Privacy policy

Draftr is a design editor for people and AI agents, run by the Draftr team ("we"). This page says what we keep about you, why, for how long, and what you can do about it. Questions go to [email protected].

What we keep

• Your account: your name, email address and a hash of your password, never the password itself. When you sign in with GitHub or Google, the name, email address and picture they share. Whether your email is verified, when you signed up and when you last signed in.
• Your work: your designs with their images and fonts, your library, comments, the invitations you send and the feedback you give us.
• Sessions: a session cookie, and for each session the address (IP) and browser it came from, so you and our support can see and end it. A session lasts 30 days and renews while you use it.
• Agents: your personal access tokens (only a hash of each secret), the applications you connect, what you allowed each to do, their sign-in tokens (only a hash of each), the tasks agents report, and daily counts of agent calls per token.
• Security events: failed sign-ins, password resets, new tokens and blocked attempts, with the email address and IP address involved. Kept 90 days.
• Usage: which features are used, such as creating a design or inviting someone, never what your designs contain. Kept 90 days, then only as daily totals without accounts.
• Errors: reports when the app or the server fails, with email addresses, long IDs and secret links removed. Kept 30 days.
• Email: the emails we send you (verification, password reset, invitations, exports), kept up to 30 days to deliver and retry them.

What we do not do

We do not sell your data and show no ads. Analytics runs only if you accept it, only on this site and the sign-in pages, never in the editor or on your designs. We do not use your designs to train AI models. Agents you connect act with your token or with the access you allowed, and see only what your account can see.

Analytics

If you accept, we use Google Analytics 4 on draftr.top and on the sign-in and sign-up pages of app.draftr.top to count visits, see where they come from and which buttons people use, such as "Join the beta" or a finished sign-up. We send no names, email addresses, account IDs or the contents of any design, and no recordings of your screen. Google Analytics keeps no IP address, sets its own _ga cookies, and we keep its data for 2 months.

Google Ireland Limited and Google LLC process this data for us; it may reach the United States under the EU-US Data Privacy Framework. Without your consent nothing from Google is loaded. You can change your choice at any time with "Cookie settings" at the bottom of the page; Reject removes Google's cookies.

Cookies and browser storage

One cookie, draftr_consent, remembers your choice about analytics for 12 months on draftr.top and app.draftr.top. Google Analytics sets its cookies only if you accept. In the app, one cookie keeps you signed in; it is secure and not readable by scripts. Your browser also remembers small preferences on your device, such as the theme or a notice you hid. Cloudflare, which protects both, may set a cookie of its own to tell people from bots.

Who helps us run Draftr

• Our own server holds the app, the database and your files.
• Cloudflare passes every request to our server and protects it from attacks.
• Resend delivers our emails, so it receives your address and the message.
• Sentry receives error reports, without your account, cookies or what you sent.
• GitHub and Google, only if you choose to sign in with them.
• Google Analytics, only if you accept analytics (see above).

Who can see your data

People you share a design with see it, its comments and the names and email addresses of the others on it. Our support team can open account details (not the contents of designs) only after giving a reason; every view and action is recorded, and that record is kept two years.

When you connect an application such as Claude Code, Codex or ChatGPT, you see what it asks for and decide. If you allow it, it receives your email address, whether that address is verified, and the designs and other content it reads or changes for you. The company behind it handles that data under its own privacy policy. Disconnect it at any time under Agent access tokens in the app; its access ends at once.

Your choices

• Export: under Your data in account settings, once a day. We email a link to a ZIP of your designs, files, library and comments; it works for 7 days.
• Delete: under Your data. Sign-in closes at once, and after 30 days we delete the account, its designs and files. A design others edit with you passes to the editor who joined it first, and your name in comments becomes "Deleted user". Until then the link in our email keeps the account.
• Ask us: to see, correct or limit what we keep, write to [email protected]. We answer within 30 days.

Security

Every connection uses HTTPS. Passwords and token secrets are stored only as hashes, and access on our side is limited to the people who run Draftr.

Children

Draftr is not meant for anyone under 16.

Changes

When this policy changes, the date above changes too; we email you about important changes before they apply.