics, which sets no cookies and doesn't tell us who you are.
- Your data is stored on our server in Frankfurt, Germany. A few providers outside the EU help with email, network protection and push notifications; they are listed in the subprocessors page.
- You can download everything you keep in Drey from Settings and delete your account from the app at any time.
1. Who is responsible
The controller of your personal data is vSites OÜ, registry code 17112051, Sepapaja tn 6, 15551 Tallinn, Estonia. For anything about your data, write to [email protected]. We are a small company and haven't appointed a data protection officer, which the law doesn't require of us; the privacy address reaches the people who run Drey.
2. What we process and why
| Data | What we use it for | Legal basis |
|---|---|---|
| Account details | Your name, email address and a salted hash of your password (never the password itself), so you can sign in and we can tell your account apart from others. | Contract: needed to provide Drey (GDPR Art. 6(1)(b)). |
| Sign-in and security records | One-time codes we email you (stored only as hashes and valid for 10 minutes); your active sessions, including the IP address and browser or device type they started from; server logs of sign-ins; and short-lived rate-limit counters keyed by IP address. We use these to keep your account secure and to stop abuse. | Contract, and our legitimate interest in keeping Drey and your account secure (Art. 6(1)(f)). |
| Your content | The notes, folders, tasks, calendar events, files, profile picture and settings you create or upload, so we can store, sync, search and show them to you on every device. | Contract. |
| Calendar subscriptions | The web address of any calendar feed you subscribe to. Our server fetches it about every 15 minutes and stores the events it contains. These addresses often contain a private access key, so treat them like a password. | Contract. |
| Notifications | If you allow notifications on iOS, your device's push token, time zone and notification settings. Reminder notifications contain the task or event title so they are useful on your lock screen. | Contract. You can switch notifications off in Drey or in iOS settings at any time. |
| Link previews and icons | When a note contains a web link, our server may fetch that page to show its title and image, and to use a site's icon for a note when you choose it. | Contract. |
| Server and network logs | Technical records of requests (such as time, IP address, request path and errors) that our server and Cloudflare keep to run, debug and protect Drey. Our logs don't contain the text of your notes. | Legitimate interest in running a reliable and secure service. |
| The waitlist | Your email address, the page of this site you first joined from and, if you answer it, what's on your plate, so we can tell you when your spot is ready and send the odd update about Drey. | Your consent (Art. 6(1)(a)), given when you confirm the emailed link. You can withdraw it from that link at any time. |
| Website visits | When you browse the public pages of usedrey.com, our self-hosted Umami analytics records the page, the site and campaign link that brought you, your browser, operating system, device type, screen size and language, the country, region and city your IP address points to, how quickly the page loaded, and a few actions such as opening a demo, opening a question or joining the waitlist (never the address you type). Your IP address and browser are turned into a visitor ID by one-way hashing with a value that changes every month; the IP address itself isn't stored. Nothing is stored on your device, it isn't linked to your account or waitlist entry, and browsers that send Do Not Track aren't counted. We use it to see which pages help people and where they get stuck. | Legitimate interest in understanding and improving our website (Art. 6(1)(f)). |
| Messages to us | What you write when you contact support or make a privacy request, so we can answer. | Contract, or legal obligation for privacy requests (Art. 6(1)(c)). |
If you have an account, we only send you email that you need to use it: verification, sign-in confirmation, password reset and email change codes, and a notice if we can't finish deleting your account. If you join the waitlist, we email you to confirm your address, when your spot is ready, and with the occasional update about Drey. We don't make decisions about you by automated means that have legal or similarly significant effects.
3. What Drey doesn't do today
Drey has code for features that are switched off for everyone: public sharing links for images and paid plans. None of them is offered, and no data is sent to the providers behind them. Before we turn any of them on, we'll update this policy and the subprocessor list and tell you.
4. Who receives your data
We use a small number of service providers (processors) that handle data only on our instructions and under data processing agreements: Oracle hosts our server, Cloudflare protects and delivers network traffic, Resend sends account email, and Expo and Apple deliver push notifications and iOS app updates. The subprocessor list says what each one receives and where.
Website analytics run on our own Umami server, so no analytics company receives data about your visits. That server runs on Oracle Cloud Infrastructure, Frankfurt region (Germany), operated by Oracle.
Some data reaches other parties because of how the web works or because you asked for it:
- Link icons. To show a small icon next to links in your notes, the desktop and iOS apps ask Google's favicon service for it. Google then learns the website's domain and your IP address, but not the rest of your note.
- Content from other sites. When a note shows an image hosted elsewhere, or a link preview's image, your device loads it from that site, which sees your IP address. When our server fetches a calendar feed or link preview, the site sees our server's address, not yours.
- Apple. If you download the iOS app, Apple processes your App Store data under its own privacy policy.
- Authorities. We disclose data to public authorities only when the law requires it, and we push back on requests that aren't properly founded.
- A new owner. If Drey or our company is sold or merged, your data may pass to the new owner, who must keep honouring this policy. We'll tell you before that happens.
5. International transfers
Your account and content are stored in the EU, on our server in Oracle's Frankfurt region. Cloudflare, Resend, Expo and Apple are based in the United States, so the data they handle for us may be processed there. We rely on the EU–US Data Privacy Framework where the provider is certified under it (GDPR Art. 45), and otherwise, or if that framework stops applying, on the European Commission's Standard Contractual Clauses in the provider's data processing agreement (Art. 46). Oracle is a US-owned company; your data stays in Frankfurt, and its agreement covers any support access from outside the EU. You can ask [email protected] for a copy of the safeguards that apply.
