Privacy

The short version: nothing about you leaves your machine.

The app

• The editor sends nothing about you or your diagrams. There is no account, no sign-in, no telemetry, no crash reporting. After the first visit it is fully cached and works with the network cable pulled — everything except collaboration, which needs the network anyway, and whose module is fetched from this site the first time you share.
• The one thing it does ask for is itself: now and then it checks this site for a newer version, which is what puts the “Update available” prompt on screen. That is a request to this site for the app’s own code — no third party, no identifier, nothing about what you have drawn — and the new version is only applied when you click Reload.
• Your diagrams are saved to files you choose and to your browser’s local storage for autosave. They are never uploaded anywhere.
• The desktop app has exactly one optional network call: a notify-only update check against this site’s release feed. It sends nothing but the request itself, downloads nothing without you clicking, and can be turned off in settings.
• Collaboration is end-to-end encrypted between the participants, always. Who carries it depends on which version you are using, and this changed in August 2026, so it is worth being exact.
  
  In the desktop app it is peer-to-peer. Our relay introduces the two machines and carries the encrypted handshake, then your diagram travels directly between them wherever a direct connection can be made. The relay stays connected as a fallback, so it sees which endpoints are in a session, their IP addresses and when they connect — never the diagram. Where a direct connection cannot be made — a strict firewall, an awkward NAT — the diagram goes through that same relay of ours, described below, still encrypted. It used to fall back to a public relay operated by n0; it no longer does, because a browser and a desktop can only reach each other if they meet on the same relay, and the browser can only use ours.
  
  In the browser it is always relayed — a web page cannot make the kind of direct connection this uses — and that relay is ours, running on this site rather than n0’s. We changed it so that everything the app touches is one address, which is what lets people behind strict firewalls use it at all. Be clear about what that means: your diagram passes through a server we run. It is end-to-end encrypted between the participants, so what reaches us is ciphertext we cannot read, and we store none of it — the relay forwards packets and keeps nothing. But it is our machine in the path, where before it was somebody else’s, and you should know that rather than infer it.
  
  The app tells you when it is happening, on both sides: the status pill reads relay whenever anyone in the session is.
  
  What the relay sees, in either version: the public keys that identify the machines in a session, their IP addresses, and when they connect and how much they send. Never the diagram — that is end-to-end encrypted between the participants — and nothing is stored. Requests to the relay (/relay) and its latency check (/ping) are not written to the web server’s log: they are not among the three things listed below.
• AI assistants (desktop) — running Drawbridge --mcp turns the app into a local MCP server an assistant of your choosing can call to read, render, generate, edit and check drawings — and, while you have a collaboration session open, to read and edit the document that session is sharing. The server itself makes no network call — it speaks only over its own stdin/stdout to the assistant that started it. Be clear about the boundary, though: a drawing you let an assistant read, and a topology you ask it to draw, are handed to that assistant — and so to whoever runs it. That is your choice to make per assistant; nothing crosses that boundary until you configure a client yourself.
• The hosted API (beta) — when you use our server instead of your own installation, a document you send is uploaded to it, rendered, returned, and forgotten: it is held in memory and scratch space for the duration of your request and is not written to any log, database or file. We do not record what you sent or what came back; the access log records that a request happened — the time, the size, the status, and what the service was asked to do: which capability, which export format, how long it took, and whether one of our limits refused it — never its content, and documents never appear in URLs. That last part is how we size the service, and it is deliberately the most we keep: not the name you asked us to call the file, not your address, not one byte of the drawing. If you would rather nothing left your machine at all, every one of these capabilities also runs locally — the desktop app is the same engine.

Your own cloud, if you ask for it

You can connect Google Drive, Microsoft OneDrive or Dropbox to save drawings there It is off until you turn it on. When it is on, your browser talks to that provider directly — sign-in, files, everything — and our server is not in the path: it never receives a file, a file name, a token or your account. The provider sees the files you put in its Drawbridge folder (including any folders you make inside it) and nothing else; we ask it for no name, no e-mail address and no other files. Disconnect at any time from Storage in the app menu; the files stay in your cloud. The one thing that passes our web server is the single-use sign-in code Google and Dropbox send back in the address (Microsoft sends it in a part of the address a browser never transmits), useless without the secret only your browser holds, and our server does not write it down. The full walkthrough, request by request, is docs/10-CLOUD-STORAGE.md.

