Privacy
Last updated: 2 September 2026
drawmebaby has no accounts and no application server. Your API keys, prompts and canvas stay in your browser until you ask your chosen AI provider to draw or generate a playground. Vercel serves the site and measures its speed, Umami provides product analytics, and mailbox.org handles email.
Who is responsible
Ewgeni Dobronos runs this non-commercial project.
- Address
- 83, 3, Phe, Amphoe Mueang Rayong, Rayong 21160, Thailand
info@drawmebaby.com
What is processed
| Activity and purpose | Data | Recipient and location | Retention | Legal basis |
|---|---|---|---|---|
| Run the app and save your work locally | API keys, settings and prompt history, canvas and images | None; it stays on your device | Until you clear it | Providing the functions you request |
| Serve and secure the website | IP address, time, requested path, status, user-agent, referrer, and request records | Vercel Inc., United States; global delivery network | Set by Vercel under its privacy notice | Legitimate interests in providing and securing the site |
| Produce the drawing or playground you request | Prompt, API key, and IP address; a captured image for drawing, or the selected HTML document for playground revisions | Your chosen AI provider; wherever it operates | Set by that provider | Providing the function you request |
| Understand use and improve the app | Page and referrer, browser and device details, language, approximate location, and a short list of app events | Umami Software, Inc.; European Union region | Six months | Legitimate interests in product analytics |
| Measure and improve site performance | Page path, network speed, browser, device, operating system, country, Web Vitals, element attribution, and time | Vercel Inc., United States; global infrastructure | 30-day reporting window; Vercel sets any further retention under its privacy notice | Legitimate interests in reliable site performance |
| Answer email and handle legal claims | Your address, your message, delivery metadata | Heinlein Hosting GmbH (mailbox.org); Germany | Delivery metadata: 7 days; access metadata: 4 days; message: 90 days after the conversation, or longer for a legal claim | Responding to your request and legitimate interests in correspondence and legal claims |
The requested-function ground refers to Section 24(3) of Thailand's Personal Data Protection Act; legitimate interests refers to Section 24(5). If the GDPR applies, the corresponding grounds are Article 6(1)(b) and 6(1)(f).
Vercel's terms allow it to use traffic, telemetry, logs and usage data generated by its service for its own business purposes. For this use, Vercel determines the processing under its privacy notice. Vercel's published data processing addendum does not cover the Hobby plan, so I do not claim that Vercel acts only on my instructions.
Connection data is required to deliver the site. A prompt, capture and API key are required for a drawing request. Your address and message are required if you want an email reply. Without them, the corresponding function cannot work.
Your browser and AI provider
Your keys, prompts and canvas stay on your device. When you draw, your prompt, API key and a capture up to 1024 pixels on its longest edge go straight from your browser to the provider you picked. Nothing passes through me and I keep none of it. What the provider does with it — retention, human review, training, transfers abroad — is set by its own terms and privacy notice.
API keys are stored unencrypted in your browser, so anyone with access to that browser profile can read them. Clear individual keys in Providers & model, reset the canvas in the app, or clear drawmebaby.com site data to remove everything.
In Playground, your prompt and, for revisions, the selected HTML document go to your chosen AI provider. Canvas images are not included. Generated versions stay in page memory until you reload or close the page; exported HTML files remain wherever you save them. The preview cannot read the app's provider keys or browser storage.
Three.js previews load the pinned library from cdn.jsdelivr.net. jsDelivr receives the module request and connection metadata, including your IP address. The app does not send API keys, prompts, generated HTML, or canvas content with those requests, and the preview omits the referrer header.
If a bundled Excalidraw font fails to load, the canvas may fetch it from the public esm.sh network.
Measurements
Umami counts visits and coarse events such as playing the onboarding demo, beginning key entry, and starting or completing a drawing. Key-entry events contain no typed value. It creates pseudonymous session identifiers. It uses the IP address for approximate location but does not store it. Vercel Speed Insights records anonymous Web Vitals on the public site only. Neither service receives API keys, prompts, images, canvas content, provider error text, custom URLs or private model identifiers.
No cookies, advertising, cross-site tracking, session recording or profiling are used. Only I can access the dashboards. Do Not Track is honoured. You can also turn off both measurements on this device, or turn them on again. Your choice is stored in this site's local storage.
Your rights
Depending on the law that applies to you, you may ask for access,
correction, deletion, restriction or portability, object to processing,
or complain to a data protection authority. Write to
info@drawmebaby.com; I will answer within 30 days. You can
delete local browser data yourself. Analytics records contain no name or
account that I could use to find an individual record.
drawmebaby is not aimed at children and does not knowingly collect their data. If you think a child's data was sent through the site, contact me. Never send an API key by email.