Privacy Policy

Last updated: July 3, 2026

This Privacy Policy explains how DRock 3D Tools ("DRock," "we," "us," or "our") collects, uses, and shares information when you use the DRock 3D Tools desktop application, the website at drock3d.com, the optional Cloud Convert service, the companion app, the DRock 3D VR headset app, and related services (together, the "Service"). It applies worldwide. By using the Service you agree to this Policy. If you do not agree, do not use the Service.

1.Who is responsible for your data

DRock 3D Tools is the controller of the personal data described here. You can reach us at support@drock3d.com.

2.Information we collect

• Account information. If you create a DRock account, we collect your email address and an encrypted (hashed) password, managed through our authentication provider (Supabase). We may also store a display name and your sharing/invite relationships.
• Payment information. When you buy credits, payment is handled by Stripe, which processes your card details directly — we do not receive or store your full card number. We receive limited transaction records (an order/customer identifier, amount, currency, status, partial billing details) used to fulfill and account for your purchase.
• Credits and usage ledger. We keep a record of credits you purchase and consume, and of cloud conversion jobs (status, timing, settings, compute used) so we can run the Service and bill credits correctly.
• Files you process in the cloud. If you use Cloud Convert, your chosen source file is uploaded to our cloud storage, processed on cloud compute (which may include third-party GPU providers), and the result returned to you. These files are handled only to provide that conversion. Local conversions never upload your files.
• Library and metadata. To show cover art, the app may send a title or query to a metadata service (e.g., TMDb) through our server-side proxy. Your library contents, file paths, and folder structure remain on your device.
• DRock 3D VR headset app. The headset app pairs with your own PC and stores its pairing credential encrypted on the headset. Your library, video streams, live desktop view, desktop audio, and any mouse/keyboard input you send travel directly between your headset and your PC over your local network (or your own secure remote link) — they are never sent to us. Desktop control only works on your local network with a paired device. The headset app contains no advertising and no third-party analytics SDKs.
• Diagnostics and analytics. The app can send privacy-safe, aggregate usage data (an anonymous install identifier, app version, feature areas used, success/failure outcomes, and broad count buckets). This is designed to never include your media file names, paths, titles, or content, and is not used to identify you.
• Technical and log data. Our servers and network provider (Cloudflare) automatically receive technical data such as IP address, request time, user agent, and error logs, used to operate, secure, and troubleshoot the Service.
• Cookies and local storage. The website and companion use cookies/local storage necessary to work and to keep you signed in. We do not use third-party advertising cookies.

3.How we use information

We use information to: provide and operate the Service; create and manage your account; process purchases and maintain your credit balance; run cloud conversions and return results; provide the remote access and library sharing you set up; secure the Service and prevent fraud or abuse; diagnose problems and improve features; communicate with you about your account, purchases, and support; and comply with legal obligations.

4.Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service and process purchases); legitimate interests (to secure, maintain, and improve the Service via privacy-safe analytics); consent (where required, which you can withdraw); and legal obligation (e.g., to keep transaction records).

5.How we share information

We do not sell your personal information. We share it only with:

• Service providers ("processors") who operate parts of the Service for us: Stripe (payments), Cloudflare (website, network, and cloud file storage), serverless GPU compute providers (running cloud conversions), and Supabase (accounts and data). They may process data only to provide their service to us.
• Metadata providers such as TMDb, when you look up cover art.
• Legal and safety recipients, where reasonably necessary to comply with law, enforce our Terms, respond to lawful requests (including copyright/DMCA), or protect rights, safety, or property.
• A successor in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

6.How long we keep information

• Cloud files: kept only as long as needed to deliver your conversion, then deleted automatically (currently within approximately 48 hours).
• Account data: kept while your account is active and a reasonable period afterward, then deleted or anonymized unless we must keep it longer by law.
• Payment/transaction records: kept as required for accounting, tax, and legal purposes.
• Analytics/log data: kept in aggregate or for a limited period for security and troubleshooting.

7.International transfers

DRock and its providers operate in the United States and other countries. If you use the Service from elsewhere, your information may be transferred to and processed in countries whose data-protection laws differ from yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses).

8.Security

We use reasonable technical and organizational measures — encrypted connections (HTTPS), hashed passwords, account + PIN protection for remote access, an outbound-only tunnel that does not expose your home IP, and access controls. No method is completely secure; keep your credentials, PIN, and access links private, and keep your own copies of your files.

9.Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or port your data, to object to certain processing, and to withdraw consent. You can exercise many of these directly in the app (sign out, reset your password, or delete your account), or by emailing support@drock3d.com from your account email. We will respond as required by law and will not discriminate against you for exercising your rights.

• EEA/UK: you may also lodge a complaint with your local data-protection authority.
• California (CCPA/CPRA): you have the right to know, delete, and correct, and to non-discrimination. We do not sell or "share" (for cross-context behavioral advertising) your personal information. Categories collected: identifiers (email, IP), commercial information (purchases/credits), internet/usage activity (privacy-safe analytics), and the content of files you choose to process in the cloud (temporarily).

10.Children

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child provided us information, contact support@drock3d.com and we will delete it.

11.Third-party services and links

The Service relies on and may link to third parties (Stripe, Cloudflare, GPU providers, Supabase, TMDb, and others). Their handling of your information is governed by their own privacy policies. We are not responsible for third-party practices.

12.Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will update the "Last updated" date and, where reasonable, provide additional notice. Continued use after changes take effect means you accept the updated Policy.

13.Contact

Questions or requests about your privacy? Contact support@drock3d.com.