Privacy Policy
Effective date: 13 August 2026.
This policy explains what personal data Draw Daily collects, why we collect it, and what you can do about it. It covers the website at drawdaily.app, the daily lesson email, and optional accounts. For who publishes the site and where it is hosted, read the Legal Notice. For the rules of using it, read the Terms of Use.
Who we are
Draw Daily is published by DFRT Limited, a limited liability company incorporated in Hong Kong (Body Corporate). In this policy, "DFRT Limited", "we", "us" and "our" all mean that company, and "you" means the person reading the site or receiving the email.
- Registered office: Unit 2A, 17/F, Glenealy Tower, No. 1 Glenealy, Central, Hong Kong.
- Hong Kong Business Registration Certificate Number: 78908767-000-10-25-1.
- Email: hello@drawdaily.app
We are the data controller for the personal data described here. We are a small operation and we have not appointed a data protection officer, because we are not required to have one. Email is the only way to reach us, and it goes to an inbox a person reads.
The short version
Draw Daily is free. There is no paid tier and nothing to buy, so we never collect card or billing details. For most people the only personal data we hold is an email address and the date they signed up. We do not sell personal data, we do not hand it to anyone for their own marketing, and we do not build advertising profiles. Every email we send carries a one-click unsubscribe link, and using it deletes your record.
What we collect, and when
1. Newsletter subscription
When you subscribe to the daily lesson, we store your email address and a signup timestamp. That is the whole record. We do not ask for your name and we do not save your IP address next to it.
The signup form does carry one hidden field, which only automated bots tend to fill in. If anything appears in it we drop the submission. It is a spam check rather than a way of learning something about you, and nothing typed into it is stored.
2. Optional account
You can create an account if you want to track your practice. Sign-in is passwordless: you type your email address, we send you a one-time link that expires after an hour, and clicking it signs you in. No password for your account exists anywhere, so there is none for us to lose. What we hold is your email address plus the standard authentication metadata our auth provider creates: a user identifier, creation and update timestamps, and the time you last signed in.
3. Lesson completions
If you are signed in and you press "mark as complete" on a lesson, we store three things: your user identifier, the lesson identifier, and the time you marked it. Those records draw the streak counter, the completion heatmap, and the day-of-week and time-of-day charts on your account page. Nothing else about your practice is recorded, and we never see your drawings. There is no way to upload one.
4. IP address, used for rate-limiting and never stored
To stop automated signup abuse, we limit each IP address to three signups every ten minutes. The address sits in the memory of the server handling the request for the length of that ten-minute window, and it goes when the server instance recycles. It is never written to our database, never saved to a file by us, and never linked to your subscription.
5. Server request logs
Our hosting provider keeps short-lived request logs for the site and its serverless functions, the way any web host does. We look at them to investigate errors and abuse, and for nothing else.
That is the complete list, and all of it comes from you. We do not buy personal data and nobody else supplies it to us.
Handing any of it over is voluntary. You can read every lesson on the site without telling us anything at all. Without an email address we cannot send you the daily lesson, and without an account we cannot keep a streak for you, but nothing else changes.
Why we use it, and our legal basis
Where the EU GDPR or the UK GDPR applies to you, these are the legal bases we rely on.
| What we do | Data used | Legal basis |
|---|---|---|
| Send you the welcome email and the daily lesson email | Email address, signup timestamp | Your consent, given when you type your address into the signup form (Article 6(1)(a)). You can withdraw it at any time. |
| Create your account and send sign-in links | Email address, authentication metadata | Performance of a contract, since the account is the service you asked for (Article 6(1)(b)) |
| Show your streaks, heatmap and practice charts | User identifier, lesson identifier, completion timestamp | Performance of a contract (Article 6(1)(b)) |
| Rate-limit signups | IP address, in memory only | Our legitimate interest in keeping the signup form from being abused by bots (Article 6(1)(f)) |
| Keep the site running, fix errors, deal with abuse | Server request logs | Our legitimate interest in a working, secure service (Article 6(1)(f)) |
| Count page views in aggregate | Analytics data that does not identify you | Our legitimate interest in knowing which lessons and guides people read (Article 6(1)(f)) |
No profiling, no automated decisions
We do not make automated decisions about you that produce legal effects or anything similarly significant, and we do not profile you for advertising. The streak counter, the heatmap and the charts on your account page are simple counts of records you created yourself by pressing "mark as complete". They are shown to you and to nobody else.
No personal data goes to the AI provider
The lesson text on Draw Daily is generated by an AI model (OpenAI GPT-4o) and the reference sketch images are generated by an AI image model (OpenAI gpt-image-2). We say so plainly, and we are just as plain about the limits of it: no subscriber or user personal data is sent to OpenAI. The generation prompt contains lesson parameters (level, skill focus, duration, difficulty) and a list of drawing subjects already used, so the model avoids repeating itself. Your email address, your account and your completion history are not part of it and never leave our own systems for this purpose. Our Terms of Use says more about how the lessons are made and how much to trust them.
