Overview
RoughSketch is a diagram editor that saves your work to your own Google Drive. We do not operate a database for your diagrams: they live in your Drive and are sent directly from your browser to Google. Connecting an AI assistant over MCP is the exception — the assistant's requests run through our server, which reads and writes your sketches on your behalf and, when it asks to see one, caches a rendered preview of it. This policy explains that, and the account and operational data we handle, why, and how you can remove it.
For a focused summary of how RoughSketch uses data from Google APIs, see the Google API Services Disclosure.
Data we collect
When you sign in with Google, we receive:
- Your email address, display name, and profile photo URL (from your Google account, via the
openid,email, and profile scopes) - An OAuth refresh token and short-lived access token issued by Google (used to keep you signed in and to call Google Drive on your behalf)
- If you connect an assistant over MCP: a second Google refresh token and access token, issued for that connection, and the contents of the sketches the assistant asks us to read or write, which pass through our server for that one request
We do not receive or store payment information, contact lists, location data, or any Google data beyond the scopes listed above.
Google OAuth scopes and why we request each one
openid, email, profile: to sign you in and display your name and avatar in the app.https://www.googleapis.com/auth/drive.file: so you can save and load RoughSketch diagrams as files in your own Drive. This is the narrowest Drive scope Google offers: it grants access only to files you open or create with RoughSketch. We cannot see, list, or modify any other files in your Drive.https://www.googleapis.com/auth/drive.install: registers RoughSketch as an option in Google Drive's “Open with” and “+ New” menus, so you can launch the editor straight from Drive. This scope only manages the menu entry; it does not grant any access to your file contents.
How we use your data
- To sign you in and keep you signed in across sessions without asking you to re-authenticate repeatedly
- To read and write the RoughSketch diagram files you choose to open or create, directly between your browser and Google Drive
- To display your name and avatar in the app so you know which account is active
- If you connect an assistant over MCP, to carry out what it asks on your behalf — listing, searching, reading, creating, editing, arranging, renaming, and trashing your sketches in your Drive, and rendering a preview of a sketch so the assistant can check its own work
- To diagnose and fix problems with the service (through limited operational logging described below)
We do not use your Google data for advertising, profiling, or to train generalized artificial-intelligence or machine-learning models. We do not sell your data. See the Google API Services Disclosurefor our affirmative Limited Use commitment.
How and where we store data
- OAuth refresh token: encrypted on our server using AES-256-GCM and stored in Cloudflare Workers KV, keyed by your Google account id rather than your email address. It is only decrypted transiently to request a new access token from Google.
- Access token: in a browser session, held in server memory for the duration of a single request and never persisted. On an MCP connection it is stored on that connection's grant record in Workers KV, and replaced each time it is refreshed.
- MCP connection record: connecting an assistant creates a grant record in Workers KV. The two Google tokens it holds — a second refresh token and the current access token — are encrypted with AES-256-GCM under a key belonging to that one connection; we hold no key of our own for it. Only a credential the assistant holds unwraps that key — the access token it sends with each request, the refresh token it exchanges for a new one, or the authorization code during the minutes before its first token is issued. The record is keyed by your Google account id. Your email address sits inside that same encrypted block, not in the clear; what is readable on the record is when you authorized the connection and which client you authorized. Every access token issued from the connection also gets a record of its own, keyed the same way and carrying an encrypted copy of the same values; it expires with the token. A connection authorized before September 2026 is keyed by your email address instead, and its token carries that address, until you disconnect and reconnect it.
- Sketch previews: only if you connect an assistant over MCP and it asks to see a sketch. A Cloudflare edge cache holds the entries described under “Diagram content and our servers” below, each keyed to the file and its last-modified time, so an edit leaves the old entry unused. They expire on their own, on the schedule under Data retention, and are not written to any database of ours.
- Session cookie: after sign-in, we set a signed JSON Web Token as an httpOnly,Secure, SameSite=Strict cookie on your browser. Because it is httpOnly, page JavaScript cannot read it, which reduces exposure to cross-site scripting. The cookie is not stored in
localStorage. - Local drafts: your browser stores drafts of diagrams in the Origin Private File System (OPFS), a sandboxed area scoped to
roughsketch.app. On older browsers that do not support OPFS, we fall back to IndexedDB under the same origin. This lets you work offline and recover unsaved changes. Drafts are written by your browser only and are not sent to our servers. They are cleared when you delete the diagram, clear site data, or use a different browser or device. - Anonymous-mode scenes: if you use RoughSketch without signing in, your scene is persisted in OPFS (or IndexedDB as a fallback) on your device only. It never leaves your device.
