draf.ing is a drawing tool. It holds the account you sign in with and the drawings you make, and nothing is sold, shared or handed to an advertiser. This page says exactly what is stored, where, and for how long. Last updated 14 September 2026.
Signing up stores one record: an internal id, your email address, a display name taken from that address or from your sign-in provider, a hash of your password, your plan, and the date the account was made. The password itself is never stored. It is hashed with scrypt, which cannot be reversed.
Signing in with Google or Microsoft stores the subject id that provider gives us, plus the email address and name on that account. draf.ing never sees your password at those providers and asks them for nothing else.
You can use the editor without an account. A guest is a cookie and nothing more: no email address, no name, one drawing, and both the cookie and the drawing are gone within a day.
Every drawing is stored as a file on the same server that serves this page, readable only by the account the service runs as. The file holds the sheet, its undo history, and any snapshot you have shared. Whatever you type into a drawing (tag numbers, line numbers, notes) is stored with it, so treat a drawing the way you would treat any working document.
Three, all first-party, all signed by the server, and none of them for advertising or analytics.
| Cookie | What it does | Lifetime |
|---|---|---|
| dfsid | Keeps you signed in. | 30 days |
| dfguest | Holds a guest drawing to the browser that made it. | 24 hours |
| dfoauth | Carries one connector approval through its consent page. | 10 minutes |
All three are set with HttpOnly, SameSite=Lax and Secure, so a script cannot read them and they do not travel to other sites. Clearing your cookies signs you out and, for a guest, gives up the drawing.
There is no analytics package, no tag manager, no session recorder, and no advertising pixel anywhere on this site or in the editor.
fonts.googleapis.com and fonts.gstatic.com, which means Google sees the IP address of the browser making that request. Nothing else is sent, and no cookie travels with it.| Thing | Kept |
|---|---|
| Account record | Until you ask for the account to be deleted. |
| Drawings | Until you delete them, or the account goes. |
| Guest drawing | 24 hours after the last edit, then swept automatically. |
| Connector access token | 1 hour. |
| Connector refresh token | 30 days, and it rotates on every use. |
| Web server log | 14 days. |
Questions, a deletion request, or a security report: [contact address]. This page changes when the service does, and the date at the top says when it last did.
The MCP connector