What Drift stores

• Drift keeps your email address, the trails you save, your likes and dislikes and the interests they build, your settings, and, if you choose one, a handle plus your friends and anything shared between you.
• It keeps them because that is the service you asked for, not because you consented to anything. That is a deliberate choice: it means there is nothing here you have to keep agreeing to.
• There is no advertising, no analytics, no tracking, and no profiling for anyone else's benefit. Nothing is sold. Nothing is shared except with the companies that run the servers.
• You can download everything Drift holds about you as one file, at any time, from your account page, and delete all of it from the same place.
• If something is wrong, write to us. If we do not put it right, you can complain to the Dutch data protection authority.

The rest of this page is the detail behind those five lines.

The controller of the personal data described here is Thomas van der Hulst, trading as Usedrift, at Uilenstede 138, 1183 AN Amstelveen, Netherlands, registered with the Dutch Chamber of Commerce under number 90992318. Being the controller means deciding what is collected and why, and being the one answerable for it. Drift is run by one person; there is no company and no team.

You can reach them through the contact form or at contact@usedrift.org, which is also the published point of contact under the Digital Services Act. The legal notice has the full details.

No data protection officer is appointed. Drift does not meet any of the conditions in Article 37 GDPR that would require one: it is not a public authority, monitoring people is not its core activity, and it does not process special categories of data.

Every row below names the ground in the GDPR that allows it. Almost all of them are the same one: Article 6(1)(b), performing the contract you entered into by accepting the terms and creating an account. Two are Article 6(1)(f), a legitimate interest, and those say what the interest is.

Drift runs on other people's computers, so a handful of companies handle some of this data in the course of running the service. They process it on our instructions and for no purpose of their own.

• Vercel Inc. Hosting and the content network that serves the app.
• Supabase Inc. The database that holds your account, trails, reactions, interests, settings, handle, friends and shares, and the authentication that signs you in.
• Resend (Plus Five Five, Inc.). Sends the emails listed above.
• Stripe Payments Europe, Ltd. Only if you buy the supporter unlock. Stripe takes the payment on its own pages and tells us that it succeeded. It receives what a payment needs (your email address, your billing country, and your card or bank details, which never pass through Drift), and it is a controller in its own right for the fraud checks and record keeping the law requires of it.
• Cloudflare, Inc. The bot check on the contact form, which receives your IP address, and the routing of email sent to the address above.
• Google Ireland Limited. Only if you choose to sign in that way. In that case the provider tells us your email address and confirms it is yours, and knows that you signed in to Drift. Signing in with an email and password instead avoids this entirely.

That is the complete list. Nothing is sold, nothing goes to an advertising network, and there is no analytics provider of any kind.

The companies above are American, and although they run European infrastructure, some data can reach the United States. Where it does, the transfer rests on one of two things: the European Commission's adequacy decision of 10 July 2023 for the EU and US Data Privacy Framework, where the recipient is certified under that framework, or otherwise the European Commission's Standard Contractual Clauses, which form part of each provider's own terms.

You can ask which of the two applies to a particular provider, and for a copy of it, by writing to us.

Drift sets no browser cookies at all. No tracking cookies, no advertising, no third-party analytics. There is nothing of ours that follows you around the web, and therefore nothing to opt out of.

Some cookies arrive anyway, and they are not ours. Card pictures are loaded straight from the source rather than copied onto our servers. When your browser asks Wikimedia for an article image, or The Metropolitan Museum of Art for an artwork, each sets a cookie of its own on its own domain, and the museum also learns your IP address the way any site you load an image from does. Drift cannot read those cookies, is not sent them, and gets nothing from them. They only appear once you are reading cards; the public pages of this site set nothing at all.

To work at all it does keep a few things in your browser's own storage: a sign-in token so you stay logged in, your trails and settings so the app works offline, and small preferences like dark mode. All of those are things you asked for by using Drift, which is what Article 11.7a of the Telecommunicatiewet calls strictly necessary, so none of them needs your consent.

Drift shows no advertising and loads nothing from an advertising network. If that changes, this page will be updated first, and you will be asked before anything from an advertiser loads.

• See it and take it with you. Download your data gives you one file with everything Drift holds about you, in a format any program can read. That covers both your right of access (Article 15) and your right to portability (Article 20), and you never have to ask.
• Correct it. Your handle, display name and settings you can change yourself. For anything else, write and it will be fixed (Article 16).
• Delete it. Delete account removes your account and everything attached to it, permanently and without having to ask anyone (Article 17).
• Object, or ask us to pause. You can object to anything done on the basis of a legitimate interest, which here means only the spam checks on the contact form (Article 21), and you can ask us to restrict a use while a disagreement is sorted out (Article 18).
• Withdraw consent. Nothing on Drift currently runs on consent, so there is nothing to withdraw. If advertising is introduced it will run on consent alone, and withdrawing it will be as easy as giving it.
• Complain. If you think Drift is handling your data wrongly, tell us first, but you do not have to. You can go straight to the Autoriteit Persoonsgegevens, the Dutch supervisory authority, or to the authority in the EU country where you live or work.

Whatever you ask for, you get an answer within one month, which is what Article 12(3) allows.

No law requires you to give Drift anything. Your email address is a contractual requirement: it is how you sign in, so without one there is no account and no way to use the hosted app. There is no other consequence, because there is nothing else Drift asks for. A name, a handle and a display name are all optional, and Drift works fully without them.

There are none. Nothing about your account is decided automatically, and there is no profiling of the kind Article 22 GDPR is about. The interests model orders your own cards for you and has no other effect: it cannot restrict your account, it is never shown to anyone else, and it is not used to target anything at you. Every decision that affects your account, including anything following a report, is made by a person. The terms set that out.

Drift is not intended for people under 16 and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, tell us and it will be deleted.

The cards themselves are made from openly licensed human knowledge: Wikipedia articles, under CC BY-SA 4.0, and public-domain artworks from The Metropolitan Museum of Art, under CC0 1.0. Every card links to the page it came from, whose history credits the people who wrote it, and every image carries its own creator and licence. Drift only reshapes that content into cards and threads. It never invents facts. Sources has the full account.

Changes are published here with a new date at the top. If a change is significant, it will be sent to the email address on your account before it takes effect.