Privacy Policy
Last updated 18 September 2026
This Privacy Policy explains how DrawlyHub ("we", "us") collects, uses, and protects personal information when you use the collaborative drawing and whiteboarding service at drawlyhub.com (the "Service"). It also sets out the choices and rights available to you.
1. Information we collect
1.1 Account information
You sign in to DrawlyHub using a Google account. When you do, we receive and store your email address, your display name, the address of your profile picture, and the unique identifier your identity provider assigns to you. We never receive and never store your password.
If you add a passkey, we store its public key, the name you give it, and when it was added and last used. The private key never leaves your device, and the public key cannot be used to sign in anywhere else.
You can also sign up with an email address instead. When you do, we store your first name, last name and email address, and the time you agreed to these terms. To sign you in we email you a six-digit code: we keep only a one-way fingerprint of it, never the code, and discard it once it is used, after ten minutes, or after five wrong attempts. There is no password on such an account either.
If you subscribe to Pro, your card details go directly to our payment processor and never reach us. We store the processor's identifiers for you and your subscription, its status, and the dates it renews or ends, so that we know which plan you are on.
1.2 Content you create
We store the content of your boards, including drawings, shapes, sticky notes, connectors, text, Markdown documents, diagrams, board and frame titles, tags, and any images you add. This content remains yours. We process it solely to provide the Service: to make your work available to you and to those you choose to share it with.
1.3 Technical information
Our infrastructure providers record standard request information in the ordinary course of delivering and securing the Service, including your IP address, the time of each request, and your browser's user-agent string. We do not operate analytics, advertising, profiling, or third-party tracking of any kind.
1.4 Security and activity records
Separately from the infrastructure logs above, we keep a short security record of significant actions on the Service — signing in, creating an account, creating, binning or restoring a board, creating or revoking a share link, an image upload that our automated check declined, and a Pro subscription starting, being canceled or ending. Each entry records the action, what it affected, the time, your IP address, and — if you were signed in — your account identifier and email address.
We keep this record to investigate abuse, answer support questions, and account for changes to your work. It is not used for analytics or profiling, it is readable only by our administrators, and entries are deleted automatically after 90 days (see Retention below). Ordinary use of the Service — opening or viewing a board, and the drawing you do on it — is not recorded here.
2. How we use information
We process the information above only to:
- authenticate you and maintain your session;
- store, display, and synchronize the boards you create;
- deliver the sharing and notification features you choose to use;
- secure the Service, investigate abuse, and diagnose faults;
- meet our legal obligations.
We do not use your content to train models, to build advertising profiles, or for any purpose you would not reasonably expect from a whiteboarding tool.
3. Cookies and local storage
DrawlyHub sets only cookies that are strictly necessary for the Service to function. There are no advertising, analytics, or tracking cookies, which is why no consent banner is presented.
| Cookie | Purpose | Lifetime |
|---|---|---|
| drawly_session | Identifies you after sign-in. Not readable by page scripts. | 180 days |
| drawly_anon | Identifies the single board a signed-out visitor is working on. | 24 hours |
| drawly_share | Records that you opened a view-only board link, so the board remains readable. | 30 days |
| drawly_oauth_state | Confirms that a sign-in was initiated by you. A security measure. | 10 minutes |
Your light or dark appearance preference is held in your browser's local storage and is never transmitted to us.
4. Service providers
We rely on third-party providers to operate the Service. Each acts on our instructions and only for the purposes described in this policy:
- Cloud infrastructure — hosting, database storage, image storage, and email delivery. Data is stored and processed in the United States.
- Identity provider — Google, which authenticates you at sign-in. Your identity provider tells us who you are; we do not disclose the content of your boards to it.
- Bot protection — Google reCAPTCHA, on the forms that email you a sign-up or log-in code. It checks that the request comes from a person, using information about your browser and how you use the page, which Google handles under its own Privacy Policy and Terms of Service. We receive only a pass or fail and a score, and keep the score in our logs to tune the check.
- Payment processor — takes payment for Pro subscriptions and lets you manage or cancel one. It receives your email address and your payment details directly from you, and handles them under its own terms; we receive only whether a payment succeeded and the state of your subscription.
- Automated image moderation — an image you add to a board is sent to our cloud provider's content-analysis service before it is stored, and is declined if that check flags it. The image is analyzed to answer that one question; it is not retained by the check itself, and no person reviews it.
We do not sell personal information, and we do not disclose it to any party other than the providers above, except where required by law or necessary to protect our rights or the safety of others.
5. Sharing a board
Your content reaches other people only when you decide that it should:
- A view-only link allows anyone in possession of that link to read the board without an account. You may revoke a link at any time, after which it ceases to work.
- Granting a named person access sends that person a notification email identifying you as the person who shared the board.
6. Retention
- Your account and boards — retained until you delete them or ask us to close your account.
- A board you delete — moved to Trash and restorable for 30 days, after which it is permanently deleted along with all of its contents. Deletion at that point is irreversible.
- A board created without an account — expires 24 hours after creation and is deleted automatically. If you create an account within those 24 hours, the board is transferred to your account and ceases to expire.
- Security and activity records (section 1.4) — deleted automatically 90 days after the action they describe.
7. Security
All traffic is served over HTTPS. The session cookie is issued with flags that prevent page scripts from reading it and prevent it from being sent from other sites. Board content and images are held in storage services that encrypt data at rest. Authorization is evaluated on every request against the workspace a board belongs to, so no board is accessible by guessing its address.
No online service can guarantee absolute security, and we make no such guarantee here.
8. Your rights and choices
You may export any board you are able to open, and delete any board you own, at any time and without contacting us.
To request a copy of the personal information we hold about you, to have it corrected, or to have your account and its contents deleted, write to support@drawlyhub.com from the email address you signed in with. We will respond within 30 days.
Depending on your place of residence you may hold additional rights over your personal data, including under the EU and UK General Data Protection Regulation and the California Consumer Privacy Act. The same address is the route to exercising them, and we will not discriminate against you for doing so.
9. International transfers
The Service is operated from the United States, and information you provide is stored and processed there. If you access DrawlyHub from another country, you understand that your information will be transferred to and processed in the United States.
10. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The date at the top of this page reflects the current version. Where a change materially affects how we handle your information, we will notify you within the Service before it takes effect.
12. Contact
Questions about this policy, or about information we hold, should be addressed to support@drawlyhub.com.