Privacy Policy

You give us:

• Account — email address and password. Passwords are stored only as hashes, by the sign-in service we run on our own servers; we never see the plaintext.
• Profile — display name, username, and optionally an avatar image and a status message.
• Content — the messages, thread replies, and emoji reactions you send, and any files or images you attach.
• Workspace data — which workspaces and channels you belong to, and invites you send or accept.
• Beta interest — if you apply for early access, we store your email address so we can contact you about the beta.

Generated by using Drum:

• Delivery state — read markers and unread counts, so Drum knows what is new.
• Presence — whether you are currently online. This is transmitted live between connected clients and is not written to our database.
• Notification records — that you were mentioned, reacted to, or added to a channel.
• Device tokens — if you enable notifications on the iOS or Android app, an Apple or Google push token identifying that device installation. Deleted when you sign out.
• AI usage counters — token counts per workspace, for capacity and billing. Counts only; we do not retain prompt or response text in this record.
• Ringo permission — when you allowed or withdrew sharing data with Mistral AI for Ringo.

Only if you connect them:

• GitHub, Linear, Jira, Figma — OAuth access tokens plus the data those services return for items you reference (issues, pull requests, files). You choose to connect these; disconnecting removes the stored token.

We do not run advertising inside Drum, we do not sell personal data, and we do not use third-party analytics or tracking SDKs in the mobile app.

Our marketing website (drum.chat, not the Drum app) uses the OpenAI Ads pixel (OpenAI) to measure whether visits from our ads in ChatGPT lead to sign-ups. It stores a first-party cookie with OpenAI's click reference and sends page and "sign-up click" events, along with standard browser data such as IP address and device information, to OpenAI. We send no names, emails or form contents. Purpose: ad conversion measurement.

In the EU/EEA, UK and Switzerland this only runs if you accept it in our cookie notice (legal basis: consent); elsewhere it runs unless you reject it. We keep a record of your choice and when you made it. You can change or withdraw it anytime via "Cookie settings" in the site footer; withdrawing stops future measurement.

To operate Drum: deliver and display your messages, keep unread state, show who is online, send notifications you asked for, and run the integrations you connected. To keep the service secure and abuse-free. To contact you about the service — invitations and account email, not marketing.

Legal bases where GDPR applies: performing our contract with you, and our legitimate interest in a secure, functioning product. Where consent applies, you may withdraw it at any time: for push notifications in your device settings, and for sharing data with Mistral AI for Ringo in Drum's Settings.

Drum includes an AI assistant called Ringo. Ringo is powered by a third-party AI service, Mistral AI (Mistral AI SAS, France). We call Mistral's EU endpoint (api.eu.mistral.ai), so processing takes place in the European Union.

Nothing is sent to Mistral until you allow it. The first time you message Ringo or @mention it, Drum asks for your permission. You can withdraw it at any time in Settings, and the change applies on every device.

When you message Ringo or @mention it, Drum sends Mistral:

• your message, and the recent messages in that conversation or thread;
• the names and @handles of the people who wrote them;
• the channel name and your time zone;
• any other channels, files, or content from connected apps (GitHub, Linear, Jira) that you ask Ringo to read.

Ringo is not passively reading your workspace. It fetches messages only when a request requires it, and only from conversations you can already see. Ringo's replies are stored as ordinary messages.

Each acts on our instructions under a data processing agreement.

Files and images you upload are stored privately and are readable only by members of the channel or conversation they were shared in. They are served through short-lived signed links that expire, rather than permanent public addresses.

Anyone you deliberately forward such a link to can open the file until that link expires, so treat a shared link as you would the file itself.

Messages and attachments are kept until deleted by you, by a workspace administrator, or until the workspace is deleted. Account records are kept while your account exists. Push tokens are removed at sign-out, and automatically when Apple or Google reports the app uninstalled.

You can delete your account from Profile → Settings → Delete account in the app. This permanently removes your profile, your device tokens, your integration tokens, and your workspace memberships.

Messages you sent to shared channels remain visible but are attributed to a removed user.

Depending on where you live you may request access, correction, deletion, export, or restriction of your data, and may object to processing. Contact contact@drum.chat and we will respond within 30 days.

If your workspace is administered by an employer, direct requests to them first; we will assist them in responding.

You may lodge a complaint with your local data protection authority (for example, Integritetsskyddsmyndigheten, IMY, in Sweden).

Drum's database and file storage run on servers we operate at Hetzner Online GmbH, in Helsinki, Finland. Hetzner's data centres are certified to ISO/IEC 27001 and are physically secured and access-controlled. Daily backups of the database and uploaded files are kept with Hetzner in the EU.

All data sent between your device and Drum is encrypted in transit using TLS (HTTPS). Passwords are never stored in readable form, only as salted cryptographic hashes. Within Drum, access rules in the database make sure you can only see the workspaces, channels and messages you are a member of.

Only the Drum team has administrative access to these servers, and we access your data only when it's needed to run, secure or support the service.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as required by law.

Drum is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

We will post any change here and update the date above. Material changes will be announced in the app or by email before they take effect.

Drum
Email: contact@drum.chat