Who this policy covers
Effective date: 31 October 2026. Last updated: 2 November 2026.
Drawsy AI ("Drawsy") is a product of Doable Works. Drawsy is owned and operated by Doable Works ("Doable Works", "we", "us", or "our"), which is responsible for the personal information described in this policy. This Privacy Policy applies to the services at app.drawsyai.com, drawsyai.com, and related web, account, billing, canvas, workspace, connector, and Drawsy Companion features. Drawsy is an AI-native visual workspace where people can create canvases, connect work sources, collaborate, and use AI to work with context they choose.
This policy describes our handling of personal information and content that you provide, create, upload, or authorize. It does not replace the privacy policies of Google, our payment partner PayU, other connected services, or AI providers that you choose to use.
- Operator: Doable Works (Partnership), 4th Floor, Bldg No. 14 / Flat No. 13, Navjivan Cooperative Housing Society, Lamington Road, Dr Dadasaheb Bhadkamkar Marg, Mumbai Central, Mumbai, Maharashtra 400008, India
- Privacy contact: shivam@drawsyai.com
- Our Terms of Service, Refund & Cancellation Policy, and Acceptable Use Policy also apply to your use of Drawsy.
Information we collect
The information we process depends on the features you use. You can use the guest canvas without creating an account; account, sync, collaboration, connector, and some AI features require additional information.
- Account and authentication data: when you sign in with Google, X, or email/password, Firebase Authentication provides identity information such as a provider identifier, name, email address, profile photo, email-verification status, and authentication timestamps. We use this to establish and verify your Drawsy account. Drawsy does not receive your Google, X, or email password.
- Workspace content: project and canvas titles, drawing elements, text, images and other files, presentations, comments, Kanban boards, cards, checklists, links, timestamps, version information, and other content you save or synchronize.
- Connected-account data: the provider and account you connect, account name, email, avatar, granted capabilities, OAuth scopes, and encrypted access or refresh credentials needed to maintain that connection. Drawsy does not ask for a connector unless you start that connection flow and approve it.
- Billing data: if you buy a paid plan, we process your plan, billing country or currency, the mobile number you enter at checkout (PayU uses it to set up recurring payments), and payment and subscription records from PayU such as transaction reference, amount, status, mandate status, billing period, and cancellation status. Card numbers, UPI PINs, and bank credentials are entered on PayU's checkout and are not received or stored by Drawsy.
- AI and companion data: prompts, conversation metadata, selected canvas elements, rendered selections, source images, generated outputs, selected project files such as DRAW.md, and the connector results you explicitly attach to an AI request. If you enter an AI provider key, it is used for the active session and is not stored in the Drawsy workspace or browser storage.
- Technical and usage data: requests, timestamps, browser and device characteristics, approximate network information, referrers, release information, error reports, and limited aggregate product events used to operate, secure, debug, and improve the service.
- Support information: the message, email address, attachments, and other information you choose to send when contacting us.
Authentication and Google Workspace data
Drawsy uses Firebase Authentication for Google, X, and email/password sign-in. Email/password accounts must verify their email address before Drawsy creates an application session. The optional Google Workspace connector is a separate authorization that lets Drawsy access selected Google Workspace data for connected-context features.
When you use Google or X sign-in, Drawsy uses the identity information returned by the provider to create or access your account, show your account identity, secure requests, and associate your saved workspace with you. When you use email/password, Firebase handles the credential, verification, and password-reset flows; Drawsy does not receive the password.
When you connect Google Workspace, the current connector requests identity scopes plus read-only access to Gmail messages, Calendar calendars and events, and Google Drive files and content. Drawsy uses that access only to show the connected account and to search, list, or read authorized source items when you explicitly request a connected-context or AI feature. Drawsy does not write to, delete from, or send through Gmail, Calendar, or Drive through this connector.
A Google Workspace source is attached to an AI turn only when you select or authorize it for that request. Drawsy uses short-lived, capability-scoped grants for this flow. We do not create a separate searchable copy of Google Workspace content in Drawsy by default. If you choose to save an answer, excerpt, image, or other result into a canvas, conversation, export, or project, that copy becomes content you stored through the relevant feature.
The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. In particular, Google Workspace data is not sold, used for advertising or ad targeting, shared with data brokers, used for credit decisions, or used to train or improve generalized artificial-intelligence or machine-learning models. It is used only to provide or improve user-facing Drawsy features that are visible in the product and that you request or enable.
