Privacy policy

Last updated October 11, 2026

RiffDrop is a small multitrack recorder in the browser: you record an idea as a Drop, send its link, and friends add layers. This page explains what data RiffDrop handles and why. Questions: contact@nightlybuildaudio.com.

The short version

• Recordings are stored in the Drop creator's own Google Drive, not on RiffDrop's servers.
• RiffDrop can only see the files it created in your Drive.
• No ads, no analytics, no tracking. We never sell data.

If you sign in with Google (to create Drops)

When you sign in, Google shares with RiffDrop your Google account ID, name and email address, plus permission to create and manage the files RiffDrop itself creates in your Google Drive (the drive.file permission). RiffDrop can't see or open any other files in your Drive.

We use this to:

• recognise you when you come back and list your Drops;
• show your name as the author of your takes to people who have a Drop's link (your email address is never shown to them);
• create a "RiffDrop" folder in your Drive and save recordings there: yours, and the ones collaborators add to your Drops;
• make each recording playable by anyone with its file link, so collaborators' browsers can play it. Those file links are only given to people who have the Drop's link, and folders are never shared.

Google's access tokens are encrypted before they are stored and are only used by our server to work with your Drops in Google Drive. They are never sent to anyone else.

If you open a Drop link (to collaborate)

You don't need an account. If you type a name, it's saved with your takes and shown to others in that Drop. Your recordings go straight from your browser into the Drop creator's Google Drive and become part of their Drop; the creator can delete them.

What we store

On Amazon Web Services, in the United States:

• the account details above, with the Google tokens encrypted;
• Drop details: names, tempo, tracks, where each clip sits on the timeline, references to the audio files in Google Drive, waveform overviews, and a scrambled (hashed) form of each Drop link's secret;
• sign-in sessions for creators, and short-lived upload tickets, which are deleted automatically.

The audio itself stays in Google Drive.

Cookies and browser storage

• Creators get a sign-in cookie that lasts 30 days, plus a short-lived one during Google sign-in. There are no advertising or analytics cookies.
• Your browser keeps, on your device only: the links of Drops you've created or opened (so you can come back and share them), the name you type for your takes, and settings such as metronome and zoom.

IP addresses and logs

Your IP address is used briefly to limit abuse (rate limits) and isn't stored by RiffDrop. Our server logs record errors, never the contents of requests or Drop links.

Who else is involved

• Google: sign-in and Drive storage, under Google's privacy policy.
• Amazon Web Services: hosting.

We don't share your data with anyone else, and we don't sell it.

Google user data

RiffDrop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is only used to provide the RiffDrop features described above. It isn't used for advertising, isn't sold, and isn't read by people, except when you ask us for help, for security reasons, or when the law requires it.

Your choices

• Delete recordings: a Drop's creator can delete clips in the Drop, or delete the files from their Google Drive.
• Stop RiffDrop's access to your Drive at any time at myaccount.google.com/permissions. Existing Drops stay playable, but nobody can add takes until you sign in again.
• Delete your account and Drops: email contact@nightlybuildaudio.com and we'll delete your data from our servers. The files in your Drive are yours: delete the "RiffDrop" folder whenever you like.

Children

RiffDrop isn't intended for children under 13.

Changes

If this policy changes, we'll update this page and the date at the top.