Privacy: what DrawDick records

Who is responsible

DrawDick is made and run by Opulent Studios. Questions about your data, and requests to remove it, go to abuse@drawdick.com.

Looking around, without an account

• Your answer to the 18+ question is kept on your device (in its local storage) and never sent to us. Saying you are under 18 stores nothing.
• The drawings you start, including any photo you draw on, are kept on your device as drafts (in your browser’s storage), so they survive a reload and starting a new one keeps the last. You can delete them from Open a saved drawing. They leave your device only if you save one to an account or download it yourself.
• The doodle model behind Surprise me and Finish it runs on your device: the site sends it to your browser the first time you use either, and your drawing is never sent anywhere to be finished.
• The site counts a few steps in its own database: a visit, the first stroke of a drawing, a download, a share, a QR code shown and a share card sent, and Finish it pressed, tried again and kept. Each count is just the day, the step and the tag of the link you arrived by (the ?r= in a link we made or posted). It records no cookie, no identifier, no address and nothing about the drawing. To count each visit once, your browser keeps that tag and a “counted” mark for the tab, until you close it.
• To see which links bring people who draw, finish and share, the site also records the steps of a drawing in its own database: a visit, the editor opening, a drawing started (with what was on the page, such as a starter or a background, and the tool of its first mark), an export asked for and made, a share button pressed, a link copied or a share sheet completed, and a drawing submitted. Each step is just the time, the step, and the ?r= tag and approved campaign and creative of the link your tab arrived by, with when it arrived. It carries a random number of its own, so it is not recorded twice, and a step about a drawing carries a random number made for that drawing, which your browser keeps beside it, and keeps for the last drawings you saved to your account or finished in it, so reopening one there continues it and a finished drawing is counted once. Neither number is your account, your drawing or its address, and no step holds the drawing, its name, its text or anything about you; a submission’s step says whether it is the account’s first, not whose. Your browser keeps the tab’s arrival time, campaign and creative with its tag, until you close it. Steps are deleted after 400 days.
• Vercel Web Analytics records page views, referring sites, and visitors’ countries and devices, and Vercel Speed Insights records how fast pages load. Neither sets a cookie, and of a page’s address they keep only the ?r= tag. Web Analytics keeps its records for one month.
• Reading the Dicktionary is counted the same way, by article: each time an article is shown, and when you follow one of its links to draw or to the campaign, follow its link to share on X, Reddit or by email, copy its link or complete your device’s share sheet from it. Each count is just the day, the article, what was done and the ?r= tag you arrived by. Following a share link or a campaign link is all that is counted: not whether anything was sent, or anything given. To count the first drawing you start after reading an article, your browser keeps which article you read last, and a “counted” mark, for the tab, until you close it.
• Links that open the editor with a challenge or something already on the page (drawdick.com/c/ and a name, or the cartoon starter’s editor) are counted the same way, by the link: each time one opens, and the first drawing you start after opening it. So is Surprise me in the editor: each doodle it draws, and the first drawing you start after it. Each count is just the day, the link’s name, what was done and the ?r= tag you arrived by. To count that drawing, your browser keeps which of these links you opened last, and a “counted” mark, for the tab, until you close it; and so that a reload does not ask again before putting a link’s drawing on your page, a mark that it has.

With an account

• Signing in sets cookies that keep you signed in, and following a confirmation or password-reset link from one of our emails sets one that completes it. Page scripts cannot read them, and signing out removes the sign-in ones. They are the only cookies the site sets itself.
• Your account holds your email address, a hash of your password (never the password itself), your username, when you confirmed you are 18 or older and which version of the content policy you accepted.
• Your drawings and their names are stored with your account. A published drawing, its name and your username are public; drafts and drawings under review are not. Your ratings are yours alone: other people see averages and counts, never who rated what.
• A report you make, with its reason, is seen by the admins, with your username.
• A photo you draw on is shrunk, re-saved and stripped of its location and camera details on your device before it goes anywhere, and a photo with a face in it is refused, also on your device. It is stored only as part of a drawing you save.
• If you submit a drawing after reading a Dicktionary article in the same tab, the submission names the article you read last and the ?r= tag you arrived by. The site never shows them to anyone, and they are deleted at the first decision on the drawing: if that is an approval, it is added to the article’s count, which says nothing about whose drawing it was.
• To show who is signed in without asking the server on every page, your browser keeps your username and account status in its local storage.

Training our drawing model

• DrawDick’s own drawing model, the one behind Surprise me and Finish it, learns only from drawings whose artists say it may. You choose for each drawing, with a tick as you submit it or later on My drawings, and it is off unless you tick it. Drawings by DrawDick’s admins are the exception: theirs are ticked by default, and an admin can untick any of them.
• Only the pen strokes of a published drawing are used: never a draft, a drawing in review, a photo, or a drawing that has been taken down, rejected or deleted. They are used only to train DrawDick’s own model, and are not published as a dataset or given to anyone else.
• You can withdraw it at any time on My drawings, and the drawing is left out of every training run after that. A model already trained on it is not retrained to forget it. We keep a record of when it was given and withdrawn.

Asking for a drawing to be removed

A removal request keeps the name, email address and details you give it, for the admins to act on and to keep a record of what was asked and done. It is not deleted automatically: ask us if you want it removed.

Services that handle data for us

• Vercel hosts the site (in the United States) and runs Web Analytics and Speed Insights. Its firewall limits how often one internet address can send changes, so it sees your address; the site itself never stores it.
• Supabase hosts the database, accounts and stored images (in the United States). Only the site’s server talks to it, never your browser.
• Cloudflare Turnstile checks that a person, not a script, is signing up, signing in, resetting a password, deleting an account or asking for a removal. Its check runs in your browser on those forms only.
• Resend sends the site’s emails: confirming your address and resetting your password, and the admins’ own emails about reports.
• Each of these services has its own privacy policy for what it does with what it handles.

Moderation records

• Every moderation decision (a submission, an approval, a takedown, a ban) is kept in a record the admins can read, so decisions can be checked later. When an account is deleted, it is no longer named in that record.
• A drawing an admin deletes is kept out of sight for 30 days, so a mistaken delete can be undone, and then deleted for good; it goes at once if its account is deleted.

Backups

Our database host, Supabase, backs up the database once a day and keeps each backup for 7 days. So something deleted can stay in a backup for up to 7 days, and then it is gone from backups too.

Deleting your account

Delete your account from your profile page, or ask us at abuse@drawdick.com. Your account, profile, drawings and ratings are deleted with it, and your published drawings are taken down. It cannot be done while your account is banned or while one of your drawings is waiting for review.

The Dicktionary and your drawings

The Dicktionary, our editorial section, does not show anyone’s drawings. Before it does, artists will be asked for permission that covers that use.