Privacy policy
Drawing with Love lets two people draw on the same board, each on their own phone. The app creates no accounts or profiles. This policy explains which data is processed, where it lives, for how long, and how to remove it. It covers the app and this website.
Controller: conhecendotudo.com.br, Brasília, DF, Brazil. Privacy channel and data protection officer: contato@conhecendotudo.com.br.
Data the app processes
| Data | Purpose | Where | How long | Legal basis |
|---|---|---|---|---|
| Drawings (not end-to-end encrypted) | Sync the board between both phones | Server on Cloudflare (Durable Object), in a location chosen automatically near first access | Until the board is cleared. The whole room is deleted after 180 days with no connection and no saved drawing | Performance of a contract (LGPD Art. 7, V; GDPR Art. 6(1)(b)) |
| Random room and install identifiers | Admit at most two phones to a room and let them reconnect | On the phone (Keychain, this device only) and on the same server | On the phone, until Change partner. On the server, while the room exists | Performance of a contract |
| Name, color, and live cursor | Show your partner who is drawing | On the phone; relayed by the server in real time, not stored | Not kept on the server | Performance of a contract |
| Short invite code and admission record | Bring your partner to the room without exposing its identifier, and admit the first entry | Temporary records on the pairing server, holding the code and the room identifier | The code expires after three minutes and is deleted after one use; the room admission record expires after ten minutes | Performance of a contract |
| IP address (full IPv4 or IPv6 /64 prefix) | Rate-limit pairing attempts | Same server and Cloudflare's rate limiter | Minutes; the longest lockout is five minutes | Legitimate interest in keeping the service secure (LGPD Art. 7, IX; GDPR Art. 6(1)(f)) |
| Special dates and reminders | Remind you of your dates | On the phone only; the reminder is scheduled by the system | Until you delete the date or the app | Never leaves the device |
What the app does not do
- It shows no ads, uses no analytics or tracking SDK, and never asks for tracking permission (App Tracking Transparency).
- It uses no remote push notifications: reminders are local.
- It does not sell, rent, or give away personal data.
- It does not log room identifiers, codes, names, IP addresses, or request bodies. Server invocation logs are turned off.
Buying the app
The app is sold on the App Store. Payment, receipts, and refunds are handled by Apple under Apple's privacy policy. We never receive your payment details.
Sensitive data
Drawings are free-form and may express a couple's intimacy. Because they are not end-to-end encrypted, avoid drawing passwords or sensitive information.
Device permissions
Notifications: used only for special-date reminders and requested only when you save a date. Declining turns off only the reminders. The app does not use the camera: the QR code is read by the system Camera app.
Processors and international transfers
Cloudflare, Inc. (United States) runs the sync server and delivers this website under its Data Processing Addendum. A room lives where Cloudflare places it near first access, which may be outside Brazil. That transfer relies on LGPD Art. 33, IX, together with Art. 7, V, because it is necessary for the shared board you use.
Apple distributes the app and processes the purchase.
This website
drawingwithlove.com sets no cookies and uses no analytics or third-party scripts. Cloudflare processes the IP address and technical data of each visit to deliver and protect the site.
Retention and deletion
- Clear the board removes the visible drawings for both of you. A stroke sent at the same moment as the clear may stay stored, invisible, until the next clear.
- Change partner removes the room identifier, name, and color from your phone.
- Deleting a special date removes it and cancels its reminder.
- A room with no connection and no saved drawing for 180 days is deleted entirely.
- To delete a room from the server right away, email contato@conhecendotudo.com.br. Because there are no accounts, we may ask for something only people in the room know, so nobody can delete your board in your place.
Your rights
Brazil's LGPD (Art. 18) gives you confirmation, access, correction, anonymization, blocking or deletion, portability, information about sharing, withdrawal of consent, and objection. In the European Union, the GDPR (Arts. 15 to 22) gives you equivalent rights.
To use them, email contato@conhecendotudo.com.br. Complete confirmation or access requests are answered within 15 days. You can also complain to Brazil's data protection authority (ANPD) at gov.br/anpd or, in the EU, to your national authority.
Age
The app is made for couples and is not directed to children. If we learn that a child's data was processed without a guardian's consent, we will delete it.
Security
All traffic to remote hosts uses TLS. The room identifier has at least 122 random bits and never appears in an invite. The server validates every update, rate-limits pairing attempts, and admits at most two identities per room. No system is invulnerable: if an incident may create relevant risk or harm, we will notify you and the ANPD within the deadline set by Resolution CD/ANPD No. 15/2024.
Changes
This policy has a version and a date. Relevant changes are announced on this page before they take effect. It complements conhecendotudo.com.br's general policy for its apps. The Portuguese version prevails over this translation.