Privacy policy

DRAFT — needs legal review. Draft of 24 October 2026. Highlighted parts are still to be confirmed.

Drawzo is a drawing game: you and another player draw the same thing, and an AI judges whose doodle it recognises better and faster. Drawzo is run by Fida ur Rehman, Rawalpindi, Pakistan ("we"), who decides how your data is used (the "controller"). Questions: [email protected].

Who Drawzo is for

Drawzo is for people aged 13 and over. If you are under 13, please do not use Drawzo. If we learn that we hold data from a child under 13, we delete it.

What we collect

Your drawings, saved as strokes: the points your finger drew and when, the prompt, and the size of your canvas. Never photos or screenshots.
A random ID, never your name, created by the app or this website. In the game you also get a random player name (like "Brave Otter 27"), a sign-in token and a deletion code. We store the token and the code only in scrambled (hashed) form.
Your profile choices (in the app, Profile › Edit): a player name you pick instead of the random one (3 to 18 letters or numbers; we check it against a list of rude, hateful and misleading words and keep when you last changed it, for the limit of 3 changes a week), the avatar you pick from the drawn ones, and whether other players may see your stats.
Your gender, only if you choose to give it (Boy, Girl or Prefer not to say; "Prefer not to say" unless you change it). It is private: we use it only to suggest avatars, and it is never shown to other players or sent to anyone else.
Game data: your rounds, the AI's guesses and scores, challenge links you share, and your Daily Draw streak.
Safety data: reports you make (from a fixed list of reasons), with a copy of the reported drawing, and players you block.
Usage events, such as "match started" or "shared a link", with the time, to see whether the game works and how much it costs to run.
Your IP address, used briefly to limit abuse (rate limits) and in server logs kept for 30 days.
If you sign in with Google, Apple or email (optional, in the app): which sign-in you used (the provider), the account ID Firebase gives it (the Firebase uid) and the email address the provider shares with us. We never see your password.
If you allow notifications (in the app): your device's push token from Firebase Cloud Messaging (FCM), its platform (Android or iOS), the app version, your language setting (locale) and your timezone (such as "Asia/Karachi"). The timezone is a coarse location: we use it only to send notifications at a sensible local time and never between 22:00 and 08:00. We also keep your notification choices and, for 7 days, which notifications we sent you each day so we never send one twice.

Unless you sign in, we do not ask for your name or email. We never ask for your phone number, photos or contacts, and never your precise location (GPS); the only location we know is the timezone your device reports if you allow notifications. There is no chat or free text anywhere in Drawzo: the only words you can type are your player name, which is checked before anyone sees it and can be reported by other players.

How we use it, and why we may

Data protection law (such as the GDPR) needs a legal basis for each use. Ours, for each use:

To run the game (start rounds, judge drawings, keep score, make challenge links work, turn a winning drawing into an AI picture): needed to provide the game you asked for (contract).
To keep Drawzo safe (review reports, remove drawings, enforce blocks, stop cheating and abuse, rate limits and server logs): our legitimate interest in a safe, working service.
To count things in total (for example how many players come back the next day) and to know what the game costs: our legitimate interest in improving Drawzo.
To train and test the AI that recognises doodles, and to replay drawings as opponents ("ghosts") shown with a random ID, never your name: for doodles from this website, your consent on the welcome screen before drawing (you can withdraw it by deleting your doodles); for game drawings, our legitimate interest in a better recogniser, which you can object to at any time with one switch in the app (see "Your drawings and the AI judge" below).

The AI picture is made by Runware (runware.ai, United States) or, if Runware is unavailable, by fal.ai (Features & Labels, Inc., United States). Whichever makes it receives your drawing, as an image, and the picture's text prompt, and uses them to create the picture for us. The finished picture is stored in a private Cloudflare R2 bucket (Cloudflare, Inc.), under a random name with no player ID, and is shown through links that stop working after one hour. Sign-in and notifications, if you use them, are provided by Google (Firebase Authentication and Firebase Cloud Messaging) and, for Sign in with Apple, by Apple. We never sell your data and do not show ads based on it.

Your drawings and the AI judge

Drawings may be used to improve our drawing recognition; you can turn this off in Settings. In the app it is Settings › Privacy › "Help improve Zo with my drawings". It is on unless you turn it off, and your choice is kept with your player on our server.

