Privacy Policy
Effective date: October 16, 2026 · Last updated: October 16, 2026
This Privacy Policy explains what personal information the operator of popop-draw (啪啪画, "we", "us") collects when you use popop-draw, why, who we share it with, how long we keep it, and how you can control it.
In short: we only collect what we need to run the service, we never sell your personal information, we do not use your prototypes for advertising or to train our own models, and you can delete your account and cloud data at any time.
1. What we collect
- Sign-in: your email address, the name you choose to show (optional), and one-time sign-in codes (stored only as a hash and valid for 10 minutes). Used to create and identify your account and send you codes.
- Cloud sync: your projects (pages, annotations, settings) and the images you upload. Used to save them and sync them between your devices.
- AI features: the requests you send, the page content, screenshots and images the AI needs to process, and for each request its task type, project and number of tokens used. Used to generate and edit prototypes and to count your tokens. When you are signed in we also keep the visible conversation text, task status and change summaries for each project, so authorized administrators can troubleshoot, support you and improve the product; these records do not include hidden model instructions, reasoning or original image data.
- Purchases: when you buy a plan, our payment provider Creem tells us your plan, subscription status, billing period, the amount paid and an order or customer reference. We do not receive your full card details.
- Security and activity: sign-in times, IP address, browser type, and the time and project name of actions such as creating or deleting projects, exporting and publishing links. Used to keep your account secure, troubleshoot and understand feature usage.
- Share links: the project snapshot you publish, its password (stored only as a hash), its expiry, and how many times and when it was opened. Used to let the people you share with view it.
- Support: your conversations with support (AI or human) and any screenshots you attach. To answer you, support can see your token balance, cloud storage, the screen you are on and recent errors. Human replies are also sent to your email.
- Error reports: error messages, where they happened, the page address and browser type; if you are signed in, your account ID. Used to find and fix problems.
- Anonymous usage data: page types visited, campaign tags and referring domains, which entry buttons were clicked, visible time on page, sign-in steps and feature usage (for example how many pages were generated, or whether a prototype was presented or exported), and random visitor and visit IDs created in your browser. It does not include full URLs with query strings, project IDs, detailed IP data, prototype content, requests or project names, and it is not linked to your account.
When you are not signed in, your projects stay in your own browser and are not sent to us. We do not collect your phone number, government ID, precise location or contacts. Please do not put other people's personal information or confidential material you are not allowed to process into prototypes or conversations.
2. How we use it
- Only for the purposes listed above. If we want to use your information for anything else, we will tell you and ask for your consent first.
- We do not use your project content for advertising, do not show it to other users (except through share links you publish), and do not use it to train our own models.
- Only authorized administrators can view the account and project information needed to solve your problem or keep the service secure.
- We do not make automated decisions that significantly affect you.
3. Legal bases (EEA, UK and similar laws)
We process your information to provide the service you asked for (performance of a contract), to keep it secure and improve it (our legitimate interests), to comply with legal obligations such as tax and accounting rules, and, where required, with your consent, which you can withdraw at any time.
4. Cookies and browser storage
- Sign-in cookie: after you sign in we store a session cookie in your browser to keep you signed in. It expires after 30 days of inactivity. We do not use third-party advertising or tracking cookies.
- Local browser storage: the editor saves your projects, conversations and settings in your browser's local database so you can keep working offline, plus your last sign-in email and a random visitor ID. Clearing your browser data removes them (projects already synced to the cloud are not affected).
5. Service providers
We share only the information each provider needs to do its job, and require them to protect it at least as well as this policy does:
- Third-party AI model providers: run the AI that generates, edits and checks prototypes and answers support questions. They receive the requests, page content, screenshots and images sent to the AI, but not your email address.
- Cloud hosting provider: hosts our servers, databases and backups, which hold the information described in this policy.
- Email delivery provider: sends sign-in codes and support replies. It receives your email address and the email content.
- Creem (Merchant of Record): processes payments, subscriptions, invoices, refunds and sales tax for paid plans, under its own privacy policy. Creem collects your payment details directly.
- External AI tools you connect via MCP (for example Codex, Claude Code or WorkBuddy) read and change prototypes in your browser with your authorization, through our relay, which does not store prototype content. Those tools handle your data under their own privacy policies.
We do not sell your personal information. Apart from the cases above, your separate consent, or a lawful request from courts or authorities, we do not share your personal information with anyone. If popop-draw is involved in a merger or acquisition that requires transferring personal information, we will tell you and require the recipient to keep following this policy.
6. Where your data is stored
Our servers are located in mainland China. If you use popop-draw from outside China, your information is transferred to and stored there, and some service providers (for example AI model providers and Creem) may process it in other countries. We use these providers only for the purposes above and take reasonable measures to protect your information wherever it is processed.
7. Share links
Anyone who has a share link you publish (and its password, if set) can view the prototype and annotations in it without signing in. You can update the content, change the password or expiry, or revoke the link at any time; a revoked link stops working immediately.
8. How long we keep it
- Account, projects, images, project conversations and task records, activity records, AI usage records and support history: until you delete them or delete your account.
- Purchase and billing records: as long as tax and accounting laws require.
- Share links: until you revoke them, they expire or you delete your account.
- Sign-in codes: 10 minutes, deleted once used.
- Anonymous usage data: 180 days.
- Error reports: deleted once the problem is resolved.
- Database backups: made daily and deleted automatically after 7 days.
When you delete your account, your cloud data is deleted immediately and copies in backups expire within 7 days. If we ever shut down popop-draw, we will tell you at least 30 days in advance and delete or anonymize your personal information.
9. How we protect it
- All traffic uses HTTPS.
- Sign-in codes, share link passwords and session tokens are stored only as hashes.
- Only authorized administrators can access the back office, with sign-in rate limits, and access can be limited to approved networks; our servers expose only the ports they need.
- If a personal information security incident happens, we will tell you what happened, the likely impact and what we are doing about it, and report it to the authorities as the law requires.
No system is perfectly secure, so please also keep your email account and any MCP connection credentials safe.
10. Your rights
- Access and copy: see all your projects in the editor and download a full copy with Export → Project file; see your token balance and storage in Settings → Account.
- Correct: change your display name in Settings → Account.
- Delete: delete projects or revoke share links at any time; projects in the trash are deleted after 30 days, or you can empty it yourself.
- Object or withdraw consent: contact us to view or delete conversation records, or to object to any processing. You can turn off "Connect your AI" and external tools lose access immediately.
- Delete your account: Settings → Account → Delete account, confirmed with a code sent to your email.
To exercise any other right, contact us using the details below. We respond within 15 business days after confirming your identity. You can also complain to your local data protection authority.
11. Children
popop-draw is intended for adults. If you are under 18, use it with the permission of a parent or guardian. We do not knowingly collect personal information from children under 14; if we learn we have done so without a guardian's consent, we will delete it promptly. Parents and guardians can contact us with any questions.
12. Changes to this policy
We may update this policy when the law or our product changes. We will post the new version on this page and update the date above. For significant changes to what we collect, why, or who we share it with, we will notify you in the product or by email and, where required, ask for your consent again.
13. Contact
Questions, requests or complaints about this policy or your personal information: email pop@casebase.space, or use the support button at the bottom right of the editor.