# Drawsy Privacy Policy Effective date: 31 October 2026. Last updated: 2 November 2026. Drawsy AI ("Drawsy") is a product of Doable Works, which owns and operates it. This policy applies to the services at https://app.drawsyai.com, https://drawsyai.com, and related web, account, billing, canvas, workspace, connector, and Drawsy Companion features. Legal business name: Doable Works (Partnership) — https://app.drawsyai.com/legal Registered address: 4th Floor, Bldg No. 14 / Flat No. 13, Navjivan Cooperative Housing Society, Lamington Road, Dr Dadasaheb Bhadkamkar Marg, Mumbai Central, Mumbai, Maharashtra 400008, India Privacy contact: shivam@drawsyai.com Also applies: Terms, Refund Policy, and Acceptable Use (https://app.drawsyai.com/acceptable-use). ## Information we collect Depending on the features used, Drawsy may process: - Account and authentication data from Firebase Authentication, including provider account identifier, name, email address, profile photo, email-verification status, and authentication timestamps. Drawsy does not receive Google, X, or email account passwords. - Workspace content such as project and canvas titles, drawing elements, text, images and files, presentations, comments, Kanban boards, cards, checklists, links, timestamps, and versions. - Connected-account data such as provider, account name, email, avatar, capabilities, OAuth scopes, and encrypted access or refresh credentials. - Billing data for paid plans: plan, billing country or currency, checkout mobile number for PayU recurring mandates, and PayU payment/subscription records. Card numbers and bank credentials stay on PayU checkout. - AI and companion data such as prompts, conversation metadata, selected canvas elements, rendered captures, source images, selected project files such as DRAW.md, generated outputs, and connected-source results explicitly attached to an AI request. - Technical, usage, and support information needed to operate, secure, debug, and support the service. ## Authentication and Google Workspace data Google, X, and email/password sign-in authenticate a Drawsy account through Firebase Authentication. Email/password accounts must verify their email address before Drawsy creates an application session. This is separate from the optional Google Workspace connector. The Google Workspace connector requests identity scopes plus read-only access to Gmail messages, Calendar calendars and events, and Google Drive files and content. Drawsy uses this access only to show the connected account and to search, list, or read authorized source items for user-requested connected-context or AI features. It does not write to, delete from, or send through Gmail, Calendar, or Drive through this connector. A Google Workspace source is attached to an AI turn only when the user selects or authorizes it. Drawsy uses short-lived, capability-scoped grants and does not create a separate searchable copy of Google Workspace content by default. A copy that the user saves into a canvas, conversation, export, or project becomes content stored through that feature. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Google Workspace data is not sold, used for advertising or ad targeting, shared with data brokers, used for credit decisions, or used to train or improve generalized AI or machine-learning models. It is used only for visible, user-facing Drawsy features that the user requests or enables. Drawsy does not permit routine human access to Google Workspace content. Access is limited to providing a requested feature, investigating security or abuse, complying with law, or specific support for which the user gives affirmative consent. See the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy) and [Google Workspace API User Data and Developer Policy](https://developers.google.com/workspace/workspace-api-user-data-developer-policy). ## Payments Payments for paid plans are processed by PayU. PayU collects payment details on its checkout under its own privacy policy and shares transaction status with Drawsy. Billing records may be retained for tax and accounting obligations (typically up to 8 years). See https://app.drawsyai.com/refund-policy. ## AI processing Drawsy AI may send the user's message and selected context to the AI runtime and model provider used for that request. Depending on setup, this may be a local Codex or OpenCode runtime, a hosted Drawsy runtime, or a provider configured with the user's own API key. Drawsy does not use workspace or Google Workspace data to train generalized AI models. Model providers may apply their own privacy policies. Drawsy Companion stores conversation indexes and preferences locally. The underlying runtime may maintain local conversation history. Session-only provider keys are removed when the session ends or the companion restarts and are not stored in the Drawsy workspace or browser storage. ## Workspace and browser storage Guest canvases and local-first data can be stored in browser local storage and IndexedDB, including drafts, files, libraries, theme preferences, and workspace state. Signed-in workspaces synchronize account-scoped metadata and encrypted scene data with Drawsy backend storage. Connector credentials are encrypted separately. Real-time collaboration may transmit canvas state, changes, cursor or presence information, and session files to collaboration infrastructure and other participants. Sharing a room or export can make content available to anyone with the relevant link or file. ## Cookies, monitoring, and service providers Drawsy uses essential browser storage and authentication state. The production product may use Simple Analytics for aggregate page views and limited product events when enabled, and Sentry for error monitoring such as URLs without fragments, release information, browser context, error messages, console errors, and stack traces. Service providers process information as needed for hosting, authentication, encrypted storage, delivery, payment processing (PayU), security, monitoring, analytics, and support. Connected providers receive data only through permissions the user approves. Drawsy does not sell personal data or transfer Google Workspace data to advertising platforms, data brokers, or unrelated third parties. We may also disclose information when required by law, court order, or a valid government request, or to protect users, the public, or Drawsy. If Doable Works is involved in a merger, acquisition, or reorganisation, information may transfer as part of it under this policy or one at least as protective. ## Retention table (summary) - Account/profile: while open, then ~30 days after deletion - Workspace content: until deleted / account closed, then ~30 days - Connectors: until disconnect or account deletion - Drawsy-held AI conversations: until you delete them or the account - Billing records: up to 8 years - Support emails: ~2 years after closed - Security/error logs: ~180 days to 1 year - Browser local storage: until cleared on device ## Your rights You can request a summary, correction, update, or deletion of personal data, and withdraw consent. Under DPDP 2023 you may nominate someone to exercise rights if you die or become unable to. Email shivam@drawsyai.com. ## Security, retention, and choices Drawsy uses HTTPS, authenticated requests, account and capability boundaries, short-lived grants, server-side connector credential handling, and encryption mechanisms for stored workspace documents, scenes, and connector tokens. No service can guarantee absolute security. We retain information while needed to provide the service, maintain an account, comply with law, resolve disputes, enforce agreements, and protect security. OAuth state records and AI or connector grants expire automatically. Disconnecting a connector requests upstream revocation and deletes the stored Drawsy connection record. Local browser copies remain until removed by the user or browser. If you delete your account, we delete or de-identify account and workspace data within 30 days, except billing records and information we must keep for law, disputes, or fraud prevention. Users can disconnect connectors, revoke Google access in provider settings, delete supported workspace content, sign out, clear browser site data, and request access, correction, or deletion by emailing shivam@drawsyai.com. Identity verification may be required. Drawsy is not directed to children. You must be 18 or older to create an account or buy a paid plan. We do not knowingly collect personal information from children. Grievance Officer: Shivam Nimbalkar, Doable Works, 4th Floor, Bldg No. 14 / Flat No. 13, Navjivan Cooperative Housing Society, Lamington Road, Dr Dadasaheb Bhadkamkar Marg, Mumbai Central, Mumbai, Maharashtra 400008, India, shivam@drawsyai.com. Complaints acknowledged within 48 hours; aim to resolve within 30 days. Privacy contact: shivam@drawsyai.com --- HTML: https://app.drawsyai.com/privacy llms.txt: https://app.drawsyai.com/llms.txt