What is used: only the strokes of your drawing, the word you were asked to draw, and whether Zo recognised it. Never your player ID, player name, email, device ID or when you played.
What is never used: drawings of written words, drawings with implausible timing, and drawings that were reported (until a moderator dismisses the report) or removed.
Turning it off keeps all your drawings, including the ones you made before, out of every training set we make from then on. Turning it back on lets them in again.
Deleting your account deletes your drawings, so they are left out of every training set we make from then on.
AI models already trained are not changed. If an AI model was trained before you turned this off or deleted your account, it keeps what it learned from your drawings; we cannot take that back out of an existing model. Your drawings themselves are not kept in the model, and they are not used to train any new one.

Questions or objections: [email protected].

Who can see it

Anyone you send a challenge link to sees your random player name and your drawing. Links can be played for 7 days.
Players who race your drawing as a ghost see it with a random ID, never your name.
Other players can open your profile from your name or avatar (on results, leaderboards, match history and notifications). It shows your player name, avatar, level, the drawings you published and, unless you turn it off under Settings › Privacy › "Show my stats to other players", your games, wins, win rate, streaks, fastest drawing and favourite kind of word. It never shows your gender, email or how you sign in. Players you block, and players who block you, cannot open it.
Your solo game drawings can be raced by other players who find nobody free. They see the drawing with your generated player name and avatar (never your real name), and you see their name and drawing in your match history. You can turn this off at any time in the app under Settings › Privacy › "Let others race my drawings"; your drawings stop being raced at once.
Companies that run Drawzo for us: hosting (Hetzner Online GmbH, European Union; Cloudflare, Inc. for the website, the network and storing AI pictures in Cloudflare R2), the AI image providers (Runware and fal.ai), Google LLC (Firebase Authentication for sign-in and Firebase Cloud Messaging for notifications, United States) and Apple Inc. (Sign in with Apple). They may only use the data to provide their service to us.

International transfers

Our providers may process data outside your country, for example Runware, fal.ai, Cloudflare and Google (Firebase) in the United States, and Apple if you use Sign in with Apple. Where data leaves the European Economic Area or the UK, we use the safeguards the law requires, such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework where the provider is certified. Ask us for a copy.

How long we keep it

Game data: until you delete your account.
Accounts linked to a Google, Apple or email sign-in: kept until you delete them; we never delete them for inactivity.
Guest accounts (not linked to a sign-in) with no game played and no usage event for 12 months are deleted automatically, with their data.
Usage events: 13 months, then deleted automatically.
Doodles drawn on this website: until you ask us to delete them; they are part of the dataset that trains the AI.
Reports: kept as a safety record. When a drawing is deleted, the copy in a report goes with it, unless we removed that drawing for breaking the rules.
Backups: kept for 35 days. Deleted data disappears from them when they are replaced; we never restore deleted data from a backup.
Exported datasets: copies of the drawings used to train the AI (doodles from this website, and game drawings of players who left "Help improve Zo with my drawings" on). Deleted and removed drawings, and the drawings of players who turned that setting off, are left out of every new export, and we delete older copies within 30 days. AI models already trained are not changed: they keep what they learned, but not your drawings.

Your rights

Depending on where you live, you have the right to:

access the data we hold about you, and get a copy;
correction of data that is wrong;
erasure: have your data deleted (see below);
objection to uses based on our legitimate interest, such as training the AI on your game drawings (you can also turn that off yourself in Settings);
restriction: ask us to pause a use while a request is checked;
portability: get the drawings you gave us in a machine-readable format;
withdraw consent at any time, for uses based on it;
complain to a supervisory authority, such as the data protection authority where you live or any other authority that is competent for you.

Write to [email protected]. Because we do not know your name, we will ask for your player ID and deletion code (app → Settings) to check the data is yours.

Deleting your data

In the app, once available: Settings → Delete my account. This deletes your player, rounds, drawings, challenge links, AI pictures, usage events, linked sign-in accounts (provider, Firebase uid and email) and push tokens at once, and keeps your drawings out of every later training set. Without the app, or for doodles drawn on this website, use the deletion page with your deletion code.

Removing a drawing from your public gallery (Remove in the app) also deletes its AI picture for good, from our storage and from your album; the drawing itself stays in your history. If the picture is still part of an open challenge link, a live match or a report a moderator has not decided yet, it stops being shown at once and is deleted when that ends.

Security

Data travels over HTTPS. Sign-in tokens and deletion codes are stored only as hashes, and admin tools need a secret key.

Changes

We will update this page and its date when things change. If we want to use your drawings in a new way, we ask again first.

Credits

Drawzo's prompts and AI recogniser are adapted from the Quick, Draw! dataset by Google, used under the CC BY 4.0 license. Google does not endorse Drawzo, and no endorsement is implied.