What we keep, and what we don't
Draw It is not a chat archive; it is a guess validator. Everything below describes what the app actually does; it is not a generic privacy template.
Last updated: 21 September 2026The short version
While a round is running, messages reach the server, are matched in memory and dropped. Not to the database, not to a log, not to an error report.
A viewer who guesses wrong leaves no trace at all: no row, no counter, no name.
The winning viewer's platform id, the display name they had at that moment and their points, plus the per-channel totals the leaderboard needs.
To limit abuse we keep an irreversible HMAC of the address, keyed with the app's own secret. The address itself is never written.
The form on this page reaches us directly. A human verifies the request, and once it checks out the record is deleted from every channel.
The uncomfortable part, first
Draw It stores the Kick username and numeric id of people who never visited this site and never agreed to anything. That is exactly what a per-channel leaderboard is: the first viewer in a streamer's chat to guess the word gets written into a table.
We are not going to dress that up. What we do instead is keep it to the smallest possible amount of data: one winner row and two counters. The message itself, the losing guesses, the chat history, e-mail, IP: none of it is stored on the viewer side.
It does appear on public pages, but in a measured way: your name appears on the page of the channel you spoke in, in that game's recap and on the cross-channel leaderboard, and the game screen says so on stream. Every page that shows a viewer name is noindex, and share images carry no viewer name at all, because once such an image is cached it can never be un-cached, and that would make our deletion promise false.
A viewer who does not want their name there can have it removed with the form below, or by asking the streamer directly.
Viewer data is processed under the legitimate-interest basis of Turkey's KVKK (art. 5/2-f), since a guessing game's scoreboard cannot work without recording who guessed, and under GDPR art. 6(1)(f) for visitors in the EU. That is why the scope is held down to one name, one id and two counters, and why the deletion route below stays open.
What we store
Three groups of people, three sets of rows. That is all of it; there is no fourth place.
1 · A signed-in user
Created when you sign in with Blamity, or open an e-mail/password account specific to this site.
- Account details
- Name, username, e-mail address, profile picture, country and flag. With a Blamity sign-in these come from the identity service; with an e-mail/password account your password is stored only as a hash.
- Kick link
- If your Blamity account has Kick connected: your Kick username and numeric id. They are used for one thing only: proving that a channel is yours.
- Login session
- Every sign-in writes a session row: the session token, its expiry, the IP address you signed in from and your browser's user-agent. This is the one place a raw address is stored. It is the standard behaviour of the session layer (better-auth) for session security, and the row goes when the session ends.
- Games you played
- Per game: the channel you connected to, the list you chose, the round count, the seconds per round and timestamps; per round, the words offered and the word picked. This is what fills the recap on your account page.
- Words you have seen
- Which words have already come up for you, so they are not offered again. Kept for signed-in players only, and resettable from your account page.
- Lists you created
- The list name, its words, its status, and the version and time of the display licence you accepted when publishing it; plus its review-queue entries.
- Reports you file
- If you report a word list: which list, the reason you picked, any note you added, and your account. The report is tied to your account; otherwise the same list could be reported without limit and bury the queue.
- Moderation actions
- If your account has been given moderator or admin rights, the actions you take with them (approving a list, ruling on a report, erasing a viewer) are written to the audit trail and stay there permanently. An ordinary account never produces such a record.
2 · A viewer in Kick chat
Someone who never opened the site, never signed up and never clicked anything. Two tables, and only this:
- The winner row
- For the viewer who guessed a round first: their platform, numeric id, the display name they had at that moment, the points they scored and the time. At most one row per round.
- Leaderboard counters
- Per channel and viewer: total correct guesses, total points and when they were last seen. Two rows: one all-time, one for the month the win happened in.
- An exclusion row, if there is one
- If a channel's owner has taken you off their leaderboard, what remains for that channel is a row holding your numeric Kick id and nothing else: no name, no reason, no note. Its only job is to stop a new score row being written the next time you guess correctly.
- Two counters per game
- For each game, how many chat messages were written and by how many distinct people, as two numbers on the game's own row. Who wrote what is not kept; the numbers cannot be tied to a person and exist to tell streamers and sponsors how much attention a game drew.
- Nothing else
- No message text, no chat history, no e-mail, no IP, no badge or emote history. A viewer who never guesses a word correctly has no row at all.
