Privacy Policy

What we collect

To run a drop, we collect only what the pipeline needs:

• For streamers: Twitch account identity via OAuth (username, user ID, channel ID), the Steam account you connect, the CS2 GSI events your client sends us, your drop configuration, and records of your balance, crypto top-ups, prize purchases, and withdrawals (including transaction references and any withdrawal address you provide).
• For viewers: The Twitch username you chat with, the Steam Trade URL you give us, and a record of drops you've been entered into or won.
• Operational data: IP address, browser, and basic request logs needed to operate the site, keep accounts secure, and prevent abuse.

We do not collect Steam passwords. Steam Mobile Authenticator codes and 2FA are handled by Steam directly — we never see them. You provide this information voluntarily; if you choose not to connect an account, fund a balance, or share a trade link, we may be unable to run drops for or to you.

How we use it

• To route GSI events from CS2 to your dashboard, pick a winner from eligible viewers, and build the Steam trade offer.
• To show streamers their own drop history and account state.
• To respond to support requests you send us via Discord or Instagram.
• To detect and prevent abuse of the platform.

We don't sell your personal data. We don't run third-party advertising on Dropzona.

Lawful basis (EEA/UK)

Where the GDPR or UK GDPR applies, we process your data to perform our contract with you (running drops, delivering prizes, and showing your account), for our legitimate interests in operating, securing, and improving the service and preventing abuse, to comply with legal obligations, and — where required — with your consent, which you can withdraw at any time.

Third parties we rely on

Dropzona is built on top of services provided by:

• Twitch — OAuth sign-in and chat integration. Their privacy policy applies to data they hold.
• Steam (Valve) — Steam OpenID, inventory lookup, and Steam trade offers. Their privacy policy applies to data they hold.
• Hosting & infrastructure — our hosting/CDN provider, which serves this site and processes basic request logs.
• Crypto & payment networks — top-ups, prize purchases, and withdrawals are operated through our payments partner, OpenSettle, and carried out over public blockchains and third-party markets, exchanges, and processors; your prize balance and funds are held by our third-party skin-platform partner. Dropzona never holds, custodies, or has access to your crypto, wallets, or private keys. On-chain transactions are public and permanent. Their terms apply, and we do not control or take responsibility for them.

Cookies & tracking

We use only the cookies and local storage needed to operate the site and keep you signed in — for example, Twitch and Steam sign-in/session and security cookies. We do not use cookies for third-party advertising. If we add analytics or any non-essential cookies, we will update this section and, where the law requires, ask for your consent before they load.

Data retention

We keep account and drop-history data for as long as your account is active. If you close your account, we delete personally identifying data within 30 days, except where retention is required for fraud prevention or by law. Basic security and transaction logs may be retained for up to 24 months for fraud prevention and legal compliance, and data written to public blockchains is permanent and cannot be deleted by us.

Your choices

• You can disconnect Twitch or Steam from your Dropzona account at any time in settings.
• You can request a copy of your data, or deletion, via our support page.
• You can revoke the Twitch and Steam connections directly with those providers.

Security

We use reasonable technical and organizational measures to protect the data we hold, and we never receive your Steam password or 2FA codes. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and to the extent permitted by law we are not liable for unauthorized access, loss, or disclosure of data that occurs despite reasonable safeguards. If a data breach affecting your personal data occurs, we will notify you and any competent authority where and as the law requires, without undue delay. We are likewise not responsible for the security or data practices of Twitch, Steam, blockchain networks, or any other third party you choose to connect or interact with through Dropzona.

International users

Dropzona may process and store data in countries other than where you live, including the United States. Where required, we rely on appropriate safeguards for such transfers. Depending on where you live (for example under GDPR or CCPA), you may have rights to access, correct, delete, or port your data, or to object to certain processing; contact us via our support page to exercise them. We do not sell your personal information.

Your rights & California privacy

Depending on where you live (for example under the GDPR/UK GDPR or the California CCPA/CPRA), you may have the right to access, correct, delete, or port your data, to object to or restrict certain processing, to withdraw consent, and to complain to your data-protection authority. California residents may also ask what categories of personal information we collect and opt out of any sale or sharing. We do not sell or share your personal information, and we will not discriminate against you for exercising a right.

To exercise a right, contact us via our support page or at hello@dropzona.tv. We may need to verify your identity, will respond free of charge within the time the law requires (generally 30 days under the GDPR, 45 days under the CCPA), and note that data written to public blockchains cannot be edited or erased.

Children

Dropzona is not directed to children. You must meet the minimum age required by Twitch and Steam (and any higher local minimum), and you must be at least 18 — or the age of majority where you live — to fund, top up, or withdraw a balance. We do not knowingly collect data from children under 13 (or under 16 in the EEA/UK); if you believe a child has given us data, contact us at hello@dropzona.tv and we will delete it.

Contact

Questions about this policy, or want to exercise your rights? Visit our support page or email hello@dropzona.tv. Dropzona is the controller of the personal data described here.