Privacy

Last updated 19 August 2026

The short version

This is a personal project, not a company. It stores the drawings you make and the minimum needed to know who you are. Nothing is sold and nothing is shared with advertisers. It does use Google Analytics to count visits, and that stays switched off unless you agree to it. Your work is private to your account unless you deliberately turn on a share link. If you want a copy of your data or want it gone, email info@puncoz.com and ask.

Who runs this

Dev Tools is run by one person as a personal side project. There is no support team behind it — the contact address below reaches an individual.

What is stored

Your account

Signing in goes through WorkOS AuthKit. This site never sees or handles your password. When you sign in, a copy of your profile is kept here so pages can render without calling out to WorkOS on every request: your email address, whether that address is verified, your first and last name, a URL to your profile picture, and the time you last signed in.

Whether you are allowed in

Having an account and being allowed to use the tools are separate things. A new sign-in starts as pending and has to be approved. Each account therefore also carries its access status, the note the administrator attached to the most recent decision, and any message you wrote when reapplying. Those decisions are kept as an append-only history with timestamps, so a decision made months ago still has its reason attached. That history includes notes written about you by an administrator.

What you make

• Each drawing's title, its full document, and when it was created and last changed.
• A preview image for the gallery. It is rendered in your browser from the drawing itself and stored as a small WebP.
• A share token, if you have ever switched sharing on for that drawing.
• Whether the drawing is in the trash, and when it was put there.

Images you place on a canvas are handled one of two ways. If you have configured your own storage bucket, they are uploaded from your browser straight to that bucket and never pass through this site's servers. If you have not, they are embedded inside the drawing itself and so are stored in the database along with it.

Your storage settings, if you use them

The draw tool can be pointed at object storage you own — S3, Cloudflare R2 or Supabase Storage. Doing so stores the provider, endpoint, region, bucket name and optional public URL, plus the access key and secret needed to reach it. Those last two are encrypted with AES-256-GCM before they are written to the database and are never sent back to your browser, not even to fill in the settings form. You can clear them at any time from Settings → Storage.

Technical data

The site is hosted on Vercel, which handles requests and keeps ordinary server logs — that includes IP addresses, as it does for any website. Page performance and visit counts are measured with Vercel Analytics and Speed Insights, both of which are aggregate and cookieless: they do not set an identifier, do not follow you to other sites, and do not build a profile of you.

Google Analytics is used as well, and it is not cookieless — which is why it is off until you say otherwise. It records the pages you visit, roughly where in the world you are, your browser and device, and how quickly pages loaded. See Cookiesbelow for what is and is not stored before you answer.

Cookies

Signing in uses one cookie, holding your encrypted session. It exists so you stay signed in between visits, and there is no way to offer accounts without it. It is not a tracking cookie and there is nothing to consent to.

Google Analyticsis the reason this site now asks. It is loaded with Google's consent settings denied, so until you press Accept it stores nothing on your device: Google is told a page was viewed, and nothing that identifies you or follows you anywhere else. Accepting lets it set its usual cookies. Declining is remembered, so the question is asked once rather than on every visit.

The advertising signals Google offers alongside this — ad storage, ad personalisation, ad user data — are switched off in code and are not part of what accepting turns on. Nothing here runs ads.

Who else has access

Data is processed by the services this site runs on. Each holds only what it needs:

• WorkOS — sign-in and identity. Holds your email, name and password.
• Supabase — the Postgres database, so it holds everything described above.
• Vercel — hosting, server logs, and the cookieless analytics.
• Google — Analytics, and only if you accept. It sees which pages you visit and how they performed, never your drawings or what is in them.
• Your own storage bucket, if you set one up — holds the images you upload. It is your account with that provider, under their terms, and you control it.

The drawing canvas itself is tldraw, which runs entirely in your browser. It does not send your drawings anywhere. Nothing you make here is ever sent to Google or to anyone else — the analytics above sees pages, not content — and none of it is ever sold.

Sharing a drawing

Sharing is off for every drawing until you switch it on. When you do, that one drawing becomes readable by anyone holding the link, without signing in — the token in the URL is the secret, so treat the link as the permission it is. Revoking takes effect on the next request. Moving a shared drawing to the trash makes its link stop working, and restoring it makes the same link work again; deleting a drawing is not a way to unshare it, the share controls are.

Pasting a share link into a chat app or a social network makes that service fetch a preview image of the drawing, so the link shows what it points at rather than a bare URL. Those services keep the picture on their own systems. Revoking a link stops the page from loading, but it cannot reach into a preview that has already been posted somewhere — treat sharing a link into a public channel as publishing the picture, because that is what it is.

How long things are kept

Deleting a drawing moves it to the trash rather than destroying it, so a mistake is recoverable. It stays there — with its document, preview and share token intact — until you delete it permanently or empty the trash. Nothing expires on a timer and nothing is purged automatically, which means nothing disappears without you asking, and also that anything you leave in the trash is still stored. Your account and its access history are kept for as long as the account exists.

Security

Everything is served over HTTPS. Storage credentials are encrypted before they are stored. Every query for a drawing is scoped to the account that owns it, so a drawing belonging to someone else answers exactly as one that does not exist. No safeguard is perfect, and this is a personal project rather than an audited service — please do not keep anything here that would genuinely hurt to lose or to leak.

What you can ask for

You can ask for a copy of what is stored about you, ask for it to be corrected, or ask for your account and everything in it to be deleted. Email info@puncoz.com and say which. Deletion is permanent and includes your drawings, so export anything you want to keep first. Depending on where you live you may have further rights under laws such as the GDPR; the same address is where to exercise them.

Children

This site is not intended for children, and accounts are not knowingly created for anyone under 16.

Changes

If this policy changes, the date at the top changes with it. If a change materially affects what is stored or who can see it, active accounts will be told by email rather than left to notice.

Contact

Questions, requests or complaints: info@puncoz.com.