Legal

Privacy Policy

Effective August 31, 2026. This policy explains what data TrackDraw processes, why it is used, how long it is kept, and the choices available to you.

What this policy covers

This Privacy Policy explains how Dutch Drone Squad handles your data when you use trackdraw.app and its hosted features. This policy is intended to be clear and practical, but it is not a substitute for legal advice.

Information we process

TrackDraw processes the following categories of information:

  • Account information — email address, display name, sign-in state, and authentication metadata.
  • Project and track data — layouts, obstacle configurations, project names, and timestamps.
  • Sharing and gallery data — share tokens, gallery titles, preview images, and visibility state.
  • API data — key metadata, expiry state, and identifiers needed to serve requests.
  • Operational and security data — audit logs, authentication events, and error states.
  • Product and reliability analytics — limited, structured records about how TrackDraw is reached and used, whether important actions succeed, and the technical context needed to improve reliability and interface-language support. Depending on the feature, this may include a timestamp, a short-lived browser-session identifier, a server-resolved account, project, or share reference, an export format, or an allowlisted category or status code. TrackDraw also creates separate privacy-minimized aggregates for product metrics, language demand, coarse country, and thresholded referring-website hostname counts. Analytics schemas do not accept free-form content and exclude track content, filenames, referring paths or queries, IP addresses, precise location, user-agent strings, device fingerprints, exception messages, and request bodies.

How we use information

TrackDraw uses this information to provide and secure the service, improve product reliability and usability, understand aggregate product use, prioritize interface translations, show publishers thresholded embed reach, and display content you choose to publish. TrackDraw relies on its legitimate interest in operating and improving the hosted service for privacy-safe product analytics and aggregate embed measurement. Product events, privacy-minimized aggregates, embed measurements, and security records are kept separate, access is limited to their purpose, and none are used for advertising or cross-site profiling.

Public content

If you publish a share or list a track in the gallery, the content and metadata you provide can become public. Unlisted, expired, or revoked links are intended to stay out of search results, but anyone with an active link may still view the shared layout until it expires or is revoked.

Service providers

TrackDraw uses service providers for hosting, storage, authentication, and email — including Cloudflare for infrastructure. These providers process information only as needed to run TrackDraw and keep the service available. Some operate outside the European Economic Area; where that is the case, TrackDraw relies on standard contractual clauses or other approved transfer mechanisms under applicable data protection law.

Cookies and local storage

TrackDraw uses functional cookies and browser storage for sign-in sessions, theme preference, local projects, editor state, an ephemeral analytics session identifier, and session-scoped deduplication. These are used to operate and improve the application, not to build advertising profiles or track people across sites. TrackDraw does not use analytics or marketing cookies.

Data retention

Local projects stay on your device until you remove them or clear browser storage. Cloud projects, shares, and account data remain stored until you delete or remove them where the product allows it. Raw product analytics events are removed after 180 days. Privacy-minimized daily product metric and localization-demand counts are removed after 24 months. The account-linked first meaningful-edit timestamp is removed when product analytics is disabled or the account is deleted. Daily aggregate embed-referrer counts are removed after 90 days and are deleted when their published share is deleted. Some operational and security records may be kept for longer when needed to protect the service, comply with legal obligations, or restore reliable operation.

Your choices and rights

You can use core editing without an account. Product analytics can be disabled below without affecting editing, import, export, sharing, gallery, or read-only use. Anonymous activity is limited to one browser session and is never retrospectively attached after sign-in. A signed-in objection applies on every device and removes account-, project-, and share-linked raw events. Depending on where you live, you may also have rights to access, correct, delete, export, restrict, or object to processing. In the Netherlands, you can complain to the Autoriteit Persoonsgegevens.

Changes to this policy

TrackDraw may update this policy when the product or how it handles data changes. Material changes will be reflected here before or when they ship.

Contact

For privacy questions or requests, email info@trackdraw.app. Please include "Privacy" in the subject so the message is easier to spot.

Product analytics

Control privacy-safe product measurement. Disabling it stops future events and asks TrackDraw to delete events linked to this browser session and, when signed in, your account, projects, and shares.

Share privacy-safe usage data

On

Helps improve editor journeys and reliability. Track content, full URLs, IP addresses, and advertising profiles are never included.

See also the Terms of Service.