Privacy Policy

Driftbottle is a location-based app where you drop and find virtual "message bottles" at real places. This policy explains what data we collect, how we use it, who can see it, how long we keep it, and who we share it with.

This is a plain-language summary, not a substitute for legal advice. If you have questions about your rights under a specific law (GDPR, CCPA, etc.), contact us at the address below. If you're in the EU, the EEA or the UK, there's a section of your own near the end: If you're in the EU, the EEA or the UK.

Who operates Driftbottle

Driftbottle is operated by Cipher Haus, LLC, a Delaware limited liability company ("we", "us"), the party responsible for the data described here — in data protection law, the controller. You can reach us at [email protected], or by post at 2958 S Victoria Ave, Los Angeles, CA 90016, United States.

Information we collect

• Account information: username, email address, and password (stored as a salted hash — we never store or can see your actual password), plus when you accepted our Terms and Privacy Policy at sign-up. If you turn on two-factor authentication, we store your authenticator secret encrypted, and only hashed copies of your recovery codes.
• Your birth month and year, at sign-up only: sign-up asks for the month and year you were born, only to check you're old enough (see Children's privacy). We don't store them.
• An age range from the app store, when one is shared: Apple's App Store and Google Play can tell the app the age range of the account it was installed from. We use it only to check you're old enough, and what we store is whether you cleared that check — never the range itself (see Children's privacy).
• Precise location: the app uses your device's precise GPS position to show you the bottles you can pick up where you are, to check you're close enough to pick one up, and to leave a bottle where you are when you drop one. Your position is sent to our server only with the request that needs it, used to answer that request, and then discarded: we don't store your location, and it isn't written to our logs. The one exception is where bottles are — and even then not your exact spot: a bottle you drop, throw back or leave with "Drop here" is kept at an approximate spot, a point within 40 metres of where you left it, and a bottle set to drift records the path it travels from there. Bottles you leave around the same place are all kept the same distance and direction from where you stood, so leaving many there doesn't give away the spot either. Location is core to how the app works and can't be turned off without losing that functionality.
• Messages and other content you create: the messages you put in bottles — voice recordings and text messages — plus photos or drawings used as bottle labels, and bottle names. Your device writes the date and time into each recording; we remove it before the recording is stored.
• Optional profile info: a display name ("bottler name") and any social media handles or links you choose to add.
• Activity: which bottles you've dropped, found, saved, recycled or reported, users you've blocked, your coin balance and bottle inventory, and who referred you (if anyone).
• Server logs: like most online services, our server logs each request it receives: the time, the part of the app requested, and your IP address. These logs do not include your location, messages or passwords.
• Crash reports: if the app crashes or hits an error, we receive a report containing the error details and device/OS information, via our error-monitoring provider (Sentry). Crash reports don't include your location.
• Emails you send us, if you write to support: your email address and what you write.

We do not use advertising trackers, and we do not sell your data.

What other users can see

Driftbottle is a social app, so some of what you create is visible to others:

• Bottles you drop: players near a bottle you dropped see only that there's a bottle they can pick up, with its name and its size — not what's in it, who dropped it, or when. Whoever picks it up sees what's inside (the recording or text message, the label, and any social links you chose to share on it) and who it's from: every bottle shows its dropper's bottler name, or their username if they haven't set one. Your name isn't shown to anyone before a bottle is picked up, and no other player ever sees when you dropped it.
• Bottles you pick up: when you pick up a bottle, its owner only sees that it was found — not who found it or where. The app doesn't show them when, either, though an owner who checks often could notice roughly when it happened. The app tells you this before you pick one up. Only you see when you found it.
• Labels and keepsakes: if you label a bottle you found, whoever picks it up after you sees that label, but not who drew it. The bottle's owner never sees it at all — not the picture, and not that there is one — because a label appearing on their list the moment you drew it would tell them someone had just handled their bottle. A player holding one of your bottles can keep its label as a keepsake, along with the bottler name (or username) and social links the bottle showed; a player who recycles one of your labeled bottles, or picks up a labeled empty one, keeps a labeled bottle with that label in their inventory. You see the labels you put on your own bottles yourself, as you always did.

Never shown to other users: your email address, your password, any location, and when you dropped a bottle. Other players never see coordinates, a map, or how far away a bottle is — not for a bottle you dropped, not where you picked one up, and not where you are. The app only ever tells a player that a bottle is within reach. Driftbottle staff can see where bottles are, and when they were dropped, for moderation (see Moderation).

What the game itself gives away

Driftbottle is played at real places, so even without coordinates, some things can be worked out from it:

• To see or pick up a bottle, you have to be within its pickup radius (50 to 100 metres) of where it's kept, which is up to 40 metres from where it was dropped. So someone who picks up a bottle you dropped, and sees your name, can tell you were within about 140 metres of where they are at some point (unless it has drifted, or been thrown back, since). The app doesn't tell them when — but a bottle can be found as soon as it's dropped, so someone who finds yours soon after you left it could guess you'd been there recently.
• The owner of a bottle knows roughly where they left it, so when they see it's been found, they know someone was near there at some point since — though not who. The app doesn't show them when, but if they check often, they could tell roughly when it changed, and if they're nearby, they can see it's no longer there to pick up. A label you draw on their bottle doesn't tell them anything: they never see it.
• A bottle you throw back, or leave with "Drop here", is left near where you are, and whoever picks it up next can tell someone left it there (but not who, or when).
• The app can only go by where a device says it is. Someone who fakes their location (with a modified app, or a faked GPS position) could see and pick up bottles in places they aren't, and by trying many places, could work out roughly where a bottle is kept — but that's never the exact spot it was dropped on, only somewhere within 40 metres of it. Finding many bottles you left around the same place doesn't narrow it down, as they're all kept the same distance and direction from where you stood — though anyone who already knows the precise spot you left one of them on could work out where you left the others around there.

So don't drop bottles near your home, school or anywhere you don't want other players to know you spend time, and think about that before picking one up, too.

How we use your information

• To operate the core gameplay: showing you the bottles you can pick up where you are, checking you're close enough to pick one up, leaving a bottle near where you drop it, and moving drifting bottles.
• To check that you're old enough to use Driftbottle — when you sign up, and again when the app starts if your app store shares an age range.
• To send you sign-in links, password resets, and verification codes by email.
• To keep the service safe: rate limiting, detecting abuse, and investigating and acting on reports.
• To diagnose and fix bugs or crashes.
• To answer you when you contact us.

Moderation

To enforce our Terms, Driftbottle staff can view any bottle's content (including bottles nobody has picked up yet), its location, and the accounts involved, and can remove content or restrict accounts. Staff actions like these are recorded in an internal audit log. Reports you file are shared with staff, not with the person you reported.

When a bottle or a label is reported, we keep a copy of what was reported for our moderators: the recording, text message or picture, the bottle's name, and the username and email address of the account that posted it (and of whoever drew its label). For a reported bottle — not a label — the copy also keeps where it was dropped (the approximate spot it was kept at, as described under Precise location) and when. It keeps nothing about the person who reported it: not where they were, not where the bottle was when they reported it, and not when they picked it up. (To pick a bottle up you have to be within its pickup radius, so someone who reported a bottle they found was once within about 100 metres of where it was kept — unless it had drifted or been thrown back — but the copy doesn't say when.) The copy is kept even if the bottle, the label or the account is deleted afterwards, so that we can act on the report and, for child sexual abuse material, report it to the National Center for Missing & Exploited Children (NCMEC) and other authorities as the law requires. It's deleted automatically one year after the report — or, if we've reported it to NCMEC or the authorities have asked us to keep it, one year after that. See our Child Safety Standards.

