privacy policy

without an account, the app stores your preferences (like theme and brush settings) and your practice progress locally in your browser, and nothing about you reaches our servers. we set no identifying cookie of our own: signed-out practice is kept on your device, not against a profile.

the one exception is the daily brief. if you ask for it — we offer it after you set a new personal best — we store the email address you give us, your time zone, and a short summary of your progress so the email has something to say: your streak, your level, what to practise next, and how much your accuracy has moved. that is the only thing a signed-out visitor can send us, it only happens if you type it in, and every brief carries a one-click unsubscribe that deletes nothing else.

with an account, we store: your email address and display name (from email sign-up or google sign-in), and your practice data — test results, scores, difficulty settings, lifetime stats, xp, streak and the behavioural measurements used to generate your report and suggestions. your actual drawings are processed in your browser and are not uploaded.

if you subscribe to pro, our payment provider holds your billing details; we only store your subscription status, plan and renewal date, plus a dated log of the subscription events behind it so we can answer billing questions.

we use seven service providers:

• vercel — hosting. the app and its server routes run on vercel, so every request passes through them with the standard details any website receives — your ip address, browser and the page asked for. see vercel’s privacy policy.
• google firebase — authentication and database. your account and practice data live in firestore, protected by per-user security rules.
• polar — payments, as merchant of record. card details go directly to polar and never touch our servers. see polar’s privacy policy.
• sentry — error monitoring. when something crashes, sentry receives the error, the page it happened on and, if you are signed in, your account id, so the bug can be traced to a reproducible case. no drawings and no practice data.
• google analytics — usage measurement: page views, sessions, which upgrade links get clicked, and whether practice sessions get finished — that last one as which board you used, the difficulty, how long the run lasted and your accuracy rounded to the nearest ten percent. only with your consent: analytics cookies stay switched off until you accept the banner, and declining leaves them off. google analytics never receives a drawing, an individual score, a stroke, or anything that identifies you.
• posthog — product analytics: the same practice and upgrade events google analytics receives, plus which buttons and links you click and the order you visited pages in, so we can see where the app is confusing rather than only whether it converted. if you are signed in it also receives your account id, so a session can be joined to the account that had it; it never receives your email or your name. only with your consent: until you accept the banner — and permanently, if you decline — posthog runs in cookieless mode, storing nothing on your device and counting you only as anonymous traffic. session recording: if you accept the banner, posthog also records your session — what was on screen, so we can improve the user experience. typed text in form fields is masked. nobody is recorded before accepting, and declining stops it. see posthog’s privacy policy.
• resend — email delivery. if you ask for the daily brief, resend receives your address and the message in order to send it. they are used for nothing else, and nothing else is shared with them. see resend’s privacy policy.

essential — your firebase sign-in session. this is required for the app to work and is not used for tracking.

analytics — google analytics and posthog cookies, set only after you allow them. you can change your mind at any time by clearing this site’s data in your browser, which resets the choice and asks again.

browser storage — the app keeps your settings on your own device (theme, brush palette, board setup), along with a counter of how many times you have opened pencyl and the date you first did. that counter is what lets the app show you where you left off, and it is not an identifier: there is nothing in it that could be joined to you or to another browser, and nothing in it is sent anywhere unless you have allowed analytics.

if you arrived through a link containing a ?ref= tag — the short label we put on links we share, like reddit or yt — that label is kept on your device too, so we can tell which places are worth posting in. it records where a visit came from, not who you are.

we don’t sell your data, show ads, or share your information with anyone beyond the processors above. we don’t train anything on your drawings — they leave your device only inside a session recording you accepted, and only to be watched.

your data is kept while your account exists. deleting your account (account settings → danger zone) immediately and permanently removes your profile, practice history, stats and subscription record, and asks our payment provider to anonymize your billing identity. this cannot be undone.

one thing outlives that deletion, deliberately: our billing event log keeps a dated record of subscription and payment events — we need it to answer chargebacks and tax questions — and it holds your account id rather than your name or email. anything the app kept in your browser stays there until you clear this site’s data.

the daily brief is separate from your account, because you can ask for it without having one. unsubscribing — the link at the bottom of every brief — stops it immediately. to have the address itself erased rather than just switched off, email us and we will delete the record.

depending on where you live (e.g. gdpr, ccpa), you may have rights to access, correct, export or erase your data. most of this you can do yourself in the app; for anything else, email us and we’ll help.

if this policy changes materially we’ll announce it in the app. the “last updated” date at the top always reflects the current version.

privacy questions? email support@pencyl.art.