3 · A visitor who writes to us
The contact form on the home page, and the deletion form on this one.
- Contact message
- The name, e-mail (optional), topic and message you type. Plus an HMAC of your IP address, keyed with the app's secret, to limit abuse. Not the address itself, an irreversible digest of it.
- Deletion request
- The Kick username you give, the e-mail you leave for a reply, and any note you add. When the request is closed every one of those fields is wiped; what remains is the reference, the dates and how many rows were deleted.
What we never store
These are not "we don't collect that right now". They are things the code has no path to write.
While a round runs, the streamer's browser relays messages to the server; the server compares them with the word in memory and throws them away. Nothing is written to the database, to a log line or to an error report. What is held in memory, for minutes, is which message id got which verdict and a SHA-256 fingerprint of the last guess for comparison, never the text.
A wrong message creates no row of any kind. Only the winner is recorded, and the round ends right there.
The drawing stays in the streamer's own browser (in tab storage, so a refresh does not lose it). There is no endpoint that accepts a drawing.
The "camera area" on the game screen is just an empty box in the layout for your broadcasting software to fill. Draw It never touches a camera or a microphone.
Rate limits count an address in memory only, for the length of the window. The only IP-derived value written to disk is the contact form's HMAC; the login session's IP is described above.
No ad network, no pixel, no fingerprinting, no data sold to anyone.
How long we keep it
These periods are not decoration: a cleanup pass really does remove the expired rows from the database.
- Viewer records: 12 months
- If a viewer has not guessed a word in a channel for 12 months, their winner rows and standings for that channel are deleted. A channel they still play in is untouched. Those old rounds still read as "guessed", but no longer say by whom.
- Contact messages: 24 months
- Messages sent through the form, including the name and e-mail on them, are deleted after 24 months.
- Deletion requests: 6 months
- A closed request has its personal fields wiped the moment it closes; what is left (reference, dates, counts) is removed entirely after 6 months.
- Game session keys: 30 days
- The stored digests of finished or abandoned games' session keys are deleted after 30 days.
- Login sessions: 7 days
- A session row (IP and user-agent included) stops being valid when it expires or when you sign out; the session layer's default lifetime is 7 days.
- Your account and history: until you ask
- Data tied to your account stays until you ask for it to go. You can reset your seen words and your claimed channel's leaderboard yourself, from your account page, at any time.
The cleanup runs at intervals rather than to the hour, so a record can sit for a little longer between the day its period ends and the next pass.
Your rights
Under KVKK art. 11 (and the equivalent GDPR rights) you can ask whether we process your data, ask what it is, have it corrected or deleted, and object to it being processed. In Draw It that comes down to three routes:
- Find out whether your data is processed, and what it is
- Have a wrong or incomplete record corrected
- Have it deleted
- Object to it being processed
The "KVKK · viewer data" section of your account page lists every viewer record stored for the channels you have claimed, row by row, and deletes them one by one. The same page resets your seen words and clears your channel's leaderboard. For the account itself to be deleted, write to us.
Once you have claimed your channel with a Blamity account that has Kick connected, you can delete any viewer from that channel's leaderboard directly. That power is scoped to your own channel; a streamer cannot touch another channel's data.
Fill in the form below. No account, no download, and no convincing the streamer. Your request is recorded with a reference number; once a human has verified it, your record is deleted from every channel.
Deletion request
If your name is sitting on a leaderboard because you guessed a word in Kick chat, and you would rather it wasn't, this is the right place.
Who we share it with
We do not sell data and we do not pass it to anyone for marketing. The parties necessarily involved are:
Chat is read by connecting from the streamer's own browser to Kick's infrastructure; our server additionally asks Kick's public API to resolve a channel name. Those requests go to Kick and are subject to Kick's own privacy policy.
Signing in happens through the Blamity identity service on its own domain. Draw It receives only the profile from it: name, e-mail, username, country and, if connected, your Kick identity.
The app and its database run on a single server we operate. The database is not exposed to the internet, and its backups are part of the same operational responsibility.
We use Google Tag Manager to see how many people visit the site. That can mean Google's own cookies are set. There is no other measurement code on the page.
When the server hits an error, we forward the record to an error-reporting service. What is sent never includes the request body, so a chat line cannot end up in an error report either.
Cