Back to home

Privacy Policy

Version 2026-05-22 · Last updated 22 May 2026

This Privacy Policy explains how Individual Entrepreneur Oleksandr Zakora (identification number 300373370, registered with the LEPL National Agency of Public Registry in Georgia on 25 October 2023, with legal address at Ts. Dadiani str N34, building 7, commercial space N10, Nadzaladevi district, Tbilisi, Georgia) - operating the droneshow.store service (the "Service") - collects, uses, stores, and protects personal data of its users ("you").

For the purposes of this Policy, "we", "us", and "our" refer to the controller named above. We comply with the Georgian Law of Georgia on Personal Data Protection and, where applicable, the EU General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. What data we collect

We collect only the data necessary to operate the Service:

  • Account data: your email address, display name and studio name (both optional and editable by you), a hashed password (Argon2id - we never store or see the plaintext), and the role assigned to your account.
  • Usage data: the projects, animations, cameras, comments, basemap tiles, and audio files you upload or create; their sizes, formats, and metadata; and timestamps of when they were created or modified.
  • Authentication data: active session identifiers (opaque random tokens stored in HTTP-only cookies), the IP address and user-agent string captured when each session was created, and the timestamp of your last activity.
  • Security / audit data: an append-only log of write-side actions on your account (login, password change, project create, etc.) together with the IP address from which they originated. This log exists to help us investigate suspected misuse.
  • Consent data: the timestamp and IP address at which you accepted these Terms and Privacy Policy, and (if applicable) at which you opted in to marketing email.
  • Rate-limit / anti-abuse data: short-lived in-memory counters of recent signup, login, and comment attempts per IP, used to drive the CAPTCHA challenge. No persistent storage.

We do not collect special categories of personal data (Art. 9 GDPR - health, biometric, political opinion, etc.). We do not knowingly collect data from children under 16; if you are under that age, do not use the Service.

2. Why we use your data, and our legal basis

  • To provide the Service (account data, usage data, authentication data). Legal basis: performance of a contract - you cannot use the Service without an account, and we cannot operate the account without these data.
  • To protect against fraud and abuse (security / audit data, rate-limit data). Legal basis: legitimate interest - keeping the Service available and protecting all users from a small number of bad actors.
  • To prove your consent if a question is ever raised (consent data). Legal basis: legal obligation under GDPR Art. 7(1).
  • To send transactional email (password resets, account notifications, magic-link setup). Legal basis: performance of a contract. You cannot opt out of these emails while your account is active - without them you cannot recover the account.
  • To send marketing email (product updates, occasional newsletters), only if you have ticked the optional opt-in. Legal basis: consent. You can withdraw consent any time via the unsubscribe link in every marketing email or via the toggle on your account page.

3. Who we share your data with

We do not sell your personal data. We share it only with the following categories of processors, strictly as needed to operate the Service:

  • Google LLC (Google Workspace), Mountain View, California, USA - handles outbound email from no-reply@droneshow.store via SMTP. Data shared: your email address and the content of any system email sent to you. Transferred under the EU-US Data Privacy Framework.
  • Cloudflare, Inc., San Francisco, USA - provides the Turnstile CAPTCHA service used to gate signup, login, password-reset, and share-comment forms. Data shared: your IP address and a Turnstile token at the moment a challenge is solved. Transferred under Standard Contractual Clauses.
  • Our hosting and infrastructure providers - currently a virtual private server we directly control. We do not run analytics, advertising, or any third-party scripts on the application interface.

If we ever need to add a processor outside this list (for example, switching SMTP providers), we will update this document and bump its version number - your prior consent will be invalidated and you will be re-prompted to accept the updated Policy on your next login.

4. How long we keep your data

  • Account, usage, and authentication data are retained for as long as your account exists, and deleted within 30 days of account deletion.
  • Audit log entries are kept for two years from the date of the event, then automatically purged. They are not deleted by account deletion (we keep them so we can investigate the deletion itself if necessary), but become orphaned - the linked user_id is set to NULL.
  • Consent records are kept for as long as your account exists, plus one year after deletion as proof of the opt-in's lifecycle.
  • Session cookies expire 8 hours after issuance. Expired sessions are pruned by the next login.
  • Rate-limit counters are in-memory only and reset on every server restart.

5. Your rights

Under Georgian PDP Law and (where applicable) GDPR you have the right to:

  • Access the data we hold about you.
  • Rectify data that is inaccurate or incomplete - the display name and studio name are editable from your account page; for anything else, email us.
  • Erase your account and all associated files. While we are in alpha, self-service deletion is not yet available; email us at contact@droneshow.store from the address registered on your account and we will complete the deletion within 30 days.
  • Restrict or object to certain processing (in particular, opt out of marketing email at any time).
  • Portability - request a machine-readable export of your data.
  • Withdraw consent for marketing email at any time via the unsubscribe link in the email footer or via your account page.
  • Lodge a complaint with a supervisory authority: in Georgia, the Personal Data Protection Service (personaldata.ge); in the EU, your local Data Protection Authority.

To exercise any of these rights, email contact@droneshow.store from the address registered on your account. We will respond within 30 days. Verification of your identity may be required if the request is sent from an unrelated email.

6. Security

We protect your data with the following measures:

  • Passwords stored as Argon2id hashes - even our database administrator cannot read them.
  • Magic-link tokens for password setup and reset are single-use, 256 bits of entropy, with a one-hour time-to-live.
  • Session cookies are HTTP-only, Secure (HTTPS only in production), and SameSite=Lax.
  • All traffic between your browser and our servers is encrypted with TLS 1.2 or higher.
  • Rate limiting and CAPTCHA (Cloudflare Turnstile) gate authentication and public write endpoints.
  • Append-only audit log of write actions for forensic review.

No system is perfectly secure. If we discover a breach that exposed your personal data and that is likely to result in a risk to your rights and freedoms, we will notify you and the appropriate supervisory authority within 72 hours of becoming aware, as required by GDPR Art. 33.

7. Cookies

We use a single cookie, named ds_session, to maintain your authenticated session. It is strictly necessary for the Service to function and is exempt from the consent requirement of the ePrivacy Directive (2002/58/EC). We do not use analytics, advertising, or tracking cookies.

8. International transfers

Our primary hosting is in Georgia (a non-EU country) and some of our processors (Google, Cloudflare) operate in the United States. Where personal data is transferred outside the European Economic Area, we rely on the EU-US Data Privacy Framework, Standard Contractual Clauses, or equivalent safeguards. Copies are available on request.

9. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated via an email to the address registered on your account, and via a banner inside the application prompting you to review and re-accept on your next login. The current version and last-updated date are shown at the top of this page. Continued use of the Service after acceptance constitutes agreement to the updated Policy.

10. Contact

For any privacy-related question, request, or complaint, contact us at contact@droneshow.store. We respond within 30 days. Postal address: Ts. Dadiani str N34, building 7, commercial space N10, Nadzaladevi district, Tbilisi, Georgia.