Privacy Policy

Last updated: June 2026

1. Overview

Deep Draft ("we," "our," or "the Service") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data. We designed Deep Draft to collect as little personal information as possible while still providing a useful service.

2. Data We Collect

We collect the following information when you use Deep Draft:

Email address: Collected when you sign in using magic link authentication. Used for account identification, subscription management, and service communications (such as deadline reminders).
User-generated content: Projects, scripts, ideas, research notes, deals, revenue entries, expenses, and other content you create within the app. This data is stored locally on your device and, if you are signed in, synced to our cloud database.
Subscription status: Whether you are on the free tier or a premium subscriber, and your subscription dates. Payment details are handled entirely by Stripe (see Section 5).
Support reports: If you contact support or submit a report through the app or the website support form, we receive the message and context you choose to include along with your email address.
Product usage analytics: We use a privacy-respecting product analytics service (PostHog) to understand how the landing page and app are used (for example, pages viewed, sign-ups, and which features are used) so we can improve the Service. These events are tied to a randomly generated identifier and, once you sign in, to your account so we can measure the sign-up funnel. We do not use this data for advertising. See Section 5 for details.

3. What We Don't Do

We want to be clear about what we do not do:

No advertising networks: We do not serve ads, embed advertising tracking pixels, or participate in any ad network.
No cross-site ad tracking: Our analytics (PostHog) is used only to understand and improve Deep Draft. We do not use it to track you across other websites or to build advertising profiles.
No BYOK API key collection: If you bring your own API keys, they are stored exclusively on your local device. We never transmit, access, or store your API keys on our servers.
No data selling: We do not sell, rent, or share your personal data with third parties for their marketing purposes. Period.

Analytics is fully optional from our side: it is disabled unless configured, and where required by law we honor "Do Not Track" / opt-out signals. You can also block it with standard browser privacy tools without affecting the core app.

4. How Your Data Is Stored

Your data is stored in two places:

Local device storage: All your content is stored locally in your browser or on your mobile device. This data remains on your device and is under your control.
Cloud storage (optional): If you sign in, your data is synced to Supabase, which is hosted on Amazon Web Services (AWS) with servers located in the United States. Cloud-stored data is encrypted in transit (TLS) and at rest. Access to your data is protected by Row Level Security (RLS) policies, meaning only you can read or modify your own data.

5. Third-Party Services

Deep Draft integrates with the following third-party services. Each receives only the minimum data necessary to provide its function:

Supabase (authentication and database): Receives your email address for authentication and stores your user-generated content for cloud sync. Supabase Privacy Policy.
Stripe (payment processing): Receives your email address and payment information to process subscription payments. We do not store your credit card number, expiration date, or CVC on our servers -- Stripe handles all payment data directly. Stripe Privacy Policy.
Resend (email delivery): Receives your email address to send transactional emails such as deadline reminders and magic link sign-in emails. Resend Privacy Policy.
AI providers — Anthropic, OpenAI, and Groq (AI processing): When you use AI features powered by Deep Draft's hosted key, your prompts and relevant content (such as script text, ideas, or research notes) are sent to Anthropic's Claude API for processing. This does not include your email address or account information. When you bring your own API key (BYOK), requests go directly from your device to the provider you chose (Anthropic, OpenAI, or Groq) and Deep Draft's servers are not involved. AI providers process this content to return a result and, per their API terms, do not use it to train their models. Anthropic, OpenAI, and Groq privacy policies.
ElevenLabs (text-to-speech): When you use the voice preview feature (premium only), your script text is sent to ElevenLabs for audio generation. If you use your own ElevenLabs API key, this data goes directly from your device to ElevenLabs. ElevenLabs Privacy Policy.
PostHog (product analytics): Receives usage events from the landing page and app (such as page views, sign-ups, and feature usage) along with a randomly generated identifier, your account identifier once you sign in, and basic technical data such as device/browser type. Used only to understand and improve the Service. PostHog Privacy Policy.
Vercel (hosting): Hosts the website and app and processes standard server request data (such as IP address and user agent) to deliver and secure the Service. Vercel Privacy Policy.
YouTube Data API, RAWG API, Google Suggest API, and Reddit/news feeds (research and analytics): These services receive search queries and, for YouTube, the channel identifiers needed to show your channel analytics, to provide game data, trending content, and discovery feeds. Deep Draft's use of information received from YouTube APIs complies with the YouTube Terms of Service and the Google Privacy Policy; you can revoke Deep Draft's access to your Google/YouTube data via the Google security settings page.

6. Data Retention

We retain your data for as long as your account is active. Specifically:

Your cloud-synced data is kept on our servers as long as you maintain an active account.
If you cancel your premium subscription, your data remains accessible. You do not lose your data by downgrading.
If you request account deletion, we will delete all your data from our servers within 30 days. Some data may persist in encrypted backups for a limited time before being purged.
Data stored locally on your device is entirely under your control and is not affected by account deletion on our end.

7. Your Rights

You have the following rights regarding your data:

Access: You can view all data associated with your account within the app.
Export: You can export your data (including revenue data as CSV) through the Settings screen.
Deletion: You can delete your account and all associated cloud data through Settings, or by contacting us at support@deep-draft.com.
Correction: You can edit or update your content at any time within the app.

If you are located in the European Economic Area (EEA), United Kingdom, or California, you may have additional rights under GDPR, UK GDPR, or CCPA respectively. To exercise any data rights, contact us at support@deep-draft.com.

8. Children's Privacy

Deep Draft is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at support@deep-draft.com and we will promptly delete that information.

9. Security

We take reasonable measures to protect your data, including:

All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
Cloud-stored data is encrypted at rest on Supabase/AWS infrastructure.
Row Level Security (RLS) policies ensure that only you can access your own data in the database.
We do not store passwords -- authentication is handled via magic links (one-time email codes).
BYOK API keys are stored using secure local storage on your device and are never sent to our servers.

No system is perfectly secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a security breach affecting your data, we will notify you as required by applicable law.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will make reasonable efforts to notify you via email or an in-app notice. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

11. Contact

If you have questions or concerns about this Privacy Policy or how your data is handled, please contact us at support@deep-draft.com.