Diagram content and our servers
When you open or save a diagram in the editor, the file is transferred directly between your browser and Google Drive using your Google access token. RoughSketch's servers are not on that data path and keep no copy of it.
An assistant connected to our MCP server works differently, and only for as long as you keep it connected. The assistant does not reach Google Drive itself: its requests come to our server, which reads and writes the sketch on your behalf. Reading a sketch, searching inside your sketches, and creating, editing, or arranging one all put the sketch's contents through our server, where they stay in memory for that one request and are not kept afterwards. Several of those tools work over what a sketch says rather than just moving it: reading returns a summary our server computes from the elements (or, in full mode, the raw file), arranging computes a layout from those elements, searching matches your query against the text in the scene, and a preview names the sketch's sections after the first line of the largest text in each, or “Region N” where a section has none.
The preview tool also keeps a copy. When an assistant asks to see a sketch, we render it to an image so it can check its own work, and a Cloudflare edge cache holds that image for up to 24 hours; when it asks for the sketch's sections instead, the cache holds that list — each section's name (the first line of its largest text, or “Region N” where it has none), bounding box, element count and element ids — for the same period. When a full render fails, a marker recording the sketch's size in bytes is held — seconds in the ordinary case, up to 6 hours when the sketch is too large to render — so we do not retry a render that cannot succeed. Every entry is keyed to the file and its last-modified time (and, for images, the requested region, elements and size), so an edit leaves the old entry unused rather than serving it, and nothing is returned from the cache until Google Drive has confirmed the request is coming from someone who can already open the file. If you never connect an assistant, nothing of yours is rendered or cached on our servers.
On either path, we do not index or analyze the contents of your diagrams for advertising or profiling, and we never use them to train AI or machine-learning models.
Third-party services
- Google LLC: provides authentication (Google Sign-In / Google Identity Services library, loaded from Google's CDN) and file storage (Google Drive). Governed by Google's Privacy Policy.
- Cloudflare, Inc.: hosts the application (Cloudflare Workers), stores the encrypted refresh token and any MCP connection records (Workers KV), caches rendered sketch previews on its edge network, and provides privacy-preserving web analytics as described below. Governed by Cloudflare's Privacy Policy.
- Google Fonts: RoughSketch loads the Caveat display font from
fonts.googleapis.com and fonts.gstatic.com for visual styling. This is a standard font-hosting service provided by Google; no account information or diagram content is sent as part of font requests. Governed by Google's Privacy Policy.
We do not embed any third-party trackers or share your data with advertisers or data brokers. Apart from an assistant you connect yourself, the services above are the only third parties RoughSketch interacts with.
On the MCP path, the sketch contents that the assistant asks for are returned to it and then handled by whoever operates that assistant, under their privacy policy rather than ours. The token the assistant holds identifies you to us by your Google account id, not by your email address — unless the connection predates September 2026, in which case its token still carries the address until you reconnect. You choose which assistant to connect, and disconnecting it ends that flow.
Analytics and tracking
RoughSketch uses Cloudflare Web Analytics to understand aggregate usage patterns (page views, browser/OS mix, approximate region). Cloudflare Web Analytics is cookieless, does not use fingerprinting, does not track users across sites, and anonymizes IP addresses before storage. No advertising cookies, tracking pixels, or third-party analytics scripts run on this site.
You can further opt out at the browser level by enabling “Do Not Track”, blocking scripts from static.cloudflareinsights.com, or using a privacy extension of your choice.
Separately, when you sign in or your session refreshes, we record a single timestamped event so we can count how many people use RoughSketch each day and each month. Your email address is not stored in these records: it is replaced by an irreversible keyed hash, computed with a secret that never leaves our server, which lets us count the same person once without being able to identify them from the analytics data. No page addresses, diagram names, diagram contents, or IP addresses are attached to these events, and Cloudflare retains them for approximately three months.
