1. Overview
CoinDrop ("we", "us", "our") is a Solana-based engagement rewards platform operated by Illy Robotic Instruments. This Privacy Policy describes how we collect, store, process, and protect information about you when you use our website at coindrop.in, our mobile application, or any related services (collectively, the "Platform").
By registering for or using CoinDrop, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Platform.
2. Data We Collect
We collect only the information necessary to operate the Platform and pay your earnings.
Account Information:
- Display name (chosen by you)
- Email address
- Password (stored as a bcrypt hash — never in plaintext)
- Country of residence
- Solana wallet address (Phantom or any SPL-compatible wallet)
Activity Data:
- Task completion records (type, timestamp, reward amount)
- Total tasks completed and SOL earned
- Subscription/follow records for residual payout tracking
- Prestige badge status and award date
Technical Data:
- IP address (used for fraud detection and geographic compliance)
- Device type, browser, and operating system
- Session tokens (stored in localStorage, not linked to browsing history)
We do not collect Social Security numbers, government IDs, payment card numbers, or sensitive biometric data.
3. AES-256 Encryption & Security
AES-256 Encryption Standard
All sensitive user data stored in our database is encrypted at rest using AES-256 (Advanced Encryption Standard with 256-bit keys) — the same encryption standard used by the U.S. government for top-secret classified information and trusted by global financial institutions.
- Encryption keys are stored separately from the encrypted data
- Keys are rotated on a scheduled basis and never committed to version control
- Wallet addresses are stored encrypted and only decrypted server-side during payout processing
- Email addresses are encrypted at rest; only hashed values are used for lookup queries
Transport Security
All data in transit between your device and our servers is protected by TLS 1.2 / TLS 1.3 (Transport Layer Security). HTTP connections are automatically redirected to HTTPS. Our Android app enforces HTTPS-only connections via a network security configuration that explicitly disables cleartext traffic.
Authentication & Credential Security
- Passwords are hashed with bcrypt (cost factor 12) before storage — we cannot retrieve your original password
- Session tokens are cryptographically random, time-limited, and invalidated on logout
- Firebase Authentication handles identity verification with industry-standard token flows (JWT)
- Admin endpoints require elevated authentication separate from standard user sessions
Infrastructure Security
- Backend API hosted on Railway with isolated container environments
- Database hosted on Google Cloud Firestore with IAM-based access control
- No third-party scripts have access to your account data or wallet address
- Rate limiting and fraud detection are applied to all task submission endpoints
- Signing keys for our Android app are stored offline and never committed to any repository
4. How We Use Your Data
- Service delivery — processing task completions, calculating rewards, and sending SOL payouts to your wallet
- Account management — verifying your identity, managing your session, and responding to support requests
- Leaderboards — displaying your display name, task count, and earnings on the public leaderboard (you can request removal)
- Fraud prevention — detecting duplicate accounts, bot submissions, and abuse patterns
- Platform improvement — aggregate usage analytics to improve task availability and performance
- Communications — sending badge notifications, payout confirmations, and important platform updates to your registered email
We do not sell your personal data. We do not use your data for advertising targeting or share it with data brokers.
5. Data Sharing
We share your data only in the following limited circumstances:
- Solana blockchain — your wallet address and payout transaction are recorded on the public Solana blockchain. This is inherent to cryptocurrency payments and cannot be made private.
- Service providers — Google Firebase (database and authentication), Railway (API hosting), and Google Analytics (aggregated, anonymized usage data). Each provider is bound by their own privacy and security commitments.
- Legal requirements — we may disclose data if required by law, court order, or to protect the rights and safety of CoinDrop users.
No other third parties receive your personal data.
6. Blockchain & Wallet Data
CoinDrop pays earnings in SOL directly to your Phantom or compatible Solana wallet. Please be aware:
- Blockchain transactions are public and permanent by nature. Your wallet address and any transactions sent to it are visible on the Solana blockchain explorer.
- We store your wallet address encrypted in our database, but once a payout is broadcast to the blockchain it is irreversible and publicly visible.
- We never have custody of your wallet's private keys. You control your wallet entirely.
7. Data Retention
We retain your account data for as long as your account is active or as needed to provide the Platform. If you request account deletion:
- Your personal information (name, email, wallet address) will be permanently deleted within 30 days
- Task completion records may be retained in anonymized, aggregated form for analytics
- Blockchain transaction records cannot be deleted as they are recorded on the public Solana ledger
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate or incomplete data
- Deletion — request deletion of your account and associated personal data
- Portability — receive your data in a machine-readable format
- Objection — object to certain processing activities
- Leaderboard opt-out — request removal of your display name from public leaderboards
To exercise any of these rights, email us at support@illyrobotic-ai.com. We will respond within 30 days.
9. Cookies & Analytics
CoinDrop uses the following cookies and tracking technologies:
- Essential cookies — session management and authentication. Required for the Platform to function.
- Google Analytics (GA4) — anonymized, aggregated usage data (page views, session duration). IP addresses are anonymized before processing. You may opt out via the Google Analytics Opt-out Browser Add-on.
- localStorage — your session token and UI preferences are stored locally on your device, not transmitted to advertising networks.
We do not use third-party advertising cookies or behavioral tracking pixels.
10. Children's Privacy
CoinDrop is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child has registered on our Platform, contact us at support@illyrobotic-ai.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page and, for material changes, send a notification to your registered email address. Continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.