1. Introduction

This Privacy Policy explains how MassDrop ("the App", "we", "our") collects, uses, and protects your information when you use our iOS application. By using MassDrop, you agree to the practices described in this policy.

MassDrop is an independent app and is not affiliated with, endorsed by, or sponsored by Google LLC or YouTube.

---

2. Information We Collect

2.1 Google Account Information

When you sign in with your Google account, the App receives basic profile information provided by Google, including:

• Your Google account email address
• Your display name
• Your profile picture URL

This information is used solely to identify your session within the App and is never sold or shared with third parties.

2.2 YouTube Subscription Data

To provide its core functionality, the App accesses your YouTube subscription list via the YouTube Data API. This data is:

• Fetched on demand to display your subscriptions
• Used only to perform unsubscribe actions you explicitly request
• Never stored on our servers beyond the duration of your active session

2.3 Authentication Tokens

To keep you signed in securely:

• On your device: App-issued JSON Web Tokens (JWTs) are stored in your iOS Keychain with device-only protection and no iCloud backup.
• On our server: Google OAuth tokens (access and refresh tokens) are stored server-side, encrypted at rest using AES-256-GCM. These tokens are never transmitted to third parties and are used exclusively to call the YouTube Data API on your behalf.

2.4 Information We Do NOT Collect

We do not collect:

• Browsing history or activity outside the App
• Location data
• Device identifiers for advertising purposes
• Any data for analytics, profiling, or marketing

---

3. How We Use Your Information

We use the information described above exclusively to:

• Authenticate you securely via Google OAuth 2.0
• Retrieve and display your YouTube subscription list
• Process unsubscribe actions you choose to perform
• Maintain your session and rotate authentication tokens securely

We do not use your information for advertising, profiling, or any purpose beyond the core functionality of the App.

---

4. How We Share Your Information

We do not sell, rent, or share your personal information with any third parties, except:

• Google LLC: The App communicates with Google's OAuth 2.0 and YouTube Data API services. Your use of these services is subject to Google's Privacy Policy.
• Legal requirements: We may disclose information if required by law or to protect our legal rights.

---

5. Data Retention

• Server-side tokens are retained as long as your account is active within the App. Tokens are invalidated and deleted when you sign out.
• Device-side tokens are removed from the Keychain when you sign out or delete the App.
• We do not retain YouTube subscription data after your session ends.

---

6. Security

We take reasonable technical measures to protect your information:

• Google OAuth tokens are encrypted at rest with AES-256-GCM
• App JWTs use short expiry windows (access tokens: 15 minutes; refresh tokens: 7 days with rotation)
• Refresh token reuse triggers automatic revocation of your entire token family to prevent replay attacks
• All communication between the App and our backend is over HTTPS

Despite these measures, no system is completely secure. We encourage you to use a strong Google account password and enable two-factor authentication on your Google account.

---

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Delete your data by signing out of the App (which invalidates all server-side tokens) or by contacting us
• Withdraw consent by uninstalling the App and revoking MassDrop's access in your Google Account permissions

To revoke the App's access to your Google account at any time, visit your Google Account security settings and remove MassDrop from authorized applications.

---

8. Children's Privacy

The App is not directed to children under the age of 14 (or the applicable minimum age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

---

9. Third-Party Services

The App integrates with the following third-party services, each governed by their own privacy policies:

Service	Purpose	Privacy Policy
Google OAuth 2.0	Authentication	Google Privacy Policy
YouTube Data API	Subscription management	Google Privacy Policy
Apple App Store	Distribution & payment	Apple Privacy Policy

---

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this document. Continued use of the App after any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

---

11. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact:

Developer: info@frozenfoot.net
App: MassDrop

YouTube is a trademark of Google LLC. This app is not affiliated with or endorsed by Google LLC or YouTube.