Privacy Policy

The short version

DrawDuel.io is a free browser game. You can play as a guest without handing over a name or an email. We keep the smallest amount of data needed to run a match and track your rank, and not much else.

We do not sell your personal data. You can have your account, and everything tied to it, deleted at any time: message us on our Discord at https://discord.gg/BcbP9aSz7M and we will erase it once we have checked the account is yours.

What we collect

Guest play: when you start a duel as a guest we create an anonymous account and store a token in your browser so your rank survives a refresh. That account holds a display handle, your rating and match history, and nothing that identifies you in the real world.

Registered accounts: if you sign in with Google we store your email address and a Google account identifier so we can recognize you on your next visit. We never receive or store your Google password. Google verifies you and only tells us that you signed in and what your confirmed email address is.

Gameplay data: the prompts you draw on, your drawings, match outcomes, and rating changes. Drawings from a finished duel can appear on public replay and leaderboard pages.

Technical data: your IP address and basic request metadata, used for rate limiting and abuse prevention. We do not build advertising profiles from it.

How the game is used: we count this ourselves rather than leaving it to an outside service. On your first visit your browser is given a random value and keeps it in its own storage, and that value is sent to us together with four things: which action you took or screen you were shown, from a short fixed list (opening a page, pressing Play, being shown the sign-up screen, starting or finishing a duel, sharing, opening a replay or a profile); a small amount of detail about that action, such as which Play button you pressed or which share option you chose; the page you were on when you took it; and the host name of whichever site linked you here, never the full address you came from. On its own it identifies the browser rather than the person. While you are signed in these counts are also recorded against your account, so we can see how a first visit relates to what that player went on to do after signing up; that link is the only thing signing in adds. We use all of it to count how many people arrive and to see where in the game we lose them, and for nothing else: no profile is built from it, we do not share it with anyone, and we never join it with anything outside our own database.

Cookies and local storage

We use your browser's local storage to keep you signed in between visits, and the game does not work without it. When you start playing as a guest we also set a cookie that identifies the browser rather than you, and it lasts about a year. It does two jobs: it counts a guest's free duels for the day against the device, so signing out or starting another guest account does not hand you a fresh set, and it lets the game avoid giving you a prompt you drew recently. Neither it nor your local storage is shared with anyone. If you sign in, your free duels are counted against your account rather than the device.

The game also keeps your settings and progress in the browser: whether sound is muted, your drawing tool settings, your personal best, and whether you have seen the intro. It leaves itself a few working notes beside them, such as which panels you had open, a duel this tab has already tried to rejoin, and why a sign-in window closed. Those settings, notes and progress stay on your device, are never sent anywhere, and say nothing about who you are. Signing in with Google is the exception: it sets two short-lived cookies that carry the session from Google back to the game, and both are spent as soon as they arrive.

Two of the things your browser stores are meant to reach us. The first is the sign-in token from the top of this section: it goes out with every request once you are signed in, because it is what tells us the request is yours, and it measures nothing. The second is the random value described under "What we collect" above, sent with the action you took or screen you were shown, a small amount of detail about it, the page you are on and the host name of the site that linked you here, so that we can count how many people visit and see where in the game they give up. On its own that one identifies the browser rather than the person, though while you are signed in those counts are recorded against your account as well. Neither is a cookie, no other site can read either of them, and neither goes anywhere but our own database.

We use no advertising cookies at all. Every advertising consent signal is set to denied before any Google tag can load and is never switched back on, so anything Google runs here is non-personalized and stores nothing to advertise to you. Any other third party we add is held to the same bar.

Analytics cookies depend on where you are. In the EU, the EEA, the UK and Switzerland analytics storage is denied as well, so Google Analytics runs cookieless there and cannot tell one visit from another. Everywhere else analytics storage is allowed by default, so Google Analytics sets two first-party cookies: one that lets us tell a returning player from a new one, and one that keeps track of the visit you are on. Both last about 13 months. If your browser sends a Global Privacy Control signal we treat it as a no and deny analytics storage wherever you are.

There is no cookie banner on DrawDuel.io. Everything kept on your device is described above, none of it advertises to you, and none of it follows you onto other sites.

