DRAWFORTWO
Privacy and your shared canvas
Last updated 3 October 2026. This notice describes the current drawing service. For privacy requests, contact hey@drawfortwo.com. This notice describes how the drawing service handles data; operator details are listed on the Legal notice page.
hey@drawfortwo.comWhat the service stores
For shared rooms, the service stores an invitation code, creation time, two random membership tokens, drawing strokes and undo events. Recent connection times and canvas pointer positions are used to show whether your partner is present. DrawForTwo does not ask for names, email addresses, camera access or audio.
Browser storage
Your browser stores a membership token for each room so you can rejoin your existing place. The drawing itself is stored on the service, rather than only on your device. A practice drawing outside a room lives only in the current page until you download it.
Who can access a drawing
Your drawing is available to the two room memberships. A person with your invitation can take an empty place. Treat the invitation and browser membership token as private. Site operators and infrastructure providers may process stored data to run, secure and troubleshoot the service. Drawing data is not end-to-end encrypted.
Retention and deletion
Shared room data remains in active storage until its creator deletes the room using the invitation panel. Deletion removes the room, its drawing events and both memberships. Infrastructure backups or security logs can have separate provider retention. A PNG downloaded by either person is under that person’s control.
Hosting and security data
The site is hosted through ChatGPT Sites and Cloudflare infrastructure. Providers may process technical request data such as IP addresses and browser information to deliver and secure the service. When available, a daily hash of an IP address is used for short-lived room-creation rate limits; raw IP addresses are not stored in the application rate-limit table.
Optional analytics
No Google Analytics property is active until a dedicated DrawForTwo measurement ID is configured. If enabled, Analytics loads only after you accept optional analytics. Rejecting does not prevent drawing. You can change the choice through Analytics preferences and withdrawing consent reloads the page with collection disabled. Advertising and advertising personalization are disabled.
Your rights and contact
Depending on applicable law, you may have rights to access, correct, erase or restrict personal data, or object to its use. The creator can delete a room directly. Email hey@drawfortwo.com for privacy requests. Describe the request and how you used the service; do not send your browser membership token. We may need information to verify that a request relates to your room before taking action. You may also contact your competent data protection authority. The operator’s full legal identity and postal address remain to be published on the Legal notice page.