privacy policy

without an account, the app stores your preferences (like theme and brush settings) locally in your browser, and nothing about you reaches our servers. we set no identifying cookie of our own: signed-out practice is kept on your device, not against a profile.

with an account, we store: your email address and display name (from email sign-up or google sign-in), and your practice data — test results, scores, difficulty settings, lifetime stats, xp, streak and the behavioural measurements used to generate your report and suggestions. your actual drawings are processed in your browser and are not uploaded.

if you subscribe to pro, our payment provider holds your billing details; we only store your subscription status, plan and renewal date, plus a dated log of the subscription events behind it so we can answer billing questions.

we use five service providers:

• google firebase — authentication and database. your account and practice data live in firestore, protected by per-user security rules.
• polar — payments, as merchant of record. card details go directly to polar and never touch our servers. see polar’s privacy policy.
• sentry — error monitoring. when something crashes, sentry receives the error, the page it happened on and, if you are signed in, your account id, so the bug can be traced to a reproducible case. no drawings and no practice data.
• google analytics — usage measurement: page views, sessions, which upgrade links get clicked, and whether practice sessions get finished — that last one as which board you used, the difficulty, how long the run lasted and your accuracy rounded to the nearest ten percent. only with your consent: analytics cookies stay switched off until you accept the banner, and declining leaves them off. no drawing ever leaves your device, and analytics never receives an individual score, a stroke, or anything that identifies you.
• posthog — product analytics: the same practice and upgrade events google analytics receives, plus which buttons and links you click and the order you visited pages in, so we can see where the app is confusing rather than only whether it converted. if you are signed in it also receives your account id, so a session can be joined to the account that had it; it never receives your email or your name. only with your consent: until you accept the banner — and permanently, if you decline — posthog runs in cookieless mode, storing nothing on your device and counting you only as anonymous traffic. session recording is switched off entirely, so your canvas is never captured. see posthog’s privacy policy.

essential — your firebase sign-in session. this is required for the app to work and is not used for tracking.

analytics— google analytics and posthog cookies, set only after you allow them. you can change your mind at any time by clearing this site’s data in your browser, which resets the choice and asks again.

browser storage — the app keeps your settings on your own device (theme, brush palette, board setup), along with a counter of how many times you have opened pencyl and the date you first did. that counter is what lets the app show you where you left off, and it is not an identifier: there is nothing in it that could be joined to you or to another browser, and nothing in it is sent anywhere unless you have allowed analytics.

if you arrived through a link containing a ?ref= tag — the short label we put on links we share, like reddit or yt — that label is kept on your device too, so we can tell which places are worth posting in. it records where a visit came from, not who you are.

we don’t sell your data, show ads, or share your information with anyone beyond the processors above. we don’t train anything on your drawings — they never leave your device.

your data is kept while your account exists. deleting your account (account settings → danger zone) immediately and permanently removes your profile, practice history, stats, token balance and subscription record, and asks our payment provider to anonymize your billing identity. this cannot be undone.

two things outlive that deletion, both deliberately. our billing event log keeps a dated record of subscription and payment events — we need it to answer chargebacks and tax questions — and it holds your account id rather than your name or email. and the anonymous practice allowance described in section 1 is keyed to a browser cookie, not to an account, so it is not reachable from account deletion; clearing your browser’s cookies for this site discards it.

depending on where you live (e.g. gdpr, ccpa), you may have rights to access, correct, export or erase your data. most of this you can do yourself in the app; for anything else, email us and we’ll help.

if this policy changes materially we’ll announce it in the app. the “last updated” date at the top always reflects the current version.

privacy questions? email iamdennisisaac@gmail.com.