Third parties we share data with

We use a small number of service providers to run the app. Each only receives the data it needs to do its job:

• Render — hosts our server and database (all data listed above), including server logs and database backups.
• Cloudflare — sits in front of our server (it sees your IP address and the requests you make, including the position the app sends with them, on their way through) and stores voice recordings and label images (Cloudflare R2).
• Resend — sends sign-in, verification, and account emails (your email address and the email content), and our moderators' alerts when something is reported. An alert carries only the reason chosen and reference numbers for the report and the bottle — not what was reported, who filed it, or any note they added.
• Mailgun — receives email sent to our cipher.haus addresses, including [email protected], and forwards it to our support mailbox (your email address and what you write).
• Google (Gmail) — the mailbox that forwarded mail lands in and that we answer you from. Google holds those messages under its own terms for as long as we keep them.
• Sentry — receives crash/error reports as described above.
• Expo — delivers app updates. When the app checks for an update, Expo receives a random identifier for that installation of the app (not linked to your account, and reset if you reinstall), your device's platform and app version, and your IP address.
• Open-Meteo — provides weather data for drifting bottles. It only receives rounded coordinates (to within about 50 km) of where drifting bottles are, never anything about you.
• OpenStreetMap Foundation — supplies the map tiles for the moderation map, which only Driftbottle staff can open. It receives the square of the world map a staff member is looking at, and that staff member's IP address. It never receives your account, a bottle, or anything in one — but staff open the map to look at reported bottles and to place official ones, so the squares it sees are squares where bottles are. Its tile usage policy says it publishes anonymised, aggregated data about how the tile service is used.

Each of these providers is bound by its agreement with us to protect your data at least as well as this policy describes, and to use it only to provide its service to us. Open-Meteo and the OpenStreetMap Foundation are the exception: they are public services we use under their published usage policies rather than under an agreement of our own, and neither of them receives anything that identifies a player.

One thing that isn't switched on: verifying an account by text message. The app is built to be able to confirm a mobile number by texting a code to it, through a provider called Twilio, which would receive the number and the code and send the message. That feature is off. There's no screen for it in the app, the server turns away every request to it, and we hold no mobile number for anybody — which is why one isn't in Information we collect and Twilio isn't in the list above. It's named here because it's in the app's code rather than only on a plan. If we ever switch it on, a number will be added to what we collect and Twilio to the providers above, the app stores will be told before it ships, and the date at the top of this page will change — before a single number is taken.

We don't share your data with anyone else, and we don't sell it. We may disclose information if required by law — including reporting child sexual abuse material to NCMEC, as described under Moderation.

Data retention

• Your account and bottles are kept until you delete your account. Bottles you recycle are hidden from everyone else but stay in our database until then.
• Drift paths are kept for up to 180 days, or 30 days once the bottle has been picked up or recycled; each bottle's original drop location is kept for as long as the bottle exists.
• Your location isn't kept at all (see Precise location). Where your bottles are — an approximate spot near where you left each one — is kept as long as the bottles are.
• The age check on your account — whether it cleared, and when it was last checked — is kept for as long as the account is. The age range your app store sent isn't kept at all.
• Sign-in sessions, email links, and verification codes are deleted automatically once they expire, and records of recent sign-in attempts (kept to stop password guessing, and which can include your email address) within a few days.
• Reported content: the copy we keep of something that was reported is deleted one year after the report, or one year after we reported it to NCMEC or the authorities asked us to keep it (see Moderation).
• Server logs are kept by our hosting provider, Render, for no more than 30 days.
• Crash reports are deleted by Sentry automatically within 90 days.
• Database backups: our hosting provider, Render, keeps backups of our database for up to 7 days, so anything deleted from Driftbottle can remain in those backups for up to 7 days before they expire. We only use them to recover from a failure.
• Emails we send (sign-in links, codes and account notices to you, and report alerts to our moderators) are kept by our email provider, Resend, for up to 30 days.
• Emails you send us pass through Mailgun, which keeps records of them for up to 30 days. In our support mailbox we keep them only as long as we need them to handle your request and keep a record of it.
• After you delete your account, we keep only what we need as a record: reports you filed or that concern your content, our internal log of the actions staff took on them and on your account (if we delete your account for you, including when you ask by email, that entry notes its username), records of any purchases (for accounting and refund handling), and anything the law requires us to preserve. These records aren't deleted on a fixed schedule; we keep them only as long as we need them for safety, legal or accounting reasons. The copy of anything of yours that was reported is kept for the year described above. Copies of your labels that other players already kept stay with them (see Deleting your account).

