Legal

Cookies and browser storage

This site and the dashboard store only what they need to work. There are no analytics, advertising or other third-party tracking scripts, so there's nothing to accept and no cookie banner.

Effective 27 October 2026 · Dropp Services Private Limited (CIN U62099HR2026PTC146867)

1. On this website and the dashboard

Name	Type	What it's for	How long
dl_session	Cookie (HTTP-only, secure)	Keeps you signed in to the dashboard. Page scripts can't read it.	Until you sign out, at most 7 days
theme	Local storage	Remembers light or dark mode.	Until you clear it
dropplink.ui	Local storage	Remembers whether the sidebar is collapsed.	Until you clear it
dropplink.workspace	Local storage	Remembers which app you last looked at.	Until you clear it

All of these are strictly necessary or remember a choice you made, so they don't need consent. When you pay for a plan, our payment provider, Razorpay, opens its payment window and may set its own cookies under its own policy; nothing from Razorpay loads before that.

2. On brands' websites (our website SDK)

Brands that use Dropplink on their websites load our script from their own link domain, so everything it stores is first-party to the brand's site. The brand decides whether to use it and is responsible for asking visitors for consent where the law requires it.

Cookies

Name	What it's for	How long
dropp_vid	A random visitor id, so the brand's server can credit an order to the link that brought the visitor.	395 days
dropp_click_id	The Dropplink click the visitor first arrived from.	30 days

Local storage

Name	What it's for
dl_vid	The same visitor id as dropp_vid.
dl_sess	The current visit: its id, when it was last active, and the click it started from. A visit ends after 30 minutes without activity.
dl_click	The first Dropplink click, kept for 30 days.
dl_q	Events waiting to be sent, kept for at most 24 hours.
dl_uid	The brand's own user id for a signed-in visitor, if the brand calls identify.
dl_consent	The visitor's consent answer, when the brand uses consent mode.

Consent mode and opt-outs

With consent: 'required', no visitor id is created and nothing else is stored or sent until the brand calls dropplink.grant() from its cookie banner. dropplink.revoke() deletes everything above and both cookies.
When a visitor arrives from a Dropplink link before choosing, the click id is held in memory only. grant() saves it (dl_click and dropp_click_id) so a later order can still be credited to the link.
If the browser sends Global Privacy Control, the script stores and sends nothing, and grant() can't override it.

3. In brands' apps (our app SDKs)

Apps don't use cookies. Our Android and iOS SDKs keep a small file on the device with the install id, the attribution result, whether tracking is turned on, and events waiting to be sent. It's deleted when the app is uninstalled, and on Android it's left out of device backups.

Brands: the consent setup for each platform is in the dashboard's SDK setup page, and your responsibilities are in section 5 of the terms.