Privacy Policy
This policy covers the draw.how website and the draw.how apps for Android and iOS. Lessons and drawing work without an account. We collect what is needed to run them, we do not sell personal data, and there are no advertisements.
Your account
An account is optional (in the apps, turning your own photos into lessons needs one). If you create one with an email address, we store that address and a hashed password (never the password itself). If you sign in with Google or with Apple, we store the account identifier that Google or Apple gives us and the email address it shares, and no password. We also store your language, your email preferences, your plan and credits, and the date the account was created. If you invite people to a team plan, we store the email addresses you invite.
Your drawings and critiques
When you save a drawing, we store the image, a thumbnail and, where there is one, a replay of how it was drawn, together with the critique and skill readings we work out from it. Critiques are calculated on our own servers. If you photograph a drawing on paper, the photo is straightened on our servers. Drawings saved without an account are kept under a random session code rather than your identity, and join your account if you sign up.
Drawings are private by default. Each file has a long random address that is not listed anywhere, and a drawing becomes visible to others only when you choose to share or publish it.
Photos you turn into lessons
When you turn a photo into a drawing lesson, we store the photo and the lesson made from it, with your account or, on the website without an account, under a random session code. To draw the outline, the photo is sent to the image services fal.ai and Together AI, and the result may be checked against the photo by Google's Gemini model through fal.ai. They receive the image, not your name or email address. Only send photos that you have the right to use.
The Android and iOS apps
- When you sign in, the app keeps a sign-in token on your device in secure storage (the Android Keystore or the iOS Keychain). Our server stores only a hash of that token, with the platform and your device model name so that you can recognise the sign-in. A token expires after 180 days without use, and signing out revokes it.
- The app reads a photo only when you pick one with the system photo picker, and sends only that photo. It does not access the rest of your library.
- The apps contain no advertising, no analytics and no third-party tracking code. They do not use an advertising identifier and do not track you across other apps or websites.
- The apps do not sell anything at present. If we offer a purchase in the app, it will be made through the App Store or Google Play: your payment details go to Apple or Google and never reach us, and we receive only the store receipt for the purchase.
On the website: cookies and statistics
The website sets a session cookie, which also keeps drawings made without an account together, and a security cookie on pages with a form. We count visits with Clicky, a web statistics service. Its script is served from our own domain, and it receives the pages you view, the referring page, your browser type and your IP address, which it uses for an approximate location. We also keep our own record of site events (such as a drawing being saved) with the IP address and session, and our web server keeps standard access logs. None of this is used for advertising.
Payments on the website
Payments on the website are processed by Stripe. Your card number goes to Stripe, not to us. We keep a record of each payment, including the card brand, its last four digits and expiry date and the Stripe references, for accounting and refunds.
Who else receives data
fal.ai, Together AI and Google for photo lessons as described above, Stripe for website payments, Google or Apple when you choose to sign in with them, and Clicky for website statistics. Email is sent from our own mail server. We do not sell or rent personal data and do not share it with advertisers. We disclose data to authorities only when the law requires it.
Messages to us
Messages sent through the contact form or the feedback button are stored with the email address you give, so that we can reply.
Deleting your account
You can delete your account at any time: in the app under Account, then Delete account, or on the website from your account page. Deletion takes effect immediately. It removes your account, your sign-ins, your drawings and their files, your critiques and skill history, your photo lessons and their photos, your share links and the messages you sent through the contact form.
Some records are kept without any link to you: payment records that we must keep for accounting, and site statistics.
How long we keep data
Account data and drawings are kept until you delete them or the account. Web server logs are deleted after 14 days. Drawings and photo lessons made without an account, and our own site-event records, are not deleted on a schedule; you can ask us to remove any of them, or anything else listed here.
Children
Anyone can follow the lessons and draw without an account. Accounts and photo lessons are meant for people aged 13 or over. We do not ask for age and do not knowingly collect personal data from children under 13. If you believe a child under 13 has an account or has given us personal data, contact us and we will delete it.
Security
All traffic to the website and from the apps is encrypted with HTTPS. Passwords and sign-in tokens are stored only as hashes.
Your rights
You can ask to see, correct, export or delete the personal data we hold about you, or object to how we use it. Contact us and we will answer within 30 days. Contact Us
Changes to this policy
We will publish any change on this page with a new date.
Who is responsible for your data
The company named above operates this site and is the controller of the personal data described on this page. “We”, “us” and “our” mean that company throughout.
Last updated: 12 October 2026
Was this page useful?