We do not permit routine human access to Google Workspace content. Access is limited to what is needed to provide a feature you request, to investigate security or abuse, to comply with law, or where you have given affirmative consent for specific support. Google Workspace data is not used for unrelated profiling or surveillance.
| Google data | Why Drawsy uses it | Storage and sharing |
|---|
| Google account ID, name, email, and profile photo | Create and secure your Drawsy account; identify a connected Workspace account. | Account data is stored with your account. It is shared with Firebase Authentication and Drawsy's service providers only as needed to operate the service. |
| Gmail messages and metadata (read-only) | User-requested search, reading, and connected context for visible Drawsy features. | Requested results may be sent to the AI runtime you select for that turn. Drawsy does not sell them or retain a separate searchable copy by default. |
| Calendar calendars and events (read-only) | User-requested calendar context for planning, analysis, and AI assistance. | Processed only for the selected request. Any copy you save to Drawsy is treated as your workspace or conversation content. |
| Drive files and content (read-only) | User-requested file search, reading, and context for visible Drawsy features. | Processed only for the selected request or feature. It is not used for ads, data brokerage, or generalized model training. |
How we use information
We use information to provide the features you request, including account authentication, local and cloud workspace synchronization, canvas and presentation storage, collaboration, comments, Kanban and resource features, connector access, AI assistance, exports, and support. If you buy a paid plan, we also use billing data to process payments, activate and renew your plan, handle cancellations and refunds, prevent payment fraud, and keep records required by tax and accounting law.
We also use limited technical information to maintain availability, prevent abuse, protect accounts and infrastructure, diagnose failures, enforce fair-use and security controls, and understand aggregate feature usage. We do not sell personal information and do not use workspace or connected-source content for targeted advertising.
- We use only the connector permissions needed for the connected feature and keep source access scoped to the account, capability, and request you authorize.
- We may use de-identified or aggregated operational information to understand reliability and improve the service, provided it is not used to identify you or to train a generalized model with Google Workspace data.
AI processing and model providers
Drawsy AI can send your message and the context you select—such as canvas elements, rendered captures, source images, a selected local project document, or results from a connected source—to the AI runtime and model provider used for that request. Depending on your setup, this may be a local Codex or OpenCode runtime, a hosted Drawsy runtime, or a provider you configure with your own API key.
The AI feature is user-directed: the runtime receives the active surface and the sources or resources attached to the current turn. We do not use your workspace or Google Workspace data to train generalized AI models. Model providers may process prompts, context, and outputs under their own terms and privacy policies, so review those policies before sending sensitive information.
Drawsy Companion stores conversation indexes and preferences locally on the device. The underlying Codex or OpenCode runtime may maintain its own local conversation history. Session-only provider keys are kept in the active runtime and removed when the session ends or the companion restarts; do not paste credentials into canvas content or chat messages.
Workspace, browser, and collaboration storage
Guest canvases and other local-first data can be stored in your browser's local storage and IndexedDB, including drafts, files, libraries, theme preferences, and workspace state. This data stays on the device unless you choose to export, collaborate, sign in, or use a feature that sends it to a service. Clear the site's browser data to remove local copies, subject to your browser's behavior and any copies you exported.
When you sign in and synchronize a workspace, Drawsy stores account-scoped project and canvas metadata and encrypted scene data in its backend storage. Canvas and presentation scenes are encrypted before or as they are stored, and connector credentials are encrypted separately. Deleting a project or canvas through the product removes it from the primary Drawsy records and associated scene object when cleanup succeeds.
If you use real-time collaboration, the canvas state, changes, cursor or presence information, and any files needed for the session may be transmitted to collaboration infrastructure and to other participants. Sharing a room or export can make content available to anyone who receives the relevant link or file. Do not share confidential content with people you do not trust.
Cookies, local technologies, and monitoring
Drawsy uses essential browser storage and authentication state to keep the product working. The product may use cookies or browser storage supplied by Firebase Authentication and uses local storage or IndexedDB for canvas, file, library, UI, and local conversation data. These technologies are not used to sell your information or to build advertising profiles.
The production product may use Simple Analytics for aggregate page views and a small set of product events when tracking is enabled. It may also use Sentry for error monitoring. Sentry can receive technical details such as a page URL without its fragment, release information, browser context, error messages, console errors, and stack traces. These tools help us operate and secure Drawsy; they are not used to read or sell your workspace content.
Blocking browser storage, authentication storage, or monitoring requests can affect product functionality. The marketing site and product may also receive standard technical request data through their hosting, security, and delivery providers.
Payments
Payments for paid plans are processed by PayU, our payment partner. When you check out, you are taken to PayU's secure checkout, where PayU collects and processes your payment details under its own privacy policy and applicable payment regulations. PayU shares with us the information needed to confirm your payment and manage your subscription, such as transaction reference, amount, status, and recurring-mandate status.
We keep billing and transaction records for as long as required by tax, accounting, and other legal obligations (typically up to 8 years under Indian tax and accounting practice), even after you cancel or delete your account.
