Privacy Policy

Effective Date: October 31, 2026

Last Updated: October 31, 2026

Introduction

Welcome to Draft, operated by P/E Valerii Alekseev ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile application, and services (collectively, the "Service").

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Service.

Information We Collect

Information You Provide to Us

Account Information

  • Name: When you provide it or it is supplied by Apple or Google during sign-in
  • Email Address: When you sign in by email, Apple, or Google; Apple may provide a private relay address
  • Provider Account Identifier: Your Apple or Google account identifier when you use the corresponding sign-in method
  • Email Verification Records: Your email address, one-time sign-in code, expiry time, verification status, and attempt information when you request an email sign-in code

Content and Usage Data

  • Generated Content: The prompts and content you create using our Service
  • Voice Recordings: Temporarily processed for transcription only, not stored permanently
  • Format Preferences: Your content generation settings and style guidelines
  • Instagram URLs: When you provide examples for content generation

Information Automatically Collected

Device Information

  • Device ID: A unique identifier for your device to enable anonymous accounts
  • Device Type: iOS version and device model for compatibility
  • App Version: To ensure proper functionality and support

Analytics Data

  • Usage Patterns: How you interact with features in the app
  • Feature Adoption: Which features you use most frequently
  • Performance Metrics: App crashes, errors, and response times
  • Session Data: Frequency and duration of app usage

Information from Third-Party Services

Google Sign-In

Google sign-in is optional. If you choose it, Draft requests only the openid, email, and profile permissions. Google provides basic account information, including your account identifier, email address, name, and, when available, profile picture and email verification information. Draft stores your Google account identifier, email address, and name to create or identify your Draft account and sign you in. Our current sign-in flow does not save your Google profile picture to your Draft account.

We use this information to authenticate you, maintain your Draft account, and link Google sign-in to an existing Draft account with the same email address. Google sign-in does not give Draft access to your Gmail messages, Google Drive files, contacts, or calendars. Draft does not receive your Google password. Google OAuth tokens are processed to complete sign-in and are not stored as ongoing access credentials in your Draft account.

Draft uses Google account information for account functionality, support, security, and service operation as described in this policy. We do not sell Google account information, use it for personalized advertising, or use it to train general-purpose AI models. Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements where applicable.

Email Sign-In

If you choose email sign-in, we send a six-digit, one-time code to the email address you provide. The code is valid for 10 minutes and can be used once. We process verification records and sign-in attempts to verify access to your inbox and help prevent abuse. After successful verification, we create a Draft account or sign you into the account associated with that email address. You do not need to provide your email account password to Draft.

Your email address and sign-in email are processed by our email delivery providers to deliver the code. Requesting a sign-in code does not by itself subscribe you to marketing emails. After sign-in, we use session cookies on the web or authentication tokens in the app to keep you signed in.

Payment Information

  • Apple In-App Purchase: Transaction receipts and subscription status (processed by Apple, we don't store payment details)
  • Subscription Status: Active, trial, or expired status

How We Use Your Information

We use the information we collect to:

Provide and Maintain Our Service

  • Create and manage your account and authenticate you using email, Apple, or Google
  • Send and verify one-time email sign-in codes and protect sign-in against abuse
  • Enable content generation across multiple platforms
  • Process voice transcriptions using OpenAI Whisper API
  • Analyze Instagram content examples using Apify
  • Generate AI content using OpenRouter API

Improve and Personalize Experience

  • Remember your format preferences and style guidelines
  • Provide personalized content suggestions
  • Optimize AI model selection for better results

Communication

  • Send important service updates
  • Notify about subscription changes
  • Respond to support requests

Analytics and Performance

  • Monitor app performance and fix bugs
  • Understand feature usage to guide development
  • Ensure service reliability and uptime
  • Comply with legal obligations
  • Detect and prevent fraud or abuse
  • Enforce our Terms of Service

Data Processing Services

AI Content Generation

We use OpenRouter API to access various AI models for content generation. Your prompts and content are processed through their servers but are not stored permanently by OpenRouter.