This website

• No cookies. No analytics. No trackers. No third-party requests — with exactly one exception, which only happens if you ask for it: see the tip panel below.
• The web server keeps only the short-lived technical logs any web server produces, used for keeping the service running and for two numbers we care about: how often the app is downloaded, and how much it is used and costs to serve. Three things are logged and nothing else — fetches of the release files, requests to the web app at /app, and requests to the hosted API and MCP door (the request line, and what the service says it was asked to do — see above: never a document). All three are counted into daily totals: downloads per file, and for the app how many requests, how many bytes, how many times it was opened, and how many distinct addresses that day. The stored counts are plain integers: no addresses, no user agents, no identifiers, nothing that can single anyone out or link one day to the next, and the raw log is emptied as it is counted. Browsing the rest of the site — these pages, the docs, the download page itself — is not logged by the web server at all, and nothing about what you draw or do inside the app is ever sent here.
• In front of the web server sits the gateway that handles HTTPS for this site. Like any proxy it keeps a short technical log of the requests it passes on — the time, the address that made the request, the page asked for and the answer — so that faults and abuse can be diagnosed. That log is not counted, analysed or shared with anyone, and it is deleted as it rotates: nothing in it is older than five weeks.
• The feedback form sends exactly what you type and pick: your message, the channel you pick for a reply with the contact line you write, and which layout you were using, Studio or Classic — already picked when you have used the editor in this browser or opened the form from it, so change it or leave it on “Not sure”. That, plus a file if you choose to attach one; nothing else is collected with it. Leave the contact field empty and the submission is anonymous. See attaching a file below.
• The gallery’s submit form sends the screenshot you pick, the words you type and a way to reach you; nothing else is collected with it. Unlike feedback, what you send there is meant to be published — but only after review, and never your contact. See sending a screenshot below.

Attaching a file to feedback

The feedback form has an optional file field. It exists for one thing: Drawbridge’s Report a bug can save a drawbridge-bug-report.zip containing the screenshots you chose to include, and pictures cannot travel inside the text of a report. Nothing is attached unless you pick the file yourself.

If you attach it, the .zip is stored in a private repository that only the maintainer can read, and the report it belongs to links to it. It is stored as you sent it — never unpacked, scanned, or looked inside on the way through. Nothing is extracted from it, and it is not shared with anyone else or used for anything but fixing what you reported.

The app never uploads anything by itself. It writes the .zip to your own downloads folder and you decide whether to send it — and it shows you every file it put in there first. If you would rather not send pictures at all, simply do not attach the file; the written report goes through on its own.

Sending a screenshot to the gallery

The gallery shows drawings and setups that people made with Drawbridge and chose to share. Its submit form takes one screenshot — a PNG, JPEG or WebP image you pick yourself — a title, an optional description, the name you want to be credited as, and a way to reach you.

Nothing is published when you send it. The submission is stored in a private repository that only the maintainer can read — hosted on GitHub, which keeps it on our behalf — and waits there for review. If it is approved, the picture is re-encoded before it goes up — which also drops anything riding inside the file, such as camera details or a location — and it appears in the gallery with your title, your description and the credit you chose, or Anonymous if you left that empty. If it is not approved, it is never published at all.

The way to reach you is never published. It is required, and it is used for one thing: telling you that your screenshot went up, or why it did not. It is kept apart from the rest of the submission, in that private repository, only until your submission has been decided and you have been told — then it is deleted. It is not shared with anyone else, and you can ask for it to be deleted sooner through the feedback form.

You can ask for a published screenshot to be taken down at any time, through the feedback form; it is removed from the gallery and from the next version of the site.

The tip panel

The donate page can show a Ko-fi tip panel inline, so you do not have to leave this site to support the project. That panel is loaded from ko-fi.com, and it is the only thing anywhere on this site that is not served from this domain.

It does not load until you press the button. Open the donate page, read it, and leave again, and nothing is ever requested from Ko-fi — no frame, no script, no cookie. Press the button and you are choosing to load Ko-fi's page inside ours, at which point Ko-fi's own privacy policy applies to what happens inside that panel. Payment is handled entirely by Ko-fi; card details never touch this site, and we never see them.

If you would rather not load it at all, the same page has a plain link to Ko-fi that works exactly as any link does.

External links

Other outbound links (GitHub, Ko-fi, licence texts) are plain links you choose to follow. Following one takes you to a site with its own privacy policy.