Operational logging
When your browser or a connected assistant talks to the RoughSketch API (for sign-in, token refresh, and MCP tool calls), Cloudflare records standard request metadata such as the request timestamp, HTTP status, user-agent string, and truncated IP address. These logs are retained briefly by Cloudflare for abuse prevention and are not combined with your Google account data.
Data retention
- The encrypted refresh token is retained in Workers KV until you sign out or ask us to delete it. Signing out replaces it with a marker that holds no token and expires 90 days later; the marker is what stops a session cookie still sitting in a browser from being renewed. Revoking access from your Google account makes the token unusable — Google refuses the next refresh — but leaves the record in place; once the app next tries to refresh it treats you as signed out, so email us and we will delete it.
- The session cookie expires automatically and is not renewed after you sign out.
- An MCP connection's grant record is retained in Workers KV until the client revokes its refresh token, we delete it on request, or 30 days after you authorized the connection — whichever comes first. After that the assistant has to be reconnected. The record for each access token issued from the connection expires with that token.
- Cached sketch previews expire on their own: a rendered image or a section list within 24 hours, a failed-render marker within seconds in the ordinary case and within 6 hours when the sketch is too large to render.
- Operational request logs are retained by Cloudflare per their standard platform retention (typically days to a small number of weeks).
- Hashed sign-in and session-refresh events, used only for aggregate daily and monthly user counts, are retained by Cloudflare for approximately three months.
- Local drafts in OPFS remain on your device until you clear site data or delete the corresponding diagram.
Your rights and choices
You can exercise the following rights at any time:
- Access: the account data we hold is your Google account id, which keys both your encrypted refresh token and any MCP connection record, and your email address, which is held inside those records' encrypted contents — alongside the tokens themselves and the connection details listed under storage above. Your name and profile photo come from Google each time you sign in and are not stored on our servers; you can see them at any time from the account menu in the app.
- Revocation: revoke RoughSketch's access to your Google account at myaccount.google.com/permissions. This immediately makes the refresh tokens we hold unusable, for the browser session and for any connected assistant alike: the next time we ask Google for a new access token it refuses, and the MCP client is told to reconnect. It deletes nothing on our side — the records stay until they are deleted or expire, as set out under Data retention above.
- Deletion: signing out deletes the encrypted refresh token from Workers KV and clears your session cookie. The marker left in its place holds no token and expires after 90 days, as set out under Data retention above. It does not touch an MCP connection, which is a separate authorization: remove the connector in your assistant, and the grant record is deleted when the client revokes its refresh token at our token endpoint. Not every client does; email us and we will delete a record left behind. We do not purge cached sketch previews on request — they expire on the schedule above.
- Portability: your diagrams are standard
.excalidraw-format JSON files in your own Google Drive. You can download, move, or delete them at any time using Drive's own tools. - Rectification: the profile fields we display come from your Google account. Update them there; the app picks up the new values the next time you sign in.
- Complaint: residents of the EEA, UK, or Canada may lodge a complaint with their national or provincial data protection authority. Canadian residents may contact the Office of the Privacy Commissioner of Canada.
Security
- All traffic between your browser, RoughSketch, and Google is encrypted in transit using TLS.
- Google tokens are encrypted at rest with AES-256-GCM before being written to Workers KV — the sign-in refresh token under our server key, an MCP connection's tokens under that connection's own key.
- The session cookie is issued as a signed JSON Web Token with the
HttpOnly, Secure, and SameSite=Strict attributes. - No system can be guaranteed completely secure; please report suspected vulnerabilities to the contact below.
International data transfers
RoughSketch runs on Cloudflare's global network, and your Google data is hosted by Google in the regions they operate. Your data may therefore be processed outside your country of residence, including in the United States. Where applicable, we rely on the privacy frameworks and contractual safeguards maintained by these providers.
Children's privacy
RoughSketch is intended for users who are at least 18 years old. We do not knowingly collect personal data from children. If you believe a child has used RoughSketch and provided personal data, please contact us and we will delete the associated records.
Changes to this policy
We may update this policy to reflect new features, legal requirements, or changes to our infrastructure. Material changes will be indicated by updating the “Last updated” date above. Continued use of RoughSketch after an update means you accept the revised policy.