Privacy policy

Who runs this

qqdraw is run by the operator of the domain you are reading it on. For anything on this page — a copy of your data, a deletion, a question — write to [email protected].

What is stored

An account exists only if you signed in. Signing in with Google gives the service your Google account id, your email address, your display name and your avatar URL. Google has verified the address; nothing else is requested from your Google account. The service keeps:

• The account — email address, display name, avatar URL, when it was created and when it was last seen.
• The session — a hash of the sign-in token, your browser’s user-agent string, and an expiry date. The token itself lives only in your browser’s cookie.
• The board — title, whether it is public or private, who owns it, when it was created and last changed, and the drawing itself: every element, including deleted ones, because keeping the deletion is how two copies of a board converge.
• Images — the picture you paste or upload, stored as a file on the server, plus its type, size and checksum. Identical images share one stored file.
• Comments and chat — the text, the name attached to it, and for a comment the point on the board it is pinned to.
• Invitations — the address you invited, a hash of the invitation link, and an expiry date. Invitations expire after 7 days.
• Membership and blocks — which account belongs to which private board, and which accounts a board owner has blocked.

What is not stored

• No IP addresses in the application’s database. The web server keeps ordinary access logs, as any web server does, and the application does not link them to an account.
• No advertising, no tracking pixels, no cross-site identifiers. Nothing is measured until you allow it, and until you answer no analytics script is requested at all. Before that, the only scripts loaded from outside this site are Google’s, and only on the sign-in surface.
• Cursors, selections and the viewport are live only: they are passed between the browsers in the room and never written down. Close the tab and they are gone.

Cookies

Three for signing in and staying signed in, and a fourth pair only if you allow analytics.

• qqdraw_session — which account this browser is. HttpOnly (no script can read it), SameSite=Lax, Secure over HTTPS, and it expires after 30 days. Signing out clears it.
• qqdraw_oauth — alive only during a Google sign-in, where it carries the state that makes the redirect safe. Removed when the sign-in finishes, successfully or not.
• qqdraw_admin_session — platform administrators only. It is a separate identity from a board account.
• _ga and _ga_<id> — set by Google Analytics, and only if you allowed it. They tell one browser from another and expire after two years. Declining never sets them, and turning analytics off deletes them.

Analytics

If this deployment has a Google Analytics measurement id configured, qqdraw can measure which pages are used — so the work goes where people actually are. It is off until you allow it, and nothing about analytics is loaded before that: no request to googletagmanager.com, no cookie, nothing to opt out of.

When it is on, Google Analytics 4 receives:

• The page you are on, as a route rather than an address. A board is recorded as /b/:id and an invitation as /invite/:token — the id and the token are dropped before anything is sent, because those are the secrets that make a board reachable.
• The browser and device, read from the user-agent string the browser already sends, and an approximate location worked out from your IP address. Google does not keep the address itself in Analytics.
• What you clicked, in the aggregate sense every analytics tool means: a page view, not a recording of the canvas.

Not sent: your account id, your email address, your display name, the contents of any board, or any board id or invitation token. qqdraw never sets a user id on the tag, never enables Google Signals and never turns on advertising features. The admin console is not measured at all.

Your answer is kept in this browser’s local storage, under qqdraw.analytics.consent.v1. It is not a cookie and it is never sent to the server, so clearing site data asks you again.

You can change your mind here at any time — turning analytics off also deletes the _ga cookies:

Public boards are public

A public board is the invitation: anyone with the link can open it, read it, draw on it and take a copy, with or without an account. Guests are given a name and a colour of their choosing, and the server does not know who they are.

A private board is narrower: only the owner and the people invited can open it, and everyone else is told the board does not exist. Either way, treat a board as shared with the people in it — they can copy what is on it.

The agent

The agent does nothing until you ask it something. When you do, the text you typed and a list of the elements already on the board — their type and their text, one per line — are sent to the model provider this deployment is configured with, OpenAI by default, so it can decide what to draw. If the deployment has TypeSafe configured, the text of the request is also sent there to classify what kind of diagram is wanted.

Nothing else leaves the server: not your email address, not your account id, not your images. The model provider’s own terms and retention apply to what it receives, and this service cannot delete the provider’s copy of it.

Each turn costs money, which is why there is an hourly limit. The limit, and whether the agent is available at all, is set by the operator.

Email

An invitation to a private board is delivered as email through Resend, the mail provider this deployment uses. The message contains the board’s title and the invitation link — nothing else.

Who else can see it

• The people in the room with you — what you draw, the name and colour you are given, your cursor, and anything you post in chat or comments. On a public board that includes people you have never met.
• Platform administrators — the dashboard lists accounts and boards by title, owner, element count and dates. It has no way to open a board, so board contents are not part of that view. As with any server, the operator controls the database itself.
• The model provider, and only when you use the agent, as described above.
• Google, and only if you allowed analytics, as described above — page routes and the browser, never a board or an account.

Nobody else. Nothing is sold, rented or shared for advertising, and this service keeps no profile of what you do — the only measurement it can make is the page-view one described above, and only while you allow it.

Keeping and deleting

• A board’s contents live until the board is deleted. Deleting it removes its elements, images, comments, chat and invitations, and collects image files that nothing else refers to.
• Sessions expire after 30 days. Invitations expire after 7.
• Deleting an account removes its sessions, its boards, its memberships and its blocks.
• There is no delete button in the product yet. Write to [email protected] and it will be done, from your address, without asking why.
• You can export any board you can open — PNG, SVG or JSON — at any time. That file is yours and does not need this service to keep working.

Your choices

• Keep anything you would not want copied on a private board, and invite only the people you mean to.
• Sign out whenever you like; the session cookie goes with it.
• Allow or refuse analytics on this browser, and take it back later, in the Analytics section above.
• Ask for a copy of what is stored about you, or for it to be deleted.

Changes

This page is dated at the top. If something material changes — a new place data goes, a longer retention — it is described here rather than slipped in, and the date moves with it.