Privacy Policy
We collect the minimum data needed to run Drawer. We don't sell it. Here's exactly what we collect, why we have it, and what you can do about it.
1. Information We Collect
1.1 Account data
- Your email address (from GitHub or Google OAuth).
- Provider-specific user ID (GitHub numeric ID or Google
sub). - Your chosen display handle.
We do not store your OAuth access tokens beyond the brief session needed to create your account; your password lives at GitHub or Google.
1.2 Content data
- Artifact files you publish (stored in Cloudflare R2).
- Artifact metadata: title, visibility, timestamps, version history.
- API keys and their scopes. Keys are stored as salted SHA-256 hashes with a server-side pepper; the plaintext value is shown to you once at creation and is not retrievable thereafter.
1.3 Workspace secrets
- Secret names, header templates, allowed hosts, last-used timestamps.
- Secret values are encrypted at rest with AES-GCM and are not retrievable in plaintext. We cannot show them back to you. We do not include them in logs, error messages, or analytics events.
1.4 Connection data
- IP address (used for rate limiting and audit logs; retained ~90 days then rotated).
- Browser user-agent string.
- Session cookies (see section 4).
1.5 Usage analytics
We send anonymized usage events to PostHog (page views, feature usage, errors). Personally identifying information is excluded from analytics event properties — we do not send artifact contents, secret values, or request bodies. See our docs/observability.md in the source tree for the event schema.
1.6 Billing data
- Subscription status and Stripe customer ID.
- We do not store credit card data. Stripe holds payment instruments directly. Stripe's privacy policy applies: stripe.com/privacy.
2. How We Use Your Data
- Operate the service: authentication, publishing and reading artifacts, MCP routing, billing.
- Rate-limit and audit for abuse.
- Improve the product via aggregate analytics.
- Communicate about service updates, security incidents, and billing matters.
3. Third Parties We Share With
- Cloudflare — hosting, edge network, R2 storage, D1 database, Email Routing. cloudflare.com/privacypolicy.
- Stripe — payment processing. stripe.com/privacy.
- PostHog — product analytics. posthog.com/privacy.
- GitHub / Google — OAuth identity, only at sign-in time. Their respective privacy policies apply.
- Third-party APIs you connect via workspace secrets — Drawer proxies requests to upstream providers (e.g. OpenAI, Anthropic) you have chosen to integrate. Those providers see the request content and are governed by their own privacy policies.
We do not sell personal data to advertisers or data brokers.
4. Cookies and Local Storage
drawer_session— HTTP-only, secure. Keeps you signed in. Expires after extended inactivity or when you sign out.drawer_anon— anonymous identifier used to stitch pre-login PostHog events to your eventual user identity after sign-up. Cleared on sign-out.drawer_csrf— double-submit CSRF token for session-authed write endpoints.
We do not set third-party advertising cookies. Cloudflare may set __cf_bm or similar bot-management cookies on its own behalf; see Cloudflare's privacy policy.
5. Data Retention
- Account and artifacts — kept until you delete them or your account.
- Deleted artifacts — index rows removed immediately; R2 objects removed within 7 days.
- Deleted accounts — 30-day grace period during which we can restore on your request, then hard-deleted (account row, artifact rows, R2 objects, Stripe customer record).
- Audit logs — 1 year.
- PostHog analytics — governed by our PostHog plan retention, currently 12 months.
- Stripe billing records — retained per Stripe's policy and US tax requirements (typically 7 years).
6. Your Rights
The rights below apply to all users. We explicitly honor GDPR (EU/UK) and CCPA/CPRA (California) requests.
- Access — see what we have. Email legal@drawer.so and we will respond within 30 days.
- Export — download your artifacts at any time via the CLI (
drawer read) or REST API. - Rectification — change your handle in the dashboard at any time; other corrections via email.
- Deletion ("Right to be forgotten") — delete your account from the dashboard (when available) or by emailing legal@drawer.so. We will delete within 30 days unless legally required to retain (Stripe billing records; audit logs of acceptable-use violations).
- Portability — artifacts can be exported in their original form.
- Object to or restrict processing (GDPR) — contact legal@drawer.so.
- Opt out of sale (CCPA) — we do not sell data, so this is automatic. You have the right to know.
- Do Not Track — we do not currently respond to DNT signals beyond honoring cookie preferences.
7. Children
Drawer is not directed at children under 13 (COPPA). If you are a parent and believe your child has created an account, email legal@drawer.so and we will delete it.
8. International Transfers
Drawer is operated from the United States. By using Drawer from outside the US, you consent to processing in the US. For EU users, Cloudflare's Standard Contractual Clauses (SCCs) apply for data leaving the EU; see Cloudflare's privacy policy.
9. Security
We use:
- AES-GCM encryption for workspace secrets at rest, with per-user derived keys;
- Salted SHA-256 with server-side pepper for API key storage;
- PBKDF2 with salt for artifact passwords (100,000 iterations, the Cloudflare Workers WebCrypto cap);
- HMAC-signed session cookies;
- Double-submit CSRF tokens on session-authed write endpoints;
- Per-IP and per-account rate limiting backed by D1;
- Audit logging of sensitive actions.
No system is perfectly secure. Report vulnerabilities to legal@drawer.so. We will not pursue good-faith security research.
10. Data Breach Notification
In the event of a data breach affecting your information, we will notify affected users via email within 72 hours of discovery, or faster where required by law.
11. Changes to This Policy
Material changes will be posted here with at least 30 days' notice and emailed to your registered address. The effective date at the top reflects the current version.
12. Contact
Privacy questions: legal@drawer.so.