Back to Home

Privacy Policy

Drawing to Live • Last updated: August 2026

Drawing to Live ("we", "our", or "the app") values and respects your privacy. This Privacy Policy provides comprehensive disclosures regarding the specific Google user data we access, how we use it, with whom it is shared or disclosed, and the robust data protection mechanisms we implement to safeguard sensitive information.

1

Google User Data We Access (Data Collection)

When you sign in using your Google Account, we request access only to the minimal read-only scope necessary: https://www.googleapis.com/auth/youtube.readonly.

  • Public Profile Information: Channel Name/Display Name and Profile Avatar URL.
  • Channel Identification & Subscription Status: YouTube Channel ID and channel subscription/membership status for the host streamer.
  • Drawing Submissions: Vector stroke paths and coordinates drawn on the app canvas.

We do NOT collect or request access to your passwords, private videos, comments, watch history, billing info, or contacts.

2

How We Use Google User Data (Purpose of Use)

The retrieved Google user data is used exclusively to provide real-time user-facing features:

  • Live Broadcast Attribution: To render your public channel name and avatar alongside your submitted drawing on the live stream video overlay.
  • Anti-Spam & Fair Queue Control: To enforce drawing queue rate limits (e.g., maximum drawings per user per session) and prevent automated bot abuse.
  • Access Verification: To verify active viewer status according to the streamer's broadcast rules.
3

Data Sharing, Transfer, and Disclosure Disclosures

We do NOT sell, rent, trade, or transfer Google user data to data brokers, advertisers, or any commercial third parties.

Google user data is only disclosed or transferred under the following strictly defined conditions:

1. Public Live Stream Display (At User's Request): When you explicitly submit a drawing to the live queue, your public channel name, profile avatar, and canvas drawing are broadcasted on the streamer's live video stream overlay (e.g., on OBS Studio / YouTube Live).

2. Essential Technical Infrastructure Sub-Processors: We transmit data only to verified cloud infrastructure providers strictly necessary to execute real-time services:

  • Supabase PostgreSQL (Encrypted Database): Used for secure storage of drawing queues and workspace configurations.
  • Supabase Realtime (WebSocket): Used for encrypted real-time WebSocket event signaling to broadcast canvas stroke data to the OBS overlay.
  • Hosting Infrastructure (Vercel): Delivers serverless compute under TLS 1.3 encryption.

These sub-processors are bound by strict data protection agreements and are forbidden from using your data for any independent or marketing purpose.

4

Data Protection & Security Mechanisms for Sensitive Data

We enforce rigorous technical and organizational safeguards to protect your sensitive Google user data:

🔒 Encryption in Transit (HTTPS / TLS 1.3 & WSS)

All communications between your browser, our servers, Google OAuth endpoints, and WebSocket channels are strictly encrypted using TLS 1.3 and WSS protocols.

⚡ Strict Queue Data Lifecycle & Expiration

User sessions and queue records are stored securely in the database and are automatically purged or marked as expired once displayed on stream or when the broadcast ends.

🛡️ Zero Permanent Sensitive Storage

We do not store OAuth access tokens, refresh secrets, or private YouTube information on permanent disks or relational databases.

🍪 Secure HttpOnly Session Cookies

Authentication state is maintained using encrypted cookies marked with HttpOnly, Secure, and SameSite=Lax attributes to prevent XSS and token interception.

5

Data Retention & User Deletion Rights

Retention Period: All user data and submitted drawings are stored securely in our database. Live queue items are typically marked as expired immediately after they are displayed on stream, or cleared manually by the streamer.

Revoking Access & Instant Deletion: You have full control over your Google user data. You can instantly revoke Drawing to Live's access at any time by visiting your Google Account Third-Party Access Settings. Upon revocation, our app immediately loses all access to your account data.

6

Google API Services User Data Policy & Limited Use Disclosure

Drawing to Live's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

🚫 Prohibition on AI/ML Model Training: Google user data accessed by this application is NEVER used to develop, improve, or train generalized artificial intelligence (AI) or machine learning (ML) models, nor is it ever transferred to third parties for AI training purposes.

7

Contact & Privacy Inquiries

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please contact the application developer at irgijak@gmail.com or via official YouTube channel community posts at @CorazonID.