Voice Transcription

Voice recordings are processed using OpenAI Whisper API. Audio files are:

  • Uploaded temporarily for transcription
  • Deleted immediately after processing
  • Not used for training AI models

Instagram Content Analysis

When you provide Instagram URLs, we use Apify to:

  • Extract publicly available content from the URLs
  • Analyze content structure and style
  • Generate similar content based on examples

Analytics Services

We use the following services to understand usage patterns:

  • Firebase Analytics: Anonymous usage analytics
  • Mixpanel: User behavior and feature adoption
  • RevenueCat: Subscription management and analytics
  • Sentry: Error tracking and performance monitoring
  • PostHog: Product analytics, including account identifiers, email address, name, and usage events to associate activity with your account

Data Storage and Security

Where We Store Data

  • Primary servers are hosted on secure cloud infrastructure
  • Data is encrypted in transit using SSL/TLS
  • Authentication tokens are stored securely in iOS Keychain

Data Retention

  • Account Data: Retained while your account is active, including your email address, name, and linked Apple or Google account identifier
  • Generated Content: Stored for your access until deleted by you
  • Voice Recordings: Deleted immediately after transcription
  • Analytics Data: May include account-linked events as described above; retained for service analytics, with aggregated or anonymized data used where appropriate

Security Measures

  • Industry-standard encryption for data at rest and in transit
  • Regular security audits and updates
  • Limited access to personal data on need-to-know basis
  • Secure API authentication using tokens

Your Rights Under GDPR

For users in the European Economic Area (EEA), you have the following rights:

  • Right to Access. You can request a copy of the personal data we hold about you.
  • Right to Rectification. You can request correction of inaccurate personal data.
  • Right to Erasure. You can request deletion of your personal data, subject to legal obligations.
  • Right to Restrict Processing. You can request to limit how we use your data.
  • Right to Data Portability. You can request your data in a machine-readable format.
  • Right to Object. You can object to certain types of processing, including marketing.
  • Right to Withdraw Consent. Where we rely on consent, you can withdraw it at any time.

To exercise these rights, contact us at hey@getdraft.io.

Data Retention

We will retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.

Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following situations:

Service Providers

  • Apple: For authentication and payment processing
  • Google: For Google sign-in and identity verification when you choose this method
  • Email Delivery Providers: To deliver sign-in codes and service emails
  • PostHog: For product analytics as described above
  • Hosting and Infrastructure Providers: To store and process account information and operate the Service
  • OpenRouter: For AI content generation (prompts only)
  • OpenAI: For voice transcription (temporary audio files)
  • Apify: For analyzing public Instagram content

We may disclose your information if required by law or in response to valid requests by public authorities.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred with appropriate protections.

Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal data, please contact us.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place to protect your information in compliance with this Privacy Policy.

Your Choices

  • Account Information. You can update your account information within the app settings.
  • Anonymous Usage. You can use our Service anonymously without providing an email address. Your account will be tied to your device ID.
  • Data Deletion. You can request deletion of your account and associated data by contacting support.
  • Analytics Opt-Out. You can disable analytics collection in the app settings (coming soon).

Sign-In Choices and Google Access

You can choose an available email, Apple, or Google sign-in method. You can revoke Draft's Google connection at any time through your Google Account connections. Revoking this connection does not by itself delete your Draft account, information already stored by Draft, or an existing Draft session. To remove your Draft account and its associated information, use account deletion or contact us at hey@getdraft.io.

Data Deletion

You can delete your account through the app's account settings or request deletion at hey@getdraft.io. Account deletion removes your account record, including the stored email address and linked Google or Apple identifier, associated content, email verification records, and active app authentication tokens. Limited records may be retained where necessary for legal obligations, security, fraud prevention, or billing, as described in this policy. Copies in backups are subject to the applicable backup retention cycle.

Analytics Opt-Out

You can disable analytics collection in the app settings (coming soon).

Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date and, for significant changes, providing prominent notice in the app.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us:

California Privacy Rights

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt-out of the sale of personal information (which we do not do).

Data Protection Department

For GDPR-related inquiries, you can contact our Data Protection Department at hey@getdraft.io.

© 2026 Draft AI. All rights reserved.

Privacy Policy • Terms of Service • Acknowledgments