Deleting your account

You can delete your account at any time in the app: tap the account icon at the top right, then Account › Danger Zone › Delete Account, and confirm with your password. If you can't use the app, email us at [email protected] from your account's email address and we'll delete it within 30 days, once we've confirmed the account is yours.

Deleting your account immediately deletes your account details and everything that's only yours: the bottles you dropped (including their recordings, text messages and labels), your keepsakes and inventory, and the labels you drew on other players' bottles. The recordings and pictures are deleted from our storage at the same time; if our storage provider can't be reached at that moment, we try again every day until they're gone. Bottles from other people that you were still holding go back into the world for someone else to find.

What stays: we don't remove copies of your labels that other players already kept. A keepsake keeps the label together with the bottler name (or username) and social links your bottle showed at the time; a labeled bottle in their inventory keeps the label (and so does any bottle they've dropped with it since). These stay with them until they delete them. The owner of a bottle you found and recycled still sees that it was found (never who found it). A copy of anything of yours that was reported is kept for a year, as described under Moderation, and our database backups expire within 7 days.

Delete your Driftbottle account has the full steps and everything that's deleted and kept.

Your choices and rights

• You can delete your account at any time — see Deleting your account.
• You can block another user from a bottle of theirs you found: neither of you will see the other's bottles after that. You can also block whoever drew a label you were shown: they won't see your bottles after that, and that label is hidden from you — but you may still come across their bottles, because we never tell you who drew a label, and hiding their bottles would. We don't tell anyone they've been blocked, though they may notice that they no longer come across your bottles. You can unblock anyone by tapping the account icon at the top right, then Blocked Bottlers.
• You can request a copy of your data, correction of inaccurate data, or deletion by emailing us at the address below. We'll respond within 30 days.

If you're in the EU, the EEA or the UK

Data protection law there — the GDPR, and the UK GDPR — asks us to tell you a few things this policy doesn't say elsewhere, and gives you rights beyond the three under Your choices and rights. This section is for you.

Who is responsible

Cipher Haus, LLC is the controller of the data described here: the party that decides what is collected and why. The name, email address and postal address are under Who operates Driftbottle. We have not appointed a representative in the EU or the UK under Article 27 of the GDPR (or the UK GDPR); write to us at the address above.

Why we're allowed to use your data

Everything we do with your data has to rest on one of the grounds the law lists. Ours are:

• To give you the app you asked for — your account, the bottles you drop and find, the position that arrives with a request so we can answer it, the emails that sign you in or verify an address, and your coins and inventory. Ground: performing our contract with you, which is our Terms. This is the data the app is made of: without it there's no account and nothing to play, which is why there's no way to switch it off and keep playing.
• To keep the service and the people on it safe — rate limiting, finding and acting on abuse, moderation, the copy we keep of anything reported, and blocks. Ground: our legitimate interest in a service people can use without being harassed or harmed, weighed against the privacy of everyone involved.
• To fix crashes and bugs — the crash and error reports described above. Ground: our legitimate interest in an app that works.
• To answer you when you write to us. Ground: our legitimate interest in answering the mail we're sent.
• To keep under-13s out, and to act on what an app store tells us about a parent or guardian's permission. Ground: our legal obligations towards children, and our legitimate interest in an app used by the people it's meant for.
• To report child sexual abuse material to NCMEC and the authorities, and to keep what the law requires us to keep. Ground: a legal obligation.

We send no marketing or promotional email, and we run no advertising or analytics trackers, so there's nothing here we ask your consent for. Where the ground is a legitimate interest, you can object to it — see Your rights below. Your device separately asks your permission for your location, for recording sound, and for your pictures; that permission belongs to your device and you can take it back in its settings at any time, though the app can't show you bottles without knowing where you are.

How long we keep it

Data retention above lists the period for each kind of data, and those are the periods we actually apply: your account and your bottles until you delete the account, drift paths for 180 days (30 once a bottle has been picked up or recycled), the copy of anything reported for one year after the report, records of recent sign-in attempts for a few days, and our providers' own limits for server logs (30 days), crash reports (90 days) and database backups (7 days).

