Privacy Policy

Last updated: October 17, 2026

Draft: pending legal review (the flagged-prompt retention line in AI features and the abuse-prevention and usage-record wording are new and unreviewed).

WebSketch is a personal project operated by its creator. This policy explains the personal information handled when you visit or use WebSketch, including its editor, community, collaboration, AI features, and paid features. The creator of WebSketch is responsible for the handling described here. For privacy questions or requests, email {{CONTACT_EMAIL}} or use our support page. If a dedicated privacy address becomes available, we will update this page.

Information we collect

Account and profile information: your email address, sign-in details handled by our authentication provider, profile name, image, and information you choose to add to your profile.
Age and agreement records: when you finish setting up your account we ask for your birth month and year to check that you are old enough. We use them once, keep only an age range (13 to 15, 16 to 17, or 18 and over), and do not store your birth date. We also record when you agreed to the Terms of Service and Privacy Policy and which version. If you tell us you are under 13, we record only that you were blocked, so you cannot try again with a different answer.
Your content and activity: sketches, code, files and images you upload, public posts, likes, saved items, collaboration invitations and activity, support messages, and AI prompts and responses. A sketch you make public, along with public profile information, can be viewed by others and may be indexed or copied outside WebSketch.
Subscription and usage records: your supporter subscription status and Stripe customer and subscription identifiers, and usage-window records (what you have used in the current daily, session and weekly windows, and when each resets) that we need to apply usage limits, show you what remains, and investigate payment or limit issues. Usage-window records are deleted automatically 35 days after the window they cover ends. Stripe handles payment details; WebSketch receives only the subscription details needed to activate and maintain supporter status.
Payment and billing data: where Stripe or its Link service sells your subscription as merchant of record, Stripe and Link receive your billing data (such as name, email, billing address and payment details) and handle it under their own privacy terms. We receive your email, billing country and region, and Stripe identifiers.
Abuse-prevention records: to limit abuse of free AI use by visitors who are not signed in, we issue a signed anonymous credential after a Cloudflare Turnstile check, and we count usage per network. We do not store the IP address for this. We reduce it to a network prefix and keep only a keyed hash (HMAC) of it, which we use to apply daily limits and cannot practically reverse. These records are kept only as long as needed to enforce the limits and investigate abuse, and are deleted automatically 35 days after the day they cover ends.
Technical and analytics information: IP address, device and browser information, pages visited, referring pages, interactions with WebSketch, request logs, error and security events, and information stored in your browser to keep you signed in and remember settings. We may infer an approximate location from an IP address for security or operations; we do not request precise device location for the service.

We receive this information from you, your device and browser, other people who invite you to collaborate, and service providers involved in sign-in, payments, and delivery of the service. Please do not put sensitive personal information, secrets, or information about other people into sketches or AI prompts unless you have a reason and permission to do so.

How we use information

We use information to provide accounts, sketches, collaboration, AI assistance, support, and the supporter subscription; to keep the service secure and reliable; to prevent abuse and fraud; to meet legal obligations; and to understand and improve how the service works. Where data protection law requires a legal basis, these uses rely on performing our agreement with you, our legitimate interests in operating and protecting WebSketch, legal obligations, or your consent where required. You can withdraw consent where processing depends on it.

Some information is required to create an account or use a particular feature. If you do not provide it, that feature may not work. We do not use your content to make decisions that produce legal or similarly significant effects about you.

AI features

When you use an AI feature, we send your prompt and the code, files, images, conversation context, or other material needed for your request to OpenAI. OpenAI processes that material to return a result under its applicable API data controls and terms. We store conversations, generated content, and related usage records so you can revisit work, support a feature, resolve errors, apply usage limits, and analyze or improve the service. We may review and reuse generated code for service analysis and improvement; do not submit private information or code you do not have permission to share. OpenAI says that API data is not used to train its models by default unless the customer opts in. Its own retention rules and exceptions apply to the data sent to it. AI output can be inaccurate; review it before use. Before a prompt is sent, we check it with OpenAI's moderation service. When a prompt is blocked or flagged as abusive, we keep the text of that prompt, with limited details of the check, for 30 days so we can review appeals and abuse, and then delete it. Prompts that pass the check are not kept by this process.

Sharing and service providers

We disclose information as needed to providers that host and operate WebSketch, including Supabase for authentication, database, and file storage; a virtual private server provider for the WebSketch API; OpenAI for requested AI features; Stripe for supporter subscriptions; Cloudflare for network delivery, security and its Turnstile bot check; PostHog for analytics; Sentry for error monitoring; and Gmail or other email delivery providers for support and service messages. Providers may process information in countries other than yours. We may also disclose information when required by law, to protect rights or safety, or in connection with a transfer of the project. We do not publish private sketches as part of normal service operation; content you publish or share with collaborators is available to the people you choose and, for public content, to anyone.

