Privacy Policy

• Your projects are saved in your own browser. They are not uploaded to our servers.
• If you sign in with Google, we receive your name, email address and profile picture, and use them only to sign you in and show your profile.
• When you use the AI features, what you ask for (and any drawing or picture you send with it) goes to OpenAI to create the result. We don't keep it.
• We don't sell your information, show ads or use advertising trackers.

Account information from Google. Signing in is optional. If you sign in with Google, Google shares your name, email address, profile picture and a unique account identifier with us. We use this to sign you in, show your name and picture in the app, and apply AI usage limits to your account. It is kept in an encrypted sign-in cookie in your browser; we don't keep a separate database of accounts.

Your projects and settings. Your drawings, animations, pictures you add, canvas settings, theme and similar preferences are stored in your browser's local storage (IndexedDB and localStorage) on your device. This is the same whether you are signed in or using Stroke as a guest. We cannot see this information unless you send part of it to an AI feature, as described below.

What you send to AI features. When you use the agent or other AI tools, we send your messages and prompts, basic details about the current canvas (such as its name and how many layers and animations it has), and any drawing or picture you ask it to work from. These pass through our server to OpenAI, which generates the reply, drawing or picture. We don't store this content after the result is returned.

Usage counts. To keep the AI features available and prevent abuse, we count AI requests per minute and per month. Each count is tied to your account identifier (or, if you are not signed in, your IP address). Counts expire on their own, the longest after about a month.

Technical information. Like any website, our hosting provider receives your IP address, browser type and the pages you request when you use Stroke, and keeps request logs to deliver and protect the service.

We use the information above only to:

• provide Stroke, including signing you in and showing your profile;
• create the drawings, pictures, diagrams and animations you ask the AI features for;
• apply usage limits, prevent abuse and keep the service secure;
• answer you when you contact us.

We don't sell or rent personal information, use it for advertising, or build profiles about you.

Stroke asks Google only for basic sign-in information: your name, email address, profile picture and account identifier (the "openid", "email" and "profile" permissions). We don't ask for access to Gmail, Google Drive, your contacts or any other Google data.

Stroke's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this information only to provide sign-in and show your profile in Stroke. We don't transfer it to others except as needed to run the service, don't use it for advertising, and don't let people read it except where you ask us to, it is needed for security, or the law requires it.

Stroke uses these providers to work. Each receives the information needed for its part and handles it under its own privacy policy:

• Google: sign-in, and the fonts you pick for text, which your browser loads from Google Fonts. Google Privacy Policy
• OpenAI: generating replies, drawings and pictures for the AI features. OpenAI Privacy Policy
• Vercel: hosting the website and app. Vercel Privacy Policy
• Iconify: the icon library. When you browse or search icons, your browser requests them from Iconify. Iconify Privacy Policy
• Openverse: the image library. When you search pictures, your browser requests results from Openverse, and the pictures themselves from the sites that host them. Openverse Terms and Privacy

We may also share information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of the service, in which case this policy would continue to apply to it.

If you sign in, we set cookies that are needed for signing in to work: an encrypted session cookie, a cookie that protects sign-in forms against forgery, and one that remembers where to return you after signing in. We don't use advertising or analytics cookies.

Your projects and preferences are kept in your browser's local storage, as described above. You can remove them at any time by deleting projects in Stroke or clearing your browser's site data.

• Sign-in cookies last until you sign out or the session expires.
• Projects and preferences in your browser stay until you delete them or clear your browser's data.
• AI content is not kept by us once the result is returned.
• Usage counts expire on their own, the longest after about a month.
• Our hosting provider keeps request logs for a limited time under its own policy.

• You can use Stroke without signing in.
• You can sign out at any time, which removes the sign-in cookies.
• You can delete projects in the dashboard, or clear all of Stroke's data from your browser settings.
• You can remove Stroke's access to your Google account at any time from your Google Account permissions.

Depending on where you live, you may have rights to access, correct, delete or object to the use of your personal information, or to complain to a data protection authority. Because we keep very little information on our servers, most of it is already in your control. For any request or question, contact us at support@stroke.design.

Stroke is served over encrypted HTTPS connections, sign-in cookies are encrypted, and the keys for our AI provider are kept on our server rather than in your browser. No method of storing or sending information is completely secure, but we work to protect the information we handle.

Stroke is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us at support@stroke.design and we will delete it.

Our providers may process information in the United States and other countries where they operate, which may have different data protection laws from where you live. We rely on these providers' safeguards for such transfers.

We may update this policy as Stroke changes. When we do, we will change the date at the top of this page, and for significant changes we will give notice on the website or in the app.

Questions or requests about this policy or your information: support@stroke.design.