Privacy Policy

Last updated: 2026-10-22.

This page says what Can You Draw? stores about you, who else handles it, how long it is kept and how to delete it. It covers the mobile app and this website.

Can You Draw? is run by Rokuma. In this policy, "we" means Rokuma.

Who can use Can You Draw?

To use Can You Draw? you must be 13 or older. The app does not ask your age. If you are under 13, please do not use it.

Accounts and sign-in

When you first open the app, it makes a guest account for you. A guest account has no email address and no password. Guest accounts are stored like any other account.

In the app you can sign in with Google, or with Apple on an iPhone. On this website's sign-in page you can use Google, or an email address and a password.

Sign-in is run by Supabase, our database provider. Supabase keeps your email address in a sign-in record that other users cannot see. If you sign in with Google, that record also holds the name and the address of the profile photo that Google sends. If you sign in with Apple, it holds the email address that Apple passes on.

If you sign up with an email address and a password, Supabase stores a hash of the password (a scrambled form of it), not the password itself. We cannot read it. If you sign in with Google or Apple, we never receive your password.

When a guest signs in, the guest's drawings, hearts and reports are moved to that account. If the account already has a drawing for the same prompt, the guest's drawing for that prompt is deleted.

Your profile

A new profile gets a made-up name, like artist_1a2b, or user_1a2b for a guest. It has no photo. We do not copy your name from Google or Apple into your profile. A few of the earliest accounts still show a name that was made from their sign-in name. If you are signed in, you can change your username in the app's Settings.

We store what you choose for your profile: a username, a short bio (only if you are signed in), a theme, a banner, a profile picture and a signature you can draw. Your profile has a photo only if you pick "Sign-in photo" when you edit it. Then we store the address of that photo and show it. You can also use one of your drawings, or no picture at all.

Your username, bio, profile picture, banner and theme are public.

Your drawings

When you post a drawing, we store the picture, a small copy of it, the strokes you made, the frame you chose, the prompt it answers and the time.

Before other people can see a drawing, the picture is sent to an AI model run by Anthropic for an automated check. Only the picture is sent. Your name, email address and account ID are not.

The app asks you before your first post. It shows you the rules and tells you about this check, and you agree to both before you post. Only the picture, and any username or bio you write, is sent to Anthropic.

Drawings that pass the check are public. Other people can see them with your username, and can replay how they were drawn.

Usernames and bios are checked too: first against a word list on our server, then by Anthropic's AI model, which is sent only the text. A drawing, username or bio that a check or a report flags can be looked at by Rokuma.

The device ID

The app makes a random ID for your phone and keeps it in the phone's secure storage (the keychain on an iPhone). On an iPhone it stays there even if you delete the app and install it again.

The app sends this ID when you post a drawing. We use it for one thing: a guest can post one drawing per prompt from one device. We store it only with drawings posted as a guest. Other users cannot see it.

Hearts, stickers, follows, blocks and reports

We store the hearts and stickers you give, who you follow, the drawings you save, that you shared a drawing, who you block, and the reports you make with their reason. We also store the tickets and badges you earn and what you unlock with them.

Your hearts, stickers and follows can be seen by other people. Your saved drawings, your blocks and your reports are not shown to other users.

Purchases

In the app you can buy packs of tickets, as a guest or signed in. Apple takes the payment. We never see your card or your Apple account details.

Purchases are handled by RevenueCat, a company that checks in-app purchases for app makers. The app makes a random purchase ID for your account. RevenueCat gets that ID, not your name, email address or account ID. For each purchase it also gets the product, the time, the price and the store's transaction ID.

We keep a record of the tickets you bought with your account, and it is deleted with the account. When you delete your account, we also tell RevenueCat to delete its copy.

Feedback

If you send feedback or a bug report from the app, we store your message, your account ID, the app version, whether the phone is iOS or Android, its OS version and its model.

The waitlist

If you leave your email address in the waitlist form on this website, we store that address and the date. It is not linked to an account.

