Privacy

Last updated 6 October 2026

Short version: we store the minimum needed to run the Service, we do not sell data, and there is no advertising tracking.

What we store

• Anonymous use — nothing about you. Shared code, thumbnails and compiled snippets are stored so links work; they carry no identity. Basic aggregated click statistics per fiddle are kept for lifetime counts.
• Signed-in accounts — your email address, a display name if you choose one, sign-in times, plan and role, quota and storage counters, your library (which shares you saved, titles, descriptions), your Community submissions and votes, and the metadata of apps you publish (id, size, build status, timestamps).
• Signing in with Google — Google hands us your name, your given and family names and your profile picture along with the sign-in. We discard all of it. None of it is stored, logged or shown anywhere. We keep the email address and nothing else from Google.
• Reports — when you report a Community item we store the reason and either your account email or, if signed out, your IP address, to limit abuse.
• Rate limiting — short-lived counters keyed by email or IP address for sign-in codes and reports (expire within an hour).
• Emails — we send one-time sign-in codes, a welcome message, and operational notices to the address you signed in with. No newsletters.

Your name is yours

An email address is not personal information until it is tied to a real name. DrawFiddle does not do that, and will not do that. The only name we ever hold is one you typed in yourself — the display name on your account, which you can change or empty whenever you like, and which is all anyone sees on a Community card. We never take a name from a sign-in provider, and we will not start.

Where and how

Everything runs on Cloudflare (Workers, KV, D1, R2, Email) and the static site on GitHub Pages; data is stored on Cloudflare's global network. Cloudflare's own edge analytics may record anonymous request metadata. We use no advertising or third-party tracking scripts.

Cookies and local storage

No cookies. Your browser keeps a session token in local storage after sign-in (valid 30 days, removed on sign-out) and small conveniences such as a queued editor open.

Retention and deletion

Shares that receive no visit for 60 days are deleted automatically. A share that carries files you added in the Resources panel is deleted after 3 days without a visit; each visit restarts that period, and premium or administrator shares keep their files permanently. Shares listed on the Community page (or waiting for review) and shares made by premium or administrator accounts are kept until removed by you or by us. We keep nightly backups of Community content for 30 days. You can remove library entries, withdraw Community submissions and unpublish apps at any time from your account. Deleting your account removes your email, library, submissions, votes and published apps; shared code you created stays available to anyone who has its link until it expires, because it holds no identity. Use the "Delete account" button in the account panel, or write to [email protected].

Your rights

You can ask what we hold about you, have it corrected or deleted, by email. We answer within 30 days.

Changes

We may update this text; the date above tells you when.