Privacy Policy
Last updated: October 17, 2026
DrawDump stores as little data as the site can function with. This page explains exactly what is kept and how.
What we store
- Email + password hash — your login. Passwords are hashed with bcrypt; the hash alone is useless for signing in anywhere else.
- Profile data — your public @username, optional display name, optional avatar.
- Scripts — title, description, code, chosen visibility (public/unlisted/private), views and likes.
- Comments & likes — the text you post and the scripts you heart.
- IP-based counters — page views are counted once per IP per 6 hours in a temporary in-memory list. The IP is never written to the database.
- Abuse reports — report reasons, optional notes, and (when logged in) your account id.
Cookies
One cookie: dd_token. It is httpOnly, only used to keep you signed in, and disappears when you log out or delete the account. No analytics cookies, no ad trackers.
We email you only for account purposes: a 6-digit verification code, password reset links, and nothing else. No newsletters.
Your rights
- Export — account → "Download my data" gives you everything we store about you as JSON.
- Delete — account → "Delete account" (type your password) erases profile, snippets, comments, likes, reports and uploaded files. This is immediate and cannot be undone.
Contact
Questions about privacy, GDPR-style requests, or takedowns: use the contact address in the site footer.