Privacy Policy

This Privacy Policy explains how the operator of drawDB (“drawDB,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use our hosted websites, applications, APIs, and related services. It does not cover a self-hosted copy of drawDB or third-party sites and services with their own privacy policies.

• Account and profile data: email address, username, avatar settings, account identifiers, authentication method, and optional onboarding responses such as role, organization, use case, and referral source.
• OAuth data: if you use GitHub or Google sign-in, the provider sends us identity information such as your name, email address, avatar URL, provider account ID, and email-verification status. We do not request repository, Drive, Gmail, or Calendar access.
• User Content: diagrams, database schemas, versions, comments or collaboration activity, sharing settings, AI prompts, and related content you create or submit.
• Team data: team name, membership, roles, invitations, permissions, and seat usage.
• Billing data: Paddle processes payment details. We receive transaction and subscription information such as customer and subscription IDs, plan, status, renewal dates, and seat count. We do not receive your full payment-card number.
• Usage and device data: product events, feature use, a randomly generated device identifier stored in local storage, session identifier, plan tier, IP address, browser and device information, referring page, request timestamps, and diagnostic logs.
• Communications: messages, support requests, survey responses, and bug reports you send us.

We use personal information to:

• provide, authenticate, secure, and maintain the Service and fulfill our contract with you;
• save, synchronize, share, and collaborate on diagrams according to your instructions;
• process subscriptions, administer trials, manage teams, and provide support;
• operate AI features when you choose to use them;
• measure product usage, troubleshoot errors, prevent abuse, and improve performance and features;
• send transactional messages and important service or policy notices;
• comply with law, enforce our terms, and establish or defend legal claims; and
• send marketing communications where you consent or where otherwise permitted, with an option to unsubscribe.

Where a legal basis is required, we rely on performance of a contract, our legitimate interests in operating and improving a secure service, compliance with legal obligations, and consent where applicable. You may withdraw consent at any time without affecting earlier processing.

We share information only as reasonably necessary with:

• Paddle: merchant of record for checkout, payments, taxes, subscription administration, fraud prevention, buyer support, and refunds.
• Cloud infrastructure providers: including Google Cloud and Cloudflare/R2, for hosting, storage, networking, security, and delivery.
• Anthropic: AI prompts, relevant conversation history, tools, and diagram context when you invoke the AI assistant, in order to generate a response.
• Amplitude and Sentry: product analytics and error/performance monitoring, when configured.
• Resend or our email provider: email address and message content needed to deliver sign-in codes and service communications.
• GitHub and Google: when you choose their sign-in services.
• Your team and collaborators: profile, presence, and User Content according to team membership, permissions, and sharing settings you or an administrator select.
• Professional advisers, authorities, and transaction parties: when needed to comply with law, protect rights and safety, or complete a merger, financing, acquisition, reorganization, or sale of assets.

We do not sell personal information for money.

We use browser storage and similar technologies for authentication, security, editor preferences, local diagrams, and a first-party analytics device identifier. We do not currently use third-party advertising cookies. Blocking storage may prevent sign-in or editor features from working. If our use changes, we will update this policy and provide consent controls where required.

We retain account, team, and User Content while needed to provide the Service. We retain different categories for only as long as reasonably necessary for the purposes described here, including security, dispute resolution, backup restoration, and legal, accounting, or tax obligations. Retention depends on the type of data, account status, sensitivity, legal requirements, and operational need. Deleted data may remain temporarily in backups or logs until routinely overwritten. Paddle retains transaction records under its own policy and legal obligations.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encrypted transport, access controls, and hashed authentication secrets. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

drawDB and its providers may process information in countries other than your own. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or standard contractual clauses.

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing; receive a portable copy; withdraw consent; or appeal a decision about a request. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

To make a request, email privacy@drawdb.app. We may need to verify your identity and authority. An authorized agent may submit a request where local law permits. We will respond within the period required by applicable law. You can also update some account details and sharing controls directly in the Service.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Where local law sets a higher age for consent to online services, users below that age must have authorization from a parent or guardian. Contact us if you believe a child provided personal information without appropriate consent.

We may update this policy as our practices or legal obligations change. We will post the revised policy and its effective date and provide additional notice of material changes where required.

For privacy questions or requests, contact privacy@drawdb.app. General support is available at support@drawdb.app.