Privacy Policy

What we collect, why, how long we keep it, and who else sees it. In force from 11 August 2026.

Hash Media operates Hashdrop and is the data controller for the information described here. This policy covers the Service itself; it does not cover the applications our customers distribute through it, which are their responsibility.

What we collect

Data	Why	Kept for
Name, email, password hash	To create and secure your account	While the account exists
Organisation name and branding	To run your workspace and any white-label portal	While the organisation exists
Build files and their metadata	To distribute them to the people you choose	90 days, except the newest build on each channel
Install events: time, IP address, user agent	To show you who installed what, and to deduplicate counts	12 months
Device UDID, model and name (iOS)	Ad Hoc distribution needs the UDID in the provisioning profile	Until you delete the device
Feedback, including screenshots	To pass a tester's report to the team that can act on it	Until deleted by the organisation
Payment records	Billing and statutory accounting	As required by Indian tax law

We do not use advertising trackers, we do not sell personal data, and we do not profile anyone.

Where it lives

On servers we operate, in one place. Backups run nightly and are verified by restoring them into a scratch database and comparing row counts, so a backup that would not restore is noticed the same night. They are compressed but not encrypted at rest, and are kept for 30 days.

Who else sees it

People in your organisation, according to their role
Our email provider, to deliver invitations, password resets and notifications
Our hosting provider, which stores the data at rest
A payment provider, when paid plans are enabled, which handles card details directly — we never see or store them
Law enforcement, where we are legally required to disclose

Testers and device enrolment

If you enrol a device, the organisation running that project receives its UDID, model and name. If you install a build, the organisation that published it sees that an install happened, when, and from what IP address. That is how the product works, and the organisation distributing to you is responsible for telling you so.

Your rights

You may ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to info@hashmedia.in. We answer within 30 days. Where an organisation you belong to controls the data, we will pass the request to them.

Cookies

One cookie, holding your sign-in session. It is httpOnly, restricted to this site, and lasts 30 days. There are no analytics or advertising cookies, which is why you are not being asked to consent to any.

Children

The Service is for professional use and is not directed at anyone under 18.

Changes and contact

Material changes are notified to organisation owners by email. For anything about this policy: info@hashmedia.in, or Hash Media, 803, Krishna Beacon, Near Tragad Tunnel, Off S.P. Ring Road, Near Vaishnodevi Circle, Ahmedabad, Gujarat, India — 382470.