When we share information
We share information only as needed to provide Drawsy, protect users and infrastructure, comply with law, or carry out an action you request. Service providers process information on our behalf for hosting, authentication, encrypted storage, delivery, payment processing (PayU), security, error monitoring, analytics, and support. They may process data in countries other than where you live.
When you connect a third-party service, Drawsy communicates with that service using the permissions you approve. When you attach a source to an AI turn, the relevant user-selected content may be sent to the selected AI runtime or provider to produce the requested result. We do not sell personal data or transfer Google Workspace data to advertising platforms, data brokers, or unrelated third parties.
We may disclose information if reasonably necessary to comply with a legal obligation, respond to a valid legal process, protect the rights or safety of users, investigate abuse or security incidents, or prevent fraud. If Drawsy is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction subject to applicable law and appropriate notice.
We may also disclose information when required by law, court order, or a valid request from a government authority, or where needed to protect the rights, safety, or security of users, the public, or Drawsy. If Doable Works is involved in a merger, acquisition, or reorganisation, information may be transferred as part of it, and this policy (or one at least as protective) will continue to apply.
Security
Drawsy uses HTTPS for network transport, authenticated requests, account and capability boundaries, short-lived request grants, server-side handling of connector credentials, and encryption mechanisms for stored workspace documents, scenes, and connector tokens. Access is limited by account ownership, membership, provider capability, and the feature being used.
No service can guarantee absolute security. Keep your Google account, Drawsy sessions, shared links, API keys, and devices secure, and tell us promptly if you believe an account or connector has been compromised.
Retention and your choices
We retain account and workspace information while it is needed to provide the service, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, and protect security. Local browser copies remain until you remove them or your browser removes them. AI conversation data maintained by a local companion or third-party runtime follows that runtime's local storage and deletion controls.
OAuth state records and AI or connector grants are short-lived and expire automatically. Connector access credentials remain while a connector is connected so that the feature can work; disconnecting a connector requests revocation and deletes the stored Drawsy connection record. Provider-side copies or backups may take additional time to expire under the provider's policies.
If you delete your account, we delete or de-identify your account and workspace data within 30 days, except billing and transaction records and any information we must keep to comply with law, resolve disputes, or prevent fraud.
- Disconnect a connector in Drawsy and revoke it in the provider's account settings.
- Delete individual projects, canvases, comments, and other supported content from the product.
- Sign out and clear Drawsy site data from your browser to remove local authentication and workspace copies.
- Email shivam@drawsyai.com to request access, correction, deletion, or information about your account and personal data, or to withdraw consent you gave. We may need to verify your identity before completing a request.
How long we keep data
Typical retention periods are summarised below. Local companion or third-party AI runtimes may keep their own copies under their own controls.
| Data | How long we keep it |
|---|
| Account and profile | While your account is open, then deleted or de-identified within 30 days of account deletion |
| Workspace content (canvases, files, comments, boards) | Until you delete it or your account, then within 30 days (backups typically overwritten within 30 days) |
| Connector records and credentials | Until you disconnect the connector or delete your account |
| AI request and conversation data held by Drawsy | Until you delete the conversation or your account |
| Billing and transaction records | Up to 8 years, for tax and accounting law |
| Support emails | About 2 years after the request is closed |
| Security and error logs (including Sentry) | About 180 days to 1 year |
| Browser local storage and IndexedDB | On your device until you or your browser clear it |
Your rights
You can ask us for a summary of the personal data we hold about you, to correct, complete, update, or delete it, and to withdraw consent you gave (this does not affect processing before the withdrawal, and some features may stop working). Under the Digital Personal Data Protection Act, 2023 you can also nominate another person to exercise your rights if you die or become unable to. Email shivam@drawsyai.com or the Grievance Officer below. We may need to verify your identity.
Children, changes, contact, and grievances
Drawsy is not directed to children. You must be 18 or older to create a Drawsy account or buy a paid plan. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us so we can review and delete it where appropriate.
We may update this policy when the service or our data practices change. We will update the dates above and, when a change is material, provide additional notice or request consent where required. We will not use Google user data for a new purpose beyond this policy without updating the disclosure and obtaining any consent required by applicable law or Google's policies.
For privacy questions, data requests, or concerns about Google data handling, contact shivam@drawsyai.com.
Grievance Officer (India): in line with the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, you can raise complaints about how we handle your personal data with our Grievance Officer: Shivam Nimbalkar, Doable Works, 4th Floor, Bldg No. 14 / Flat No. 13, Navjivan Cooperative Housing Society, Lamington Road, Dr Dadasaheb Bhadkamkar Marg, Mumbai Central, Mumbai, Maharashtra 400008, India, shivam@drawsyai.com. We will acknowledge complaints within 48 hours and aim to resolve them within 30 days.