Notifications

If you turn on notifications, the app gets a push token from Expo and we store it with your account. We use it to tell you about today's prompt, a new follower, new stickers on your drawing or a new badge.

There is also an evening streak reminder. If you have drawn several days in a row and have not drawn today's prompt yet, we tell you before your streak ends. It is on and off together with the notification about today's prompt.

With the token we store your phone's time zone, for example Europe/Berlin, so that the notification about today's prompt arrives in the evening where you are and not in the middle of the night. The app sends the time zone again when it changes. We also store the date we last sent you that notification, so that you get it once a day. Both are deleted with the token.

Notifications are sent through Expo's push service, which passes them to Apple or Google to reach your phone. Expo receives the token and the text of the notification. Turning the notification switch off in the app's Settings deletes that phone's token from our database.

Limits and IP addresses

To stop abuse, our server counts how often an account does things like posting or reporting. These counters hold your account ID. The waitlist form has no account, so its counter holds your IP address instead. A daily clean-up deletes counters that are more than a day old.

What stays on your device

The app keeps some things on your phone: your sign-in session, the device ID, an unfinished drawing, your settings, and saved copies of things it has loaded, such as today's prompt.

This website keeps your sign-in session in cookies. It has no advertising or tracking cookies.

Crash and speed reports

When the app crashes, hits an error or runs slowly, it sends a report to Sentry, a company that collects such reports for app makers. A report holds the error, the kind of phone and its system version, the app's version, which screen was open, and how long screens and requests took.

A report does not hold your account, your username, your email address, your drawings or anything you wrote, and we have Sentry set not to keep your IP address. We can't tell from a report whose phone it came from. The website sends no such reports.

Who else handles your data

These companies handle data so that Can You Draw? can work: Supabase (the database, the stored pictures and sign-in), Vercel (this website and our server), Anthropic (the automated checks of drawings and text, and writing prompt ideas, for which nothing about you is sent), Expo and then Apple or Google (delivering notifications), RevenueCat (in-app purchases, under a random purchase ID), Apple (taking the payment for a purchase), Sentry (crash and speed reports from the app, which don't say who you are), and Google or Apple when you sign in with them.

As hosts, Supabase and Vercel handle every request the app or the website makes. That includes your IP address and details of your device or browser, and they may keep these in their own logs. Our server also logs errors, and an error line can include an account ID.

What we don't do

We don't sell your data and we don't show ads. The app and this website contain no advertising code and nothing that tracks what you do. The app's crash and speed reports, described above, are the only thing of that kind.

How long we keep things

A guest account is deleted, with its drawings, by a daily clean-up once it is more than 90 days old and has not been used for 90 days. Not used means no drawing, heart, sticker or report, and no sign that the app was opened.

Waitlist email addresses and feedback are deleted when they are 2 years old. Everything else is kept until you delete it or delete your account.

Sentry keeps crash and speed reports for 90 days.

Deleting your data

To delete one drawing, open it in the app and choose "Delete drawing" from its menu. This removes the picture, its small copy, the strokes, and the hearts, stickers and reports on it. You can delete up to 3 drawings a day. Tickets the drawing earned are kept.

To delete everything, open Settings in the app and choose "Delete account". A guest sees "Delete my drawings and data" there instead, and it does the same. This removes your sign-in record, your profile, every drawing and its files, your hearts, stickers, follows, saved drawings, shares and blocks, your reports of drawings, your tickets, badges and unlocks, the record of tickets you bought, and your notification tokens. We also ask RevenueCat to delete its copy of your purchases.

Some things are not removed. Feedback you sent stays, without your account ID, until it is 2 years old. Reports you made about someone else's username or bio stay, without your account ID. A waitlist email address is not tied to an account, so deleting an account does not remove it. The device ID stays on your phone.

Other requests

For anything about your data that you cannot do in the app, such as removing a waitlist email address, write to hello@canyoudraw.com.

Contact

Questions about this policy: write to Rokuma at hello@canyoudraw.com.