Where your data goes

Our server and database run in the United States, in Render's Oregon region, and Cloudflare, Resend, Sentry and Expo are United States services too — so data about you is transferred out of the EEA and the UK. Open-Meteo, which receives rounded coordinates and nothing about you, is in Germany. For each of Render, Cloudflare, Resend, Sentry and Expo we rely on the provider's data processing agreement and the European Commission's standard contractual clauses it incorporates (the UK addendum where the UK applies). Email you send to our cipher.haus addresses is received by Mailgun and forwarded to a Google (Gmail) mailbox, both in the United States, under the same kind of terms.

Your rights

You can ask us to:

• give you a copy of the data we hold about you, and tell you what we do with it;
• correct anything that's wrong — your username, bottler name, email address and social links you can change in the app yourself;
• delete your account and its data — which you can also do yourself, in the app, right now: see Deleting your account;
• give you the data you gave us in a portable form, or pass it to another service where that's technically possible;
• pause what we do with your data while we look into a correction or an objection you've made;
• stop something we do on the ground of a legitimate interest above. We'll stop unless we have reasons that outweigh yours — for safety and moderation they usually will, and we'll say so and why.

To use any of these, email [email protected] from the address on your account, so we know it's you. We'll answer within 30 days, and it costs nothing.

Two things are decided automatically rather than by a person: the age check at sign-up and when the app starts, which can turn an account down or stop it working, and the limit that locks an account after too many failed sign-in attempts. Neither one profiles you or targets anything at you, and you can ask a person to look at it by emailing us.

If you think we've got any of this wrong, you can complain to a data protection regulator: in the EEA, the supervisory authority where you live, where you work, or where you think the problem happened; in the UK, the Information Commissioner's Office. We'd rather you wrote to us first, but you don't have to.

Children's privacy

You must be 13 or older to use Driftbottle. Sign-up asks for the month and year you were born and doesn't let anyone younger than 13 create an account. We don't keep what you enter, and we don't keep an account, an email address or anything else you entered for someone it turns away. The app itself remembers on that device, for at least 30 days, that sign-up was turned down (not the month or year entered), so a different date can't simply be tried instead. Driftbottle isn't directed at children under 13, and we don't knowingly collect personal information from them. If we learn that someone under 13 has an account, we delete it and its data; if you believe a child under 13 is using Driftbottle, contact us.

Apple's App Store and Google Play can also tell the app an age range for the account it was installed from. Where that happens, an age range is all we receive — not your birth date, your name, or your store account — and we use it for one thing: checking that you're old enough for a Driftbottle account. We don't keep it. What we store on your account is the answer (old enough, or not) and when it was last checked; we don't keep the range, we don't use it for anything else, and we don't share it with anyone. Not every device or account has this: where the store shares nothing, or you choose not to share it, the birth month and year you enter at sign-up are what decide, exactly as before.

Where a child needs a parent or guardian's permission to use an app, it's the app store that asks for it and records it, not us — Apple and Google hold the family account and its parental controls, and we're never part of that conversation. Our part is to check what the store tells us and to apply the limits your device reports. If a parent withdraws that permission for Driftbottle, Apple tells us, and the account stops working until the store tells us the age again. We can't tell you whether consent was given for any particular account, and we have no way to contact a parent ourselves.

Teenagers can use Driftbottle. If you're under 18, remember that other players are strangers. Whoever picks up a bottle you drop sees your bottler name (or your username), and so can tell you were somewhere near where they found it at some point (they don't see when you dropped it, and a bottle's owner only sees that it was found, not who found it). Choose a username and bottler name that aren't your real name, don't put your name, school, address or other personal details in a bottle or a label, don't drop bottles near your home or school, and talk to a parent or guardian if anything on Driftbottle worries you. Our Child Safety Standards explain how we prevent and respond to child sexual abuse and exploitation.

Security

Passwords are hashed (never stored in plain text), sensitive account secrets are encrypted at rest, all traffic to our servers is encrypted in transit (HTTPS), and recordings and pictures are only served through short-lived signed links.

Changes to this policy

If we make material changes to this policy, we'll update the "last updated" date above.

Contact us

Questions, data requests, or concerns: [email protected]. Help with the app: Support.