Who processes data on our behalf
| Provider | What they do for us | Where processing happens |
|---|---|---|
| Supabase | Database, file storage for the reference images, and authentication | European Union (Ireland, eu-west-1) |
| Vercel | Website hosting, serverless functions, privacy-friendly analytics | United States, served from a global edge network |
| Resend | Sends the daily lesson email, the welcome email and sign-in link emails, delivered over Amazon SES infrastructure | United States |
| ImprovMX | Forwards inbound mail sent to hello@drawdaily.app | Outside Hong Kong, so we treat it as an international transfer |
| OpenAI | Generates the lesson text and the reference images | United States. Receives no personal data at all. |
These providers act on our instructions and may not use your data for their own purposes. That is the full list. We do not sell personal data, we do not rent it out, and we do not pass it to anyone for their own marketing. We would disclose data only where the law required it, for example in response to a valid legal order.
International transfers
We are in Hong Kong, our database is in the European Union, and several of our providers process data in the United States. If you are in the EEA or the UK, that means your data is transferred outside your region. Where it is, we rely on the data protection terms each provider offers, including the standard contractual clauses where they apply. The scope is small: an email address, and for account holders a list of completion timestamps.
How long we keep it
- Subscriber record: until you unsubscribe. Every email we send carries a working one-click unsubscribe link, and unsubscribing deletes the row from the database. It is not flagged as inactive and quietly kept, so afterwards we no longer hold your address.
- Account and authentication data: until you ask us to delete the account. Email hello@drawdaily.app and we will remove it.
- Lesson completions: deleted automatically with the account they belong to.
- IP address used for rate-limiting: held in server memory for the ten-minute window and never written down.
- Server logs: kept briefly by our hosting provider under their standard retention, then discarded.
Your subscription and your account are separate records. Unsubscribing stops the emails and removes you from the mailing list, but it does not delete an account you created, and deleting an account does not by itself unsubscribe you. Ask us for both and you will get both.
Cookies and similar technologies
If you sign in, an authentication session token is stored in your browser so you stay signed in between visits. It is strictly necessary for the account feature to work, and it is the only thing we put there.
We also use Vercel Web Analytics to see how many people read which pages. It is privacy-friendly by design: it produces aggregate page-view figures and does not use cookies to follow individuals from site to site.
There are no advertising cookies on Draw Daily, no third-party marketing trackers and no cross-site tracking. That is why the site does not confront you with a consent wall.
Your rights under the GDPR and UK GDPR
If you are in the EEA or the UK, you have the right to:
- ask for access to the personal data we hold about you, and a copy of it;
- have inaccurate data corrected;
- have your data erased;
- ask us to restrict how we use it;
- receive your data in a portable, machine-readable form;
- object to processing we base on legitimate interests, and to direct marketing at any time;
- withdraw consent for the daily email at any time, which does not affect anything we sent before you withdrew it;
- complain to a data protection supervisory authority.
To use any of these rights, email hello@drawdaily.app, ideally from the address you signed up with so we can match the record. It costs nothing and we will reply within one month.
Your rights under the Hong Kong PDPO
DFRT Limited is incorporated in Hong Kong, so the Personal Data (Privacy) Ordinance applies to us too. Under it you may make a data access request, asking whether we hold personal data about you and for a copy of it, and a data correction request, asking us to correct data that is wrong. Send either to hello@drawdaily.app and we will respond within the statutory period of 40 days. The Ordinance lets a data user charge a fee for complying with a data access request. We do not charge one.
You can also tell us at any time to stop using your data for direct marketing, which in our case means the daily lesson email. Clicking unsubscribe does exactly that and deletes the record with it. We have never provided anyone's personal data to a third party for that party's own direct marketing, and we will not.
Children
Draw Daily is not directed at children under 13, or under 16 in those parts of the European Economic Area where that is the age of digital consent. We do not knowingly collect their personal data. If you believe a child has subscribed or created an account, email us and we will delete the record.
How we protect your data
- Traffic to and from the site, and between us and our providers, is encrypted in transit using TLS.
- Row level security is switched on for our database tables. Signed-in users can read only their own completion records, and the subscriber list is not readable by the browser client at all.
- Administrative database keys live in server-side environment variables and are never shipped to the browser.
- No passwords are stored, because none exist. Sign-in is by emailed one-time link only, and each link works once and expires after an hour.
- Access to the production database and the email tool is limited to the people who run Draw Daily.
No service can promise perfect security and we are not going to pretend otherwise. What we can say is that we hold very little in the first place, which is the most reliable protection there is. If a breach ever put your data at real risk, we would tell you and the relevant regulator as the law requires.
Complaints
If something here bothers you, tell us first at hello@drawdaily.app. We would rather fix it than have you chase us. You also have the right to go straight to a regulator. In the EEA that is the data protection authority in your country. In the UK it is the Information Commissioner's Office. In Hong Kong it is the Office of the Privacy Commissioner for Personal Data.
Changes to this policy
If we change how we handle personal data, we will update this page and change the effective date at the top. Anything significant will also be mentioned in the daily email, so you are not expected to keep checking back. This version is effective from 13 August 2026.
See also our Terms of Use and our Legal Notice.