WebSketch does not currently use third-party advertising trackers or sell personal information for money. We do not use personal information for cross-context behavioral advertising. If these practices change, we will update this policy and provide any choices required by law.

Analytics and error monitoring

PostHog helps us understand visits and use of WebSketch. Depending on its configuration, it may receive page views, interaction events, device and browser details, IP-derived location, and identifiers used to recognize visits. If session recording is enabled, PostHog may also capture page content and interactions during a visit. Sentry helps us investigate crashes and other errors; an error report may include a page URL, browser details, a stack trace, and information included in the error or its surrounding context. We use these tools to improve and secure the service, not for advertising. We do not intentionally ask you to put sensitive information into analytics or error reports.

Cookies and browser storage

Authentication and preferences use cookies or browser storage so sign-in and settings work. PostHog may use cookies or browser storage for analytics, depending on its configuration. Payment, authentication, and other service providers may set their own cookies when you use their features. You can clear or block browser storage in your browser settings, though sign-in and some features may stop working. We do not use advertising cookies.

Opt-out signals. If your browser sends a Global Privacy Control signal (or the older Do Not Track signal), WebSketch does not load or send analytics for that browser. We treat Global Privacy Control as a valid request to opt out of any sale or sharing of personal information. Error monitoring and security logging that are needed to run the service still work.

Retention

Unless a different period is stated above: account, profile, sketch, upload and conversation data stays while your account is active and is deleted after you ask us to delete the account (see below); age and agreement records are deleted with the account; payment and subscription records are kept for as long as tax and accounting law requires; support messages are kept for as long as needed to handle your request and keep a record of it; and server logs and error reports are kept for the limited period set by the tool that holds them.

Security

Account information, sketches, uploads, and conversations generally remain while your account is active, unless you delete individual content or request deletion. We currently handle account deletion requests manually rather than through an in-app deletion tool. We may keep limited records afterward when needed for fraud prevention, disputes, or legal, tax, and accounting obligations. In particular, Stripe and WebSketch may need to retain subscription and transaction records after account deletion. Backups and provider copies may take additional time to expire; public copies made by others are outside our control. We use access controls and other reasonable safeguards, but no online service can guarantee absolute security.

Your choices and privacy rights

You can edit some account and profile information in WebSketch, choose whether to publish a sketch, and stop using AI features. You can request access, correction, deletion, or a copy of your personal information by emailing {{CONTACT_EMAIL}}. Account deletion is currently completed manually after we verify the request. Depending on where you live, you may also have rights to object to or restrict processing, withdraw consent, appeal a decision, or complain to a data protection authority. We may need to verify your identity and may retain information when the law permits or requires it. We will respond within the period required by applicable law. Authorized agents can contact us using the same email.

Other US states. Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, Montana and other states with privacy laws may have rights to access, correct, delete and obtain a copy of their personal information, and to opt out of the sale of personal information, targeted advertising and certain profiling. We do none of those three things. Use the email above to make a request. If we decline it, you may appeal by replying to our answer, and if you are still not satisfied you can contact your state attorney general. We will not treat you worse for using these rights.

For California residents, these requests may include the rights to know, correct, and delete personal information. The categories collected, sources, purposes, and recipients are described above. We do not currently sell or share personal information for cross-context behavioral advertising, so there is no sale or advertising-sharing opt-out to exercise at present. We do not knowingly sell or share the personal information of people under 16. We do not use sensitive personal information to infer characteristics about you.

International visitors

WebSketch is operated from the United States for a primarily US audience and is not actively marketed in other countries, but it can be accessed elsewhere. Your information is processed and stored in the United States and in other countries where our providers operate, and those countries may have different privacy laws. Where the law requires a transfer mechanism, we rely on our providers' standard contractual clauses or other approved safeguards, and, for US providers, on certifications under the EU-US Data Privacy Framework where they hold them. If you are in the European Economic Area, the United Kingdom or Switzerland, you have the rights described above, including to object, to restrict processing and to complain to your data protection authority. Contact us to ask about the location and safeguards that apply to your data.

Children

WebSketch is intended for people aged 13 or older and is not directed to children under 13. We ask for a birth month and year when an account is set up, and we block anyone who says they are under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us information, contact us and we will delete it. If you are 13 or older but under the age of majority where you live, please use the service with a parent or guardian's permission. We do not sell or share the personal information of people under 16, and we do not use it for advertising.

Security incidents

If we learn of a breach of security that affects your personal information, we will tell you and the authorities as the law requires.

Changes and contact

We may update this policy as the service or law changes. We will post the revised policy here with a new date and provide additional notice when required. Questions and privacy requests can be sent to {{CONTACT_EMAIL}} or through support.

WebSketch needs JavaScript. AI agents and other non-JavaScript clients: any public sketch at https://websketch.dev/sketch/<id> is available as JSON at https://api.websketch.dev/sketch/<id>.json. Format and caveats: /llms.txt.