Privacy policy
We collect as little as we can. We don’t sell your data, show ads or use tracking cookies. Questions or requests: [email protected].
What we store
- Account: your email and your password, stored only as a secure hash (Argon2). We can’t see your password.
- Saved items: the list of assets you saved, so it shows on any device.
- Subscription: if you buy Pro, your Stripe customer and subscription IDs and the subscription status. Stripe handles your card. We never see or store card numbers.
- Session cookie: one cookie (
illo_s) that keeps you logged in for up to 30 days. It’s needed for login and isn’t used for tracking. - Your browser: without an account, your saved items stay in your own browser (local storage), not on our server.
What we use for a short time only
- IP address: kept briefly in memory to stop password guessing and abuse, then forgotten. Our servers may also keep standard technical logs for security.
- Requests and waitlist: if you request an illustration or join the Figma plugin waitlist, we keep what you wrote and the email you gave, only to draw it or to tell you about the launch. Ask us and we delete it.
- Visitor counts: to see what people use, the site counts page views, downloads, copies and searches. We store totals per day, the website you came from, your country (from Cloudflare) and whether you use a phone or computer. To count visitors once per day we mix your IP address and browser name with a random code that is thrown away every day; the IP address itself is never stored. No cookies, nothing is shared.
- Brand match: when you paste a website, our server opens that public page once to read its colours. We don’t keep the link.
Who helps us run 99doodle
- Hetzner (Germany): our server and database.
- Cloudflare: delivers the site securely and gives us cookie-free visit counts (Cloudflare Web Analytics).
- Stripe: payments, invoices and the billing page.
- Resend: sends password reset emails.
- Google Fonts: loads the site’s fonts, so Google sees your IP address when the fonts load.
They only get what they need to do that job.
Why we use your data
To run your account, give you the features you asked for (Pro, saved items, password reset), take payments, keep the site secure, and meet legal duties such as tax records.
How long we keep it
Account data stays until you delete your account. Your account → Delete my account removes your email, password hash, saved items and sessions right away, and cancels any Pro subscription. Stripe keeps payment records for as long as tax and finance laws require.
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it. Delete your account yourself in one click, or email us for anything else. If you’re in the EU or UK, you can also complain to your data protection authority.
Children
99doodle is for professionals and isn’t meant for children under 16.
Changes
If we change this policy in an important way, we’ll say so on the site or by email.