6. How long we keep data
| Data | How long | Notes |
|---|---|---|
| Account and content | Until you delete it or delete your account. | Items you delete stay in Recently Deleted until you delete them permanently. |
| Uploaded images and files | Until you delete them from the list of files in Settings, or delete your account. | Deleting a note doesn't delete the images or files it used, so they stay in your storage until you remove them. |
| Deleted account | Removed from our live systems within minutes of confirming deletion. | We keep only a record that the deletion happened, without your content or email address. |
| Account exports | 24 hours after the export is ready. | The zip file is then deleted from our server. Download it again by starting a new export. |
| Waitlist | Until your spot is ready and you've had time to take it, or until you leave the list. | An address that is never confirmed is deleted after 7 days. |
| Website analytics | Kept indefinitely. | Visit records hold no IP address, cookie or account, so they can't be traced back to you. |
| Backups | Backups are kept for up to 30 days, then deleted. | Access is restricted, and backups are used only to restore the service after a failure. |
| Sessions | Until you sign out or delete your account. | A session stops working 30 days after you last used it. |
| Notification devices | Until you sign out on the device or switch notifications off, plus up to 30 days. | Delivery receipts are kept for up to 30 days. |
| Server logs | Server logs are kept in a size-limited rotating store and are overwritten as new entries arrive, usually within a few days. They are never kept for more than 30 days. | Includes sign-ins, which help us investigate suspicious activity. Cloudflare keeps its own network logs for a short period under its terms. |
| Support and privacy requests | Up to 3 years after the request is closed. | So we can show how we handled a request if it is questioned. |
If you create an account but never verify your email address, the unverified account stays until you or we delete it.
7. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- correct it if it is wrong, for example your name or email address;
- delete it: you can delete your account in Settings, under your account;
- take it with you in a commonly used, machine-readable format;
- restrict how we use it, or object to processing based on our legitimate interests; and
- withdraw consent where we rely on it, such as for notifications, without affecting what happened before.
For a copy of your data, use Export in Settings. It builds a zip file with your notes as Markdown, the images and files you uploaded, the events you created in Drey as a calendar (.ics) file, and your todos, events and settings as JSON. You can start one export a day, and the file stays available to download for 24 hours. If the export doesn't give you what you need, or for any other request, write to [email protected]. We answer within one month, and may ask you to confirm the request from your account's email address so we know it's you. Requests are free unless they are clearly unfounded or excessive.
You also have the right to complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, [email protected], aki.ee. You can also complain to the authority in the EU country where you live or work, or where you think the problem happened; in Hungary that is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). We'd appreciate the chance to sort it out with you first.
8. Storage on your device
Drey stores some data on your device so it can keep you signed in, let you work offline and remember your preferences. All of it is needed for the features you use, so we don't ask for consent first. We use no advertising or tracking cookies, our website analytics store nothing on your device, and nothing here is shared with other sites.
| Where | What | Why |
|---|---|---|
| Web: cookies | better-auth.session_token and better-auth.convex_jwt, first-party and inaccessible to scripts. | Keep you signed in. They last for your session, up to 30 days after your last use. |
| Web and desktop: browser storage | Local storage, session storage, IndexedDB and a media cache holding your preferences, unsent edits, an offline copy of recently opened notes, and images you have viewed. | Remember your settings, keep working offline and never lose an edit that hasn't reached the server yet. |
| Desktop: app files | Your session, encrypted with your operating system's secure storage, window positions, preferences and the list of local files you've opened in Drey. | Keep you signed in and restore the app the way you left it. |
| iOS: Keychain | Your session and the key that encrypts the app's local database. | Keep you signed in securely. |
| iOS: app storage | Encrypted and unencrypted local databases with unsent edits and offline copies of your notes, tasks and calendar, preview images, files you've opened, and the data your widgets and share extension show. | Work offline, load quickly and power widgets and sharing to Drey. |
Signing out removes your session from the device. Edits that never reached the server are kept so you don't lose them, unless you choose to discard them. Uninstalling the app or clearing your browser's site data removes the rest.
9. Security
All traffic to Drey is encrypted in transit. Passwords are stored only as salted hashes, sign-in codes expire after 10 minutes, and every request is checked against your account before it can read or change data. Our server's disks are encrypted at rest by Oracle, and administrative access is limited to the people who run Drey.
Drey is not end-to-end encrypted, so we could technically read the content on our servers. We don't, except when you ask us to help with a problem, when it is needed to investigate a security issue or abuse, or when the law requires it.
If a personal data breach puts your rights at risk, we'll notify the Estonian Data Protection Inspectorate within 72 hours of learning about it and tell you without undue delay. Please report vulnerabilities to [email protected].
10. Children
Drey isn't meant for children. You must be at least 16 years old to create an account. If you believe a child under 16 has given us personal data, tell us at [email protected] and we'll delete the account.
11. Changes to this policy
We'll update this policy when Drey or the law changes, and show the new effective date at the top. If a change affects how we use your data in a meaningful way, such as turning on one of the features in section 3, we'll tell you by email or in the app before it takes effect.