Advertising

We do not show ads on DrawDuel.io today. We expect to eventually, and it will not necessarily be Google: this section will name the provider before any advert of theirs appears here.

One caveat while that is true: Google’s AdSense script is already loaded on the site, left over from an application to the program, so your browser does contact Google on each page load. No ad unit is configured behind it, so nothing is shown and no ad is chosen for you.

Whoever ends up serving them, the posture does not change. Every advertising consent signal here is switched off and stays off, so ads may only be non-personalized: chosen from the page in front of you, never from an advertising profile of you, and setting no advertising cookies. You can manage how Google advertises to you across the web at https://www.google.com/settings/ads, and manage third-party ad vendors generally at https://www.aboutads.info.

Analytics

We use Google Analytics to understand how players find and use DrawDuel.io, such as which pages they land on and how many finish a duel. This helps us decide what to fix and build next. We also keep our own count of the same things, described under "What we collect" above, because Google Analytics only ever sees the visitors whose browsers let it run.

How it runs depends on where you are. In the EU, the EEA, the UK and Switzerland analytics storage is denied, so it sets no cookies and cannot follow you between visits. Everywhere else it is allowed, so it sets the two first-party cookies described above and can tell that a visit is a return visit, which is what lets us see whether the game is worth coming back to. It is never allowed to feed advertising in either case, and Google processes the data, including a truncated form of your IP address, on our behalf. You can opt out across all sites with the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

How we use your data

To run matches, judge drawings, and keep your ranked rating accurate over time.

To show public leaderboards and shareable replay pages, which is part of how the game works.

To keep the service healthy: rate limiting, blocking abuse, and fixing bugs.

Who we share it with

Service providers that make the game run, such as our hosting platform and the AI model that judges drawings. They process data on our behalf and only for that purpose.

Google, for analytics, as described above: it receives event data about your visit, including a truncated form of your IP address. In the EU, the EEA, the UK and Switzerland that happens cookielessly; elsewhere it includes the identifiers in those first-party cookies so a return visit can be recognized. None of it is allowed to be used for advertising.

An advertising provider, once we have one. We do not share anything with an ad network for that purpose today.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising: any ads here are non-personalized and set no advertising cookies.

Your rights and choices

You can have your account and all data attached to it deleted at any time. Message us on our Discord at https://discord.gg/BcbP9aSz7M, telling us the username on the account. Because a username is public, we will ask you to show the account is yours first: the email or Google address it signs in with, or something only its owner can do, such as playing a duel while we watch for it. Once we are satisfied, we erase it. Deletion is permanent.

Depending on where you live, you may have the right to access, correct, or export your data, or to object to certain processing. To make a request, reach us the same way; the same ownership check applies.

Any ads on DrawDuel.io are non-personalized by default, and you can manage advertising across the web using the Google and aboutads.info links above without affecting your ability to play.

Data retention

We keep account and match data while your account exists so your rank and history stay intact. When your account is deleted, that data is removed. Public match records may keep an anonymized result so historical leaderboards stay consistent, and the usage counts described above are kept the same way: both the link to your account and the random value that identified your browser are cleared, and that value is cleared from everything else it recorded that belongs to no account, not only from what you did while signed in, so what remains is a count nothing can tie back to you. Counts belonging to somebody else's account are left as they are, even where you shared a computer with them. That is a real erasure rather than a relabelling, and it costs us something on purpose: from then on your visits stop counting as anybody in the numbers we read.

Those usage counts are kept for 13 months and then deleted. Thirteen rather than twelve so a month can be compared against the same month a year earlier.

Guest identities are not kept forever. A guest who never played is deleted 30 days after it was created, and a guest who did play is deleted 90 days after their last game. Nobody can recover a deleted guest, because a guest has no password and no email; create an account if you want to keep your rating and history.

Children

DrawDuel.io is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, tell us through the contact route below and we will remove it.

Changes to this policy

If we change how we handle data we will update this page and the date at the top. Material changes will be called out on the site.

Who we are and how to reach us

DrawDuel.io is operated by 5Head Labs Pty Ltd, an Australian company. "We", "us" and "our" in this policy mean that company, which is responsible for the personal data it describes.

Questions about privacy or a data request? Message us on our Discord at https://discord.gg/BcbP9aSz7M.