Limited Use affirmation
RoughSketch's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
What Google APIs we use
RoughSketch integrates with Google to let you sign in with your Google account and save diagrams to your own Google Drive. We request the following OAuth scopes:
openid, email, profile: to sign you in and display your name and avatar.https://www.googleapis.com/auth/drive.file: the narrowest Drive scope Google offers. It grants RoughSketch access only to files you open or create with RoughSketch. We cannot see or modify any other file in your Drive.https://www.googleapis.com/auth/drive.install: lets RoughSketch register itself as an option in Google Drive's “Open with” and “+ New” menus, so you can launch the editor directly from Drive. This scope only controls the menu entry; it does not grant any access to your files.
How we handle Google user data
- In the editor, diagram content is transferred directly between your browser and Google Drive. RoughSketch's servers are not on that data path and keep no copy of the file.
- If you connect an AI assistant to our MCP server, its requests run through our server instead: we read and write the sketch on your behalf with your Google token, holding the contents in server memory for that one request. One of those tools, the preview, also keeps a copy — an edge cache holds the rendered image for up to 24 hours, or for the same period the sketch's section list, which holds each section's name (the first line of its largest text, or “Region N” where it has none), bounding box, element count and element ids, when the assistant asks for that instead. When a full render fails, a marker recording the sketch's size in bytes is held — seconds in the ordinary case, up to 6 hours when the sketch is too large to render — so we do not retry a render that cannot succeed. Every entry is keyed to the file and its last-modified time (and, for images, the requested region, elements and size), and is served only after Google Drive confirms the requester can already open the file.
- The sketch contents an assistant asks for are returned to it and then handled by whoever operates that assistant, under their privacy policy rather than ours. The token the assistant holds identifies you to us by your Google account id, not by your email address — unless the connection predates September 2026, in which case its token still carries the address until you reconnect. You choose which assistant to connect, and disconnecting it ends that flow.
- Google user data persisted on our infrastructure: an OAuth refresh token, encrypted with AES-256-GCM and stored in Cloudflare Workers KV, used solely to keep you signed in; a grant record in Workers KV for each MCP connection you create; a short-lived record for every access token issued from such a connection; and the preview cache entries described above.
- On a grant record, the two Google tokens — a second refresh token and the current access token — are encrypted with AES-256-GCM under a key belonging to that one connection; we hold no key of our own for it. Only a credential the assistant holds unwraps that key — the access token it sends with each request, the refresh token it exchanges for a new one, or the authorization code during the minutes before its first token is issued. The record is keyed by your Google account id. Your email address sits inside that same encrypted block, not in the clear; what is readable on the record is when you authorized the connection and which client you authorized. The record for each access token issued from the connection is keyed the same way and carries an encrypted copy of the same values, expiring with the token. A connection authorized before September 2026 is keyed by your email address instead, and its token carries that address, until you disconnect and reconnect it.
- No humans read your Google user data except as necessary for security investigations, to comply with the law, or where you affirmatively consent.
- We do not use Google user data to develop, improve, or train generalized artificial-intelligence or machine-learning models.
- We do not sell Google user data, use it for advertising, or transfer it to third parties for advertising or data-broker purposes.
How to revoke access
You can revoke RoughSketch's access to your Google account at any time at myaccount.google.com/permissions. Revocation takes effect immediately and makes every Google token we hold unusable, for the browser session and for any connected assistant alike, but it deletes nothing: the records stay until they are deleted or expire. Signing out from within the app is what deletes the encrypted refresh token from our infrastructure, and it clears your session cookie. An MCP connection is a separate authorization: remove the connector in your assistant, and the grant record is deleted when that client revokes the connection's refresh token; in any case the grant expires 30 days after you authorized it. If a client leaves a record behind, email us and we will delete it. Cached previews are not purged on request; they expire on the schedule in the Privacy Policy.
More detail
For the full description of what we collect, how we store it, retention periods, security practices, your rights, and our contact information, see the Privacy Policy.