Privacy policy

Your boards stay on your device

Boards, the pictures on them and your settings are saved in your browser's storage on your device. You can draw without an account, and then nothing you draw reaches our server.

Backups you make are files on your device. We never see them.

What reaches our server

When you sign in or try to, and only what the features you use need:

• Your account: your email address, and your name and profile picture if you sign in with Google. If you use a password, we store only a salted hash of it, never the password itself.
• Boards you share: a copy of each board you share, so the people you invite can open it, with their email addresses and roles.
• Ask chat history: your messages and Ask's replies, so you can go back to them. You can delete a chat at any time. How long chats are kept is explained under "How long we keep data".
• AI usage: for each day, how many Ask requests you made, the tokens and cost they used, and a keyed hash of each message (not its text), used to spot the same message sent many times. This applies the plan limit and stops abuse.
• Board activity: how many boards you created and edited on our server, and when you last did.
• View-only links: if you turn on a view-only link for a board, anyone who has the link can open and read that board without signing in, until you turn the link off or delete the board. Pictures on the board are not included.

When you create an account

If you create an account with an email address and a password, we collect only the following, to run your account and keep sign-ups fair. It is never sold. It is deleted when you delete your account; an unfinished sign-up is deleted within a day.

• Your email address and a hash of your password (never the password itself).
• A display name, shown to people you share boards with.
• Your country or region and what you use the app for (personal, study, work or other), to understand who uses it.
• The version of the Terms and Privacy policy you accepted, and when.
• Whether you want product news by email (off unless you tick it; you can ask us to stop at any time).
• If you sign up with Google: your email address, name and profile picture from Google (you can change the name before the account is made), plus the same country, purpose, Terms acceptance and product-news choice.
• Emails are sent through Resend (and Brevo as a backup, only if it is turned on). When you sign up with email, the address's domain (the part after @) is checked through Cloudflare's DNS service to make sure it can receive mail.

Keeping accounts safe

To stop fake sign-ups, password guessing and AI abuse, the server keeps a few signals. Your IP address, device id, browser and email address appear in them only as keyed hashes, which cannot be turned back into the original.

• Sign-in records: the time and kind of each sign-in, sign-up, code request and failed attempt, with hashes of the email address typed, your IP address (for IPv6, its /64 network) and your device. They are written even when the attempt fails.
• Your account's networks and devices: hashes of the IP addresses and devices that signed in to your account. A known device is not slowed down by a stranger's wrong passwords.
• Wrong-password counters: one entry per failed password, keyed by a hash of the account, the IP address and the network. Email codes are also counted per address (as a hash): after too many wrong codes in a day, codes for that address are paused for 24 hours.
• Sign-up record: when and how (email or Google) your account was made, hashes of your IP address, network, device and browser, the country Cloudflare reports for your connection, and whether the address is from a throwaway email service.
• Risk score: a score worked out from these signals and your AI usage, with the reasons behind it, and any limit placed on the account automatically or by us. A high score can pause Ask for your account; it never deletes anything.
• Bot check: signing up, resetting a password, and signing in after several wrong passwords show a Cloudflare Turnstile check. Your browser loads it from Cloudflare, and our server sends Cloudflare the check's answer and your IP address to verify it. Cloudflare processes this data for us.

Ask and the AI provider

When you use Ask, your message, the pictures you attach and the parts of the board Ask needs are sent through our server to our AI provider, DeepSeek, which produces the reply.

Pictures you attach are passed to the model and are not stored on our server. In your chat history, pictures stay on your device only.

Cookies and local storage

There are no advertising or analytics cookies. The app uses these cookies, which scripts on the page cannot read:

• navyreef_session: keeps you signed in. Set when you sign in; lasts 30 days.
• navyreef_device: a random id for this browser (not a fingerprint), used for the sign-in protection above. Set when you sign in or try to sign in with email, and when you sign in with Google; lasts 400 days.
• navyreef_otp: links an email code to the browser that asked for it; lasts 15 minutes.
• navyreef_gpending: during a first Google sign-in, links this browser to the "Complete your profile" step; lasts 30 minutes.
• navyreef_oauth_state, navyreef_oauth_verifier and navyreef_oauth_reauth: protect a Google sign-in while it is under way (the last one only when you sign in again to delete your account); last 10 minutes.
• These pages remember your theme and language choice in your browser's local storage, and they make no requests to other companies.

How long we keep data

• Account details, including the password hash: until you delete your account (Settings > Account > Delete account).
• Shared boards: until you delete them or your account.
• Ask chat history: a chat not used for 90 days on Free is hidden at once and deleted the next time you open or save your chats. There is no scheduled clean-up yet, so if you do not come back, it stays stored until you delete it or your account.
• AI usage, board activity, the sign-up record and the risk score: as long as your account; they are deleted with it.
• Sign-in records: 90 days, also after an account is deleted.
• When an account is deleted, one record of the deletion (the time, and keyed hashes of the email address and the IP address) is kept with the sign-in records for 90 days.
• If Ask was paused on an account when it was deleted, a keyed hash of its email address (never the address itself) is kept for 30 days, so the pause carries over to a new account made with that address. Nothing is kept for other accounts.
• Your account's networks and known devices: 90 days after they were last used.
• Wrong-password counters and unfinished sign-ups (the email address and password hash waiting for the code): one day. Email codes are stored only as hashes and expire after 10 minutes.

Your rights

You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] from the address you use with NavyReef Board.

You can delete your account yourself at any time in the app: Settings > Account > Delete account. If you cannot sign in, email us as above.

You can also complain to the data protection authority where you live.

Changes to this policy

When this policy changes, we update the date at the top of this page.

Contact

Questions about privacy: [email protected].