Privacy Policy

1. Overview

We are committed to transparency about how we handle your data. This policy covers all Chamuka DrawIt products: the web app at chamuka.ai, the CLI, VS Code extension, desktop app (Tauri), MCP server, and embed SDK.

We collect only the data we need to provide and improve the Service. We do not sell your personal data to third parties.

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Name (if provided via OAuth provider)
• Profile picture URL (if provided via OAuth provider)
• Authentication provider identifier (Clerk user ID)

Authentication is handled by Clerk. We store a reference to your Clerk ID and email address in our own database to associate your diagrams, subscription, and credits with your account.

2.2 Diagram Content

Diagrams you create and save to the cloud are stored in our database (encrypted at rest via our hosting provider). This includes:

• Diagram JSON (nodes, edges, shapes, styles)
• Diagram names and metadata
• Room/session identifiers for collaboration

Diagrams created offline (desktop app or local browser storage) are stored only on your device and are not transmitted to our servers unless you explicitly save them to the cloud.

2.3 AI Prompts and Inputs

When you use AI features (diagram generation, agent chat, design suggestions), your prompts and relevant diagram context are transmitted to third-party AI providers. We do not permanently store the full content of AI prompts, but we do log:

• The type of AI operation performed (e.g. ai_generation, image_generation)
• Credits consumed per operation
• Timestamp of the operation

This usage data is used for billing, abuse prevention, and improving the service. Third-party AI providers (Google Gemini, Anthropic Claude, Pollinations) process your prompts under their own privacy policies. We recommend not including sensitive personal information in AI prompts.

2.4 Subscription and Billing Data

Payment processing is handled entirely by Stripe. We do not store your full payment card details. We store:

• Stripe customer ID
• Subscription plan and status
• Billing period dates
• Credit balance and transaction history

2.5 Usage Data

We automatically collect limited technical data to operate and improve the Service:

• Pages visited and actions taken within the web app (via Vercel Analytics — aggregated and privacy-preserving)
• Performance metrics (via Vercel Speed Insights — no personal identifiers)
• IP addresses and browser user-agent strings (retained in server logs for security purposes, typically 30 days)
• API call counts and timestamps for rate limiting and abuse detection

2.6 OAuth Clients and API Keys

If you register an OAuth application or create API keys, we store:

• OAuth client name, redirect URIs, and scopes
• Hashed versions of OAuth client secrets and API key tokens (we cannot recover the plaintext after creation)
• Last-used timestamps

2.7 MCP Session Data

When AI agents use the MCP server, session state (the current diagram snapshot) is temporarily stored in Vercel KV to allow the agent and browser canvas to stay in sync. Session data is scoped to a unique session ID and expires automatically. It is not associated with your account unless you are authenticated.

2.8 Collaboration Data

Real-time collaboration is powered by PartyKit (CRDT over WebSocket) or our own WebSocket server. Diagram operations broadcast during a collaboration session pass through these servers in transit but are not permanently stored beyond the active session duration.

3. How We Use Your Data

We use the data we collect to:

• Create and manage your account
• Provide, operate, and maintain the Service
• Process payments and manage subscriptions
• Track credit usage and enforce plan limits
• Provide AI-powered features by transmitting prompts to our AI partners
• Enable real-time collaboration
• Send transactional emails (e.g. account notifications, billing receipts) — we do not send marketing emails without your explicit consent
• Detect and prevent fraud, abuse, and security incidents
• Improve the Service through aggregated, anonymised analytics
• Comply with legal obligations

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal bases for processing your personal data are:

5. Data Sharing and Third Parties

We do not sell your personal data. We share your data only in the following circumstances:

5.1 Service Providers (Data Processors)

These processors act on our instructions and are contractually bound to handle your data securely:

5.2 AI Providers

Your prompts and diagram context are transmitted to these providers to fulfil AI requests. They process this data under their own privacy policies:

• Google Gemini (via OpenRouter) — diagram generation
• Anthropic Claude (via OpenRouter) — diagram evaluation, agent chat
• Pollinations — AI image generation

We recommend not including personally identifiable or sensitive information in AI prompts.

5.3 Legal Disclosure

We may disclose your data if required by law, court order, or to protect the rights, safety, or property of Chamuka Labs, our users, or the public.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, your data may be transferred to the acquiring entity. We will notify you via email or a prominent notice on the Service before your data is subject to a materially different privacy policy.

6. Cookies and Local Storage

We use minimal cookies and browser storage:

• Authentication cookies — set by Clerk to maintain your login session. These are strictly necessary and cannot be opted out of while using the Service.
• Theme preference — stored in localStorage (light/dark mode). No personal data.
• Local diagram data — diagrams you create without saving to the cloud are stored in IndexedDB on your device. This data never leaves your browser unless you explicitly save to the cloud.
• Analytics — Vercel Analytics uses a privacy-preserving approach that does not set persistent tracking cookies and does not fingerprint individual users.

We do not use advertising cookies or third-party tracking pixels.

7. Data Retention

When you delete your account, we begin the deletion process within 30 days. Some data (e.g. financial transaction records) may be retained longer to comply with legal obligations.

8. Security

We implement industry-standard security measures to protect your data:

• All data in transit is encrypted using TLS 1.2+
• Data at rest is encrypted by our hosting infrastructure (Vercel / Neon)
• API keys and OAuth secrets are stored as hashed values — we cannot recover plaintext after issuance
• Authentication is delegated to Clerk, which implements MFA, bot protection, and session management
• Credit operations use atomic Redis transactions to prevent race conditions and abuse
• MCP session write access is optionally token-protected

Despite these measures, no system is completely secure. If you discover a security vulnerability, please report it responsibly to dev@chamuka.ai.

9. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

To exercise any of these rights, contact us at dev@chamuka.ai. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are in the EEA or UK and believe we have processed your data unlawfully, you have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK or your national data protection authority in the EU).

10. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at dev@chamuka.ai and we will promptly delete it.

11. International Data Transfers

Chamuka Labs is operated globally. Your data may be processed in countries outside your own, including the United States, where our infrastructure providers (Vercel, Clerk, Stripe, Upstash) are primarily based.

When transferring data from the EEA or UK to third countries, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreements (IDTAs), or we use providers that participate in recognised adequacy frameworks.

12. Desktop App and CLI

The desktop app (Tauri) and CLI operate primarily on your local machine. Diagrams are stored locally unless you explicitly save them to the cloud or use a feature that requires network access (e.g. AI generation or cloud sync).

When you use AI features in the desktop app or CLI, prompts are transmitted to our web API at chamuka.ai/api and forwarded to the relevant AI provider. The same data handling rules apply as described in section 2.3.

Neither the desktop app nor the CLI includes telemetry or crash reporting that transmits data without your knowledge.

13. VS Code Extension

The VS Code extension reads and writes .drawit files on your local filesystem. No data is transmitted to our servers unless you:

• Use the AI generation command (prompts are sent to our API)
• Sync a diagram to the cloud via the web app

The extension does not collect workspace telemetry.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Effective date" at the top of this page and, where appropriate, by email. We encourage you to review this page periodically.

15. Contact and Data Controller

Chamuka Labs is the data controller for personal data processed under this policy. For any privacy-related questions, requests, or concerns, please contact us: