DRAFTLY · LEGAL

Privacy Policy

Effective May 16, 2026. Last updated August 27, 2026.

1. The short version

Draftly is a CAD application built for working drafters. We collect the minimum information needed to run the product: an email address if you create an account, the drawings you save to the cloud if you opt into sync, and basic technical information so the app keeps working. We do not sell your data, we do not run ad networks, and we do not train AI models on your drawings.

2. Who we are

Draftly is operated by Tyler Thompson (doing business as "Draftly"). When this policy says "we," "us," or "Draftly," it refers to that operator. You can reach us at [email protected].

3. What we collect

Information you give us

Account information. When you create an account, we collect your email address and a password (stored as a salted hash — we never see the plaintext). You may also provide an optional display name.
Drawings and project content. If you opt into cloud sync, the drawings, layers, dimensions, and other CAD artifacts you create are stored on our servers so they're available across your devices.
Billing information. Everything sold on draftlycad.com is charged by Stripe, which processes the payment and issues your receipt. Draftly never sees or stores your card number, expiry date or CVC. From Stripe we receive a customer and purchase identifier, the plan you bought, and the entitlement status (active, expired, refunded) — and the name, email and billing address you gave Stripe are included in the event Stripe sends us; “How long we keep it” below says how long that copy survives. If Draftly is later published on the Apple App Store or Google Play, those stores will process purchases made through them.
Support correspondence. If you email us we keep the thread so we can follow up.
Notify-me list. The download page offers to email you once, when a build that is still in development ships. If you use that form we store the address you typed and which platform you asked about — Windows, macOS or Linux — and nothing else. No name, no account, no tracking pixel in the message. You do not need a Draftly account to join the list and joining it does not create one, so for most people on it this address is the only thing we hold. It is used for exactly one message: the one saying that build is out. We do not sell it, rent it, add it to a newsletter, or hand it to an advertiser. To come off the list before then, email [email protected] and we delete the row.

Information we collect automatically

Device identifiers. A randomly generated device ID so a single account can sync across machines without collisions. This is not a hardware fingerprint.
Product analytics. A small set of server-side events — account created, account deleted, account data exported, export requested, purchase completed — recorded against your account id in PostHog so we can see which parts of the product are used and which are broken. Drawing contents are never included, and document identifiers appear only as hashes.
Server logs. Our API host records the method, path, status and duration of each request, along with a request id and your IP. Authorization headers, tokens and query-string values are stripped before anything is written.
Crash reports. When Draftly hits an error it cannot recover from, it sends us the error message, a shortened stack trace, the platform and app version, and — if the app had got far enough to have one — your account and device id. A crash before you sign in is reported without any identifier, because those are often the crashes worth knowing about most.
Reports go to our own servers. Draftly ships no third-party crash SDK: there is no Sentry, Crashlytics or Bugsnag in the app, and no crash data reaches a company other than the hosting providers listed below.
A stack trace can incidentally contain a file name or path from your machine. We do not go looking for it, we never send drawing contents, and reports are erased on the schedule in section 7.
Approximate IP address. Recorded transiently by our hosting providers for abuse prevention and routing. We don't build user profiles from it.
Marketing-site button clicks. The public pages on draftlycad.com — not the app — record which of a small, named set of buttons was pressed, and which page it was pressed on, so we can tell whether the download and pricing pages reach anyone. Loading a page sends us nothing: there are four events in total, three of them buttons and the fourth a completed “tell me when it ships” signup, and nothing is sent unless you press something. Each page load invents a random id in memory and forgets it the moment you navigate away. That id is never written to a cookie, to local storage or to session storage, which means it cannot be joined up across page loads, across tabs, or across any other site: two visits by one person are indistinguishable from one visit each by two people. No advertising network is involved, and nothing here is used to build a profile of you.
Cloudflare Web Analytics. These pages also carry one third-party script, and it is fair to name it rather than round it down to nothing. Cloudflare's edge adds its analytics beacon to every page on this site, including the app, and your browser loads it from static.cloudflareinsights.com. It counts page views. It sets no cookie, stores nothing on your device, and does not follow you to other sites — but it is still a request your browser makes to a third party, which is a different thing from a line in our own server log, and you are entitled to know it happens.

Information from third parties

Single sign-on providers. If you sign in with Google or with Apple, we receive the email address and basic profile information that provider returns. We do not request access to your contacts, calendar, or other services. Sign in with Apple lets you hide your real address, in which case Apple gives us a relay address and we never see the one behind it.
Payment and entitlement providers. Stripe tells us when a payment succeeded, failed, was refunded, or was disputed, and which plan it was for. RevenueCat, once store purchasing is live, reports the same about App Store and Google Play purchases. Neither sends us card numbers.

4. How we use it

To operate the app: authenticate you, sync your drawings, and deliver the features you signed up for.
To bill you accurately and provision the entitlements you've paid for.
To send transactional email — sign-in confirmations, password resets, receipts, and important account notices.
To fix bugs and improve performance, using aggregated diagnostic data.
To respond to support requests.
To comply with the law when we have a legal obligation to do so.

We do not use your drawings or account data to train machine-learning or AI models. We do not sell your personal information. We do not share it with advertisers.

We use a small set of vendors to operate the product. Each one receives only the data needed to do its job, under a contract that restricts its use.

Supabase — authentication and primary database (US-hosted Postgres). Stores your account record and, if sync is on, your drawings. It also holds the notify-me list described in section 3, in a table that has no link to any account.
Cloudflare — content delivery, DNS, and static hosting for draftlycad.com and the in-browser app. Its edge also counts page views for the marketing pages, without cookies and without an identifier that survives the page.
Render — backend API hosting (the service that accepts and serves drawing sync snapshots, and that receives the notify-me signups and the marketing button-click counts the public site sends).
Stripe — payment processing for every purchase made on draftlycad.com. Stripe receives your name, email, billing address and payment details directly; it sends Draftly a customer and purchase identifier, the plan, and the payment status. Stripe holds the card; we hold the identifiers it gives back. Stripe also issues and emails your receipt.
Supabase Auth — sends the transactional account email Draftly relies on: sign-in confirmations, email verification and password resets. Same vendor as the database entry above, acting in its email capacity.
PostHog — product and operational analytics. Receives a pseudonymous account identifier and event names such as "account deleted" or "checkout completed" so we can tell whether the product works. It never receives drawing contents, geometry, file names, or payment details.
RevenueCat — subscription entitlement reconciliation across Apple, Google, and web. Receives a user identifier so it can match store purchases to your account. It is not a payment processor for anything sold on this site and it never charges you.
PostHog — product analytics. Receives the server-side events listed above, keyed by your account id. It never receives drawing contents.
Apple — Sign in with Apple, when you choose it, which tells us the email address (or Apple relay address) and name you agreed to share. Apple also handles payment processing for purchases made inside a published App Store app; no Draftly store app is published today, and when one is, Apple's privacy practices govern the payment itself.
Google Play — payment processing for purchases made inside a published Play Store app, on the same terms as Apple.
Google — Google Identity when you sign in with Google, and Google's gstatic CDN, from which the in-browser version of the app at draftlycad.com/app/ loads its rendering engine and default font. This marketing site and these legal pages contact no Google host.

Transactional email — confirmations and password resets — is sent by Supabase Auth, which is already listed above. An earlier version of this policy named SendGrid as our email provider; it is not, and has never sent a Draftly email.

We may also share information when required by law (subpoena, court order, lawful government request), to defend our legal rights, or to protect the safety of users. If Draftly is ever acquired or transferred, account data may be transferred with the business — we'll notify you by email before that happens.

6. Cookies and local storage

On the marketing site at draftlycad.com, we use a minimal first-party cookie set — only what's needed for the Cloudflare edge to route requests. We do not use third-party advertising cookies.

The click counting described in section 3 sets no cookie of its own and writes nothing to your browser. Its per-page-load id lives in a JavaScript variable and dies with the page. That is the reason this site shows you no consent banner: there is no persistent identifier to ask you about.

Inside the application at draftlycad.com/app/, we store your session token, your unit and theme preferences, and a local cache of your drawings in your browser's local storage. You can clear that at any time from your browser's site settings.

7. How long we keep it

Account data and drawings: kept while your account is active. When you delete your account, your authentication record, your profile and the drawings in any workspace you own with no other members are deleted immediately, as part of the delete request itself — not on a 30-day timer. A workspace you share with other people is handed to one of them rather than destroyed, because the drawings in it are their data too; your name is removed from it, and a drawing you created inside someone else's workspace stays with that workspace with your name taken off it.
Payment provider event records: Stripe and RevenueCat send us an event for every purchase, renewal, refund and cancellation. We keep the raw event — which for Stripe includes the name, email and billing address you gave at checkout — for 30 days. After that it is erased and the record keeps only a fingerprint of the original event and the provider's own customer identifier, which is what lets us settle a dispute without holding your details. If you delete your account before the 30 days are up, those events are erased on the next scheduled run rather than waiting out the clock. The stripped record itself is removed 400 days after the event was processed.
Billing records: the provider identifiers and purchase status needed for tax and anti-fraud purposes are retained for the period applicable law requires (typically 7 years in the US). These are provider identifiers and a status, not your name or address.
Server logs: held by our API host for a matter of days, then rotated. They are keyed by request id and IP rather than by account, so they are not attributable to you.
Crash reports: written into those same server logs, and rotated away with them within days. We keep no separate crash database, so there is nothing to search months later and nothing that outlives the log rotation.
Product analytics: retained by PostHog under that project's retention setting.
Support email: kept for up to 24 months, or until you ask us to delete the thread.
Notify-me list: kept until the build you asked about ships and that one email has gone out, at which point the row is deleted. If a build is cancelled rather than shipped, the list for it is deleted instead and no email is sent. Ask to come off sooner and we delete it sooner.
Marketing-site button clicks: counts, with no identifier attached to them once the page is closed. There is no profile to age out and nothing to look you up by later.
Analytics events: held by PostHog under our account for as long as your account is active, and deleted when it is.

8. How we protect it

Passwords are stored as bcrypt-style salted hashes — we never see the plaintext.
Traffic between your device and our servers uses TLS 1.2 or higher.
Data at rest in Supabase is encrypted.
Access to production data is restricted and audited.

No service is 100% secure. If we ever experience a breach that affects your data, we'll notify you and the appropriate regulators as the law requires.

9. Your rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct information that's inaccurate.
Delete your account and personal information.
Export your drawings and account data in a portable format.
Object to certain processing, or withdraw consent where processing is based on consent.

Deleting your account is self-service: Settings → Account → Delete account, inside the app. It runs immediately: your authentication record, profile and the drawings in workspaces you own alone are destroyed as part of the request, and any live subscription must be cancelled or explicitly acknowledged first so you are not charged after the account is gone.

Exporting your drawings works from the app at any time and on any tier — save the .drft file, or use Export for PDF and SVG (DXF export is a Pro feature).

Coming off the notify-me list takes one email to [email protected]. There is no account to sign into, because joining the list never made one — tell us the address and we delete the row. The message the list eventually sends carries that same address to reply to.

Requesting an export of your account data is done by emailing [email protected]. We run it and send you a single JSON file containing your account record, devices, workspaces, drawings, entitlements, purchase records and audit history, together with a list of anything we withheld and the reason. Credentials — password hashes, session tokens, device push tokens — are never included, because a file that contains them is a file that can be used to impersonate you. There is no “Export my data” button in Settings yet; an earlier version of this policy said there was.

For any other request — access, correction, objection, withdrawing consent — email the same address. We'll respond within 30 days.

California residents. Under the CCPA you also have the right not to be discriminated against for exercising these rights. We do not sell personal information.

EEA, UK, and Swiss residents. Our legal bases for processing under the GDPR are: contract (operating the service you signed up for), legitimate interest (improving the product and preventing abuse), legal obligation, and consent (where we ask for it). You have the right to lodge a complaint with your local supervisory authority.

10. Children

Draftly is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has provided us with personal information, contact us and we'll delete it.

11. International users

Draftly is operated from the United States. If you use the product from outside the US, you understand that your information will be transferred to and processed in the US, where data-protection law may differ from your home jurisdiction.

12. Changes to this policy

We may update this policy as the product evolves. When we make a material change we'll update the "Last updated" date at the top and, for substantial changes, notify you by email or an in-app notice before the change takes effect.

13. Contact

Questions about this policy or about your data? [email protected].