Legal # Privacy Policy Effective July 19, 2026 · Last updated August 21, 2026 Kato Drop is a local alerts platform that lets Mankato-area brands send updates ("drops") to people who choose to follow them. It is operated by Lysne Software LLC, a Minnesota limited liability company doing business as Kato Drop — the entity responsible for the personal information described below ("we", "us"). This policy explains what we collect, why, and what your choices are. The short version: we collect what's needed to deliver the alerts you asked for, we don't sell your data, and you can unsubscribe or delete your account at any time. ## What we collect - Account info — your email address, and optionally your name. We do not collect phone numbers from subscribers or brands. Where we do hold a mobile number, it was given to us by its owner to receive texts. - Notification preferences — which brands you follow and which channels (email, push) you've enabled. - Push subscription data — a browser-generated endpoint that lets us send push notifications to your device. It contains no personal details. - Signup context — when you follow a brand we may record the source (e.g. QR code or link), your device type, and an approximate location (city/region) derived from your IP address, so brands can see how followers found them. We do not track your precise location. The lookup runs on our own servers against a local database — your IP address is not sent to any third party for this, and we don't store the IP itself. This product includes GeoLite2 data created by MaxMind, available from [maxmind.com](https://www.maxmind.com). - Engagement — whether alert emails were opened and links clicked, so brands can see how their drops perform. Brands see these as per-drop totals only, never tied to an individual follower. - For brand accounts — business details, the content and photos you post, and tokens for social accounts you choose to connect (Facebook, Instagram, Discord). Payment details are handled entirely by Stripe — we never see or store card numbers. - Messages you send to a business — if you message a brand, we store what you wrote, when, and which brand it was sent to, so both of you can read the conversation later. These are private to you and that brand's team; they are never published, never shown on the brand's public page, and never used to train anything. An automated check runs on every message for hate speech and threats, and anything it catches is not delivered. - Cookies — session cookies to keep you logged in and protect forms from forgery, a 30-day cookie when you arrive through a brand's referral link (so we can credit that brand), and short-lived security cookies set by Cloudflare, which sits in front of the site and separates real visitors from automated traffic. That's the whole list: no analytics cookies, no advertising cookies, and nothing that follows you to other sites — which is why Kato Drop has no cookie banner to click through. Our host measures page traffic for us on its own servers, in aggregate and without cookies or any identifier stored on your device. ## How we use it To deliver the alerts you subscribed to, let brands you follow manage their audience, process brand subscription payments, keep the service secure, and comply with the law. That's it — we don't sell or rent personal information, and we don't use it for third-party advertising. ## Who we share it with - Brands you follow — a brand never sees your email address. Kato Drop sends every alert on their behalf, so what a brand can see is the name or @username you chose (or just an anonymous "Subscriber #" if you gave neither), which channels you've enabled for them and whether your email is confirmed, and how you found them (source, device type, approximate city). Reactions and comments you leave appear under that same name. If you message a brand, they see that name and everything you wrote in that thread — still not your email address, because their reply goes through us. Brands can't export their follower list, and a brand still awaiting verification sees only the anonymous numbers. Beyond that, only service providers who help us run Kato Drop, and only what they need to do their job: - Amazon SES — sends our email alerts. - Stripe — processes brand subscription payments. - Meta / Discord — when a brand connects Facebook, Instagram or Discord, their drops are posted to those platforms on the brand's behalf. Follower data is never shared with them. - Twilio — delivers our text messages. - Hosting providers — our infrastructure and content delivery partners store data on our behalf. - Cloudflare Turnstile — protects our forms (sign-up, subscribe, login) from bots and abuse. Turnstile processes limited technical signals — such as your IP address and browser characteristics — to tell real people from automated traffic, and does not use that data for advertising. See Cloudflare's [Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/). We may also disclose information if required by law, or as part of a business transfer (we'd notify you). ## Your choices - Every alert email includes a one-click unsubscribe link for that brand. - Turn channels on or off any time in your notification settings, or revoke push permission in your browser. - Tracking — there is nothing here to opt out of. We run no analytics or advertising cookies and no third-party trackers, so the only cookies we set are the ones that keep you logged in, credit a referring brand, and keep the site secure. - Approximate location — the city/region estimated from your IP address at signup is not precise location data and we never store the IP itself. If you'd rather we didn't hold it, email us and we'll clear it from your subscription records. - “Use my location” — the directory and the events calendar have an optional button that asks your browser for your position, to work out which part of town you’re in. Your position is compared against a list of area centres *on your own device*, and the only thing sent to us is the name of the area it picked — the same thing you’d have chosen from the dropdown yourself. Your coordinates never reach our servers, are never stored, and never appear in a link you might share. Nothing happens unless you tap it and allow it, and your browser can revoke that permission at any time. - Delete your data — if you have a login, delete your account from your profile page. If you only subscribed by email (no account), the unsubscribe link in any of our emails leads to a one-click "delete all my data" option. Either way your personal information is removed from our systems. ## Connected Facebook & Instagram accounts When a brand connects a Facebook Page or Instagram account so its drops post there, what we store is the page or account id, its name, and an access token that lets us publish on the brand's behalf. Tokens are encrypted at rest. We never receive follower or friend data from Meta, and nothing about your Kato Drop subscriptions is sent to them. You can delete that data at any time, in any of three ways: disconnect the account from the brand's Integrations page in Kato Drop; remove Kato Drop from your Facebook settings, which tells us to delete it automatically; or request deletion directly from Facebook's Apps and Websites settings. Requests are completed immediately, and the last of those returns a confirmation code and a link to a page confirming what was removed. You can also email [hello@katodrop.com](mailto:hello@katodrop.com) and we'll do it by hand. ## SMS Privacy Policy Drops reach followers by email and web push. We also send text messages. We only text a number that its owner gave us for that purpose, confirmed by a consent box they check themselves and that is never pre-ticked. We do not sell or rent mobile numbers, and no mobile information is shared with third parties or affiliates for marketing or promotional purposes. Twilio, our messaging provider, receives a number only to deliver the message. Message frequency varies with the alerts you've chosen, and message and data rates may apply. Reply STOP to any text to stop receiving them, or HELP for help. ## Retention & security We keep your information while your account is active and delete or anonymize it when you delete your account, except records we're required to keep (like payment history). Data is encrypted in transit, and sensitive credentials (like connected social account tokens) are encrypted at rest. Deleting your account deletes your message threads outright — both sides of them, including the brand's replies, because a conversation only exists as a conversation. A brand deleting its account does the same to its side. There is no "delete this one message" button for either of you: the other person keeps their copy of anything already sent, and a button that claimed otherwise would be lying about what happened. ## Children Kato Drop is not directed at children under 13, and we don't knowingly collect their information. ## Changes & contact If we make meaningful changes to this policy we'll update the date above and, for significant changes, notify you by email. Questions or requests about your data: [hello@katodrop.com](mailto:hello@katodrop.com). Lysne Software LLC, d/b/a Kato Drop · PO Box 4451, Mankato, MN 56002 --- - Source: [Kato Drop](https://katodrop.com/) - This page in HTML: https://katodrop.com/privacy - Content-Signal: search=yes, ai-input=yes, ai-train=no (https://katodrop.com/robots.txt)