Privacy Policy
DDraw is a collaborative drawing app. This page explains what we collect, why, how long we keep it, and who else sees it.
What we collect
- Account details. A username and a password (stored only as a bcrypt hash, never in plain text). Email is optional and is used for password resets and email verification. You can also sign in with Discord, in which case we store your Discord ID and linked profile details. You can add a secret question; its answer is stored hashed.
- Network and device data. Your IP address, the network range it belongs to, a random device ID kept in your browser, a browser fingerprint, and a short summary of your browser and device (language, screen, user agent). We keep the most recent 20 values of each per account and log registrations, sign-ins and connections as events. This is used for abuse prevention and moderation. [CONFIRM how long connection events are kept; no automatic expiry was found in the code]
- Things you make. Drawings and board state for rooms, gallery uploads (images, titles, tags), comments, likes and favorites, and room replay data and checkpoints. Room checkpoints are pruned to a fixed number per room. [CONFIRM retention for rooms, replays and gallery items]
- Messages. Direct messages in the Messenger are stored on our server, encrypted at rest with a key we hold. They are not end-to-end encrypted, so we (and moderators handling a report) can read them. [CONFIRM whether public room chat is stored or only held live]
- Usage stats. Per-account counters such as strokes, distance drawn, time spent and tools used, kept for up to the last 365 days. Basic page analytics are collected by Vercel Analytics on our web pages.
- Supporter purchases. If you buy a Supporter plan we store your Stripe customer ID and the date your Supporter status runs until. We never see or store your card number; Stripe handles it. We keep Stripe webhook event IDs for 90 days to avoid double processing.
- Feedback. Anything you send through the feedback form.
Why we use it
- To run the service: sign you in, sync drawings, show your gallery items.
- To keep it safe: detect ban evasion, spam and abuse, and enforce bans and mutes. Bans match on a hashed network range, your account, and your device identifiers.
- To bill Supporters and turn on Supporter cosmetics.
- To fix bugs and improve the app.
Cookies and browser storage
We do not set advertising cookies. We use your browser's local storage to keep your login token (valid for 30 days), a device ID, your settings and preferences, and drawing state. The page analytics script may use its own storage as described by Vercel. [CONFIRM]
How long we keep it
- Password reset links: 1 hour. Email verification links: 15 minutes. Discord sign-in state: 10 minutes.
- Sync debugging events: 30 days.
- Stripe event IDs: 90 days.
- Moderation records: kept as a record after a ban or mute ends. [CONFIRM]
- Everything else: until you ask us to delete it or the account is removed. [CONFIRM]
Who we share it with
We do not sell your data. These services process it for us:
- Stripe for payments.
- Koyeb hosts the game server and API.
- Vercel hosts the website and provides page analytics.
- MongoDB hosts our database. [CONFIRM which provider and region]
- Cloudflare R2 stores gallery and snapshot images, served from assets.ddraw.ca.
- Resend delivers account emails such as password resets.
- Discord, if you choose to sign in with it.
- Google Fonts and flagcdn.com receive your IP address when your browser loads fonts and country flags.
We may also disclose information if the law requires it. Data is stored on servers that may be outside Canada. [CONFIRM]
Public content
Your username, gallery uploads, comments and room drawings can be seen by other users. Think before you post anything personal.
Desktop app
The desktop app uses the same accounts and servers as the website. It checks https://www.ddraw.ca/desktop-updates/latest.json for updates, which reveals your IP address and app version to our host. We found no other tracking in the app beyond what is described here. [CONFIRM for the Steam build]
Your rights
You can ask to see, correct or delete the personal information we hold about you, or withdraw consent, by emailing support@ddraw.ca with your username. We will respond within 30 days. Some moderation records may be kept where needed to prevent abuse.
Children
DDraw is a public chat and drawing service. You must be at least 13 years old to use it. [CONFIRM minimum age] If you believe a child under 13 has an account, contact us and we will remove it.
Changes
If we change this policy we will update the date above. Continued use after a change means you accept it.