Privacy policy.

Who is responsible

REPLACE_WITH_YOUR_NAME_OR_COMPANY operates Draw AI and is responsible for the personal data described here.

Privacy enquiries: hello@draw.example.com

What we collect

When you create an account, we store your name, email address, password hash or sign-in provider account, verification status and session records. We store the references you upload, generated lesson images and instructions, lesson progress, credit balance and quality reports. Requests may also include technical information such as an IP address and browser details for authentication, rate limiting and service operation. We do not ask for payment-card details in this preview.

Why we use it

Account and lesson data lets us provide the service you request: sign you in, send security emails, process a reference, save a lesson and restore your progress. Where GDPR applies, providing those requested services relies on performance of our agreement with you. Protecting accounts, preventing abuse and diagnosing service failures relies on our legitimate interests in operating a secure service. Optional product analytics relies on your consent. We use information to meet legal obligations when they apply.

Photo processing and service providers

Personal lessons send the reference image and drawing instructions to OpenAI for analysis and image generation. Private storage uses Cloudflare R2 in production; local development can use local disk. Our hosting provider processes service traffic and stored database records. The configured email provider handles transactional messages. If you choose Google or Apple sign-in, that provider handles its authentication flow and shares account details with us. Optional analytics uses PostHog only when configured and you opt in. These providers process data under their applicable agreements and policies; this notice does not promise a particular provider retention or training setting.

Private access and retention

Personal lessons are account-owned and are not published in a public gallery. Image links are temporary bearer links: anyone holding a valid link can view that image until it expires, so avoid sharing them. Account and lesson records are kept while you use the account, until you delete the account or individual lesson, unless a legal obligation requires otherwise. Image deletion is queued for the worker and can be delayed by retries or service outages. Temporary uploads and expired sessions are subject to cleanup. Any production backup, operational-log and provider retention schedules must be confirmed by the operator before launch; deletion from live storage does not imply immediate deletion from backups or provider systems.

Cookies and local storage

Essential session cookies keep you signed in and secure authentication flows. Local storage remembers your analytics choice and sample lesson progress. Optional PostHog analytics can record allowlisted lesson events, tutorial identifiers, stage numbers, platform and whether a lesson is a sample. These identifiers can be pseudonymous rather than anonymous. We do not send photos, email addresses, passwords, free-text lesson content or session recordings as analytics event properties. Analytics is off until you opt in through Settings, and you can withdraw that consent there at any time.

Your choices and rights

You can delete individual lessons from your library and close your account in Settings. Where applicable, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw analytics consent without affecting earlier lawful processing. You can complain to your local data protection authority. We may need to verify your identity before fulfilling a request. Use the privacy contact above for requests that are not available through account controls.

International processing

Hosting, authentication, storage, AI and email providers may process data outside your country, including outside the EEA. The operator must confirm the selected deployment regions, applicable transfer safeguards and how to obtain information about them before launch. Do not upload sensitive personal information, confidential documents or other people’s private photographs unless you have an appropriate basis to do so.

Changes to this notice

We will update this page when the service or its data handling changes. The date below identifies this version. Material changes should be communicated through the service or another appropriate channel.