What we record, and what we never do.

DrawDog is a Mac app that records how a piece of work was made — never what is in it. It runs on your computer. Nothing leaves your Mac until you press Certify, and then only a signed summary does. You can see every field of that summary on any certificate page, under “Appendix”.

• A cryptographic fingerprint (SHA-256) of each file in the folder you chose, recomputed when the file changes.
• Each file’s size and last-modified time.
• A salted fingerprint of each file’s path. The salt is random per session and never uploaded, so the path cannot be recovered from the fingerprint.
• Which application is frontmost, checked every two seconds and kept only as a running total per application — never as a timeline.
• How often the pen or mouse moves while a drawing application is in front: a count of strokes per minute, seconds of movement, and whether stylus pressure varied. Never where it moved, never what it drew. This uses a macOS event monitor that reports movement without positions and needs no accessibility permission.
• When your session started and stopped, and the label you typed for it, if any.

This is stored in a database inside the app’s own folder on your Mac. It is not synced anywhere.

• The contents of your files. Files are read only to fingerprint them, in small pieces, and discarded. Nothing is copied.
• File names or folder paths. These exist only in the app’s memory while a session is running and are never written to disk. The app’s database has no column that could hold one, and a test fails if anyone adds one.
• Anything you type. DrawDog does not read the keyboard, and never requests the accessibility permission that would allow it.
• Where your pen or cursor goes. Positions are not read. Only that it moved, and when.
• Your screen. No screenshots, no recording.
• Window titles, document names, or browser tabs. Time in a browser is reported as browser time, nothing more specific.

Pressing Certify uploads one signed record to our servers. It contains:

• The grade and the written reasons for it.
• Session totals: how long, how many saves, minutes of drawing, strokes per minute, how much time in which categories of app, and the display names of those apps (for example “Procreate”).
• For each watched file: how many times it changed, its size over time, and the fingerprint of its final contents — so a client can confirm the file you sent them is the one on record.
• A fingerprint of the whole record and a signature from a key held on your Mac.

It does not contain file names, paths, contents, or the second-by-second log. The application identifiers macOS uses internally are removed on the way out; only the display name travels.

The record’s fingerprint is also sent to a public timestamp authority (freetsa.org), which returns a signed statement of the time. That authority receives only the fingerprint — a fixed-length number — and nothing about you or your work.

Anyone who has the link. Certificate links are long random strings and are not listed anywhere, so a certificate is as private as the link. Certificate pages are marked not to be indexed by search engines.

A certificate shows the name on your account if you have set one, otherwise “A DrawDog user”. It never shows your email address.

You can withdraw a certificate at any time from your dashboard. A withdrawn certificate stays at its link, clearly marked as withdrawn with the reason you gave, so that someone who was sent it knows you retracted it. Withdrawing is not the same as deleting: you can also delete the underlying session from your Mac, which removes the record entirely.

An account needs an email address and a password. We keep the email so you can sign in and recover your account, the date you joined, your plan, and — if you subscribe — a reference to your Stripe customer record. Stripe handles payment details; we never see your card number.

Each Mac you certify from registers a public signing key with your account. This is what lets a certificate page say the signature belongs to your account. The private half never leaves your Mac.

• We do not sell, rent, or share your data with advertisers or data brokers.
• We do not use your records to train anything.
• We do not run third-party analytics or advertising trackers on this site.
• We do not read your certificates for any purpose other than serving them to people you send the link to, and operating the service.

• Supabase hosts the account database and certificate records (United States).
• Netlify hosts this website.
• Stripe processes subscription payments.
• freetsa.org issues the public timestamp on each record.

Each receives only what it needs for its job, as described above.

You can see everything we hold about a certificate by opening it — the appendix on each page is the complete record. You can withdraw or delete certificates from your dashboard, and delete sessions from the app. To delete your account and everything attached to it, email privacy@drawdog.art from the address on the account and we will do it within 30 days.

If you are in the EU, UK, or California, the rights to access, correct, delete, and port your data described in GDPR and CCPA apply, and the address above is how to exercise them.

If this policy changes in a way that matters, we will say so on this page and, for account holders, by email. The date at the top is the date of the last change.

See also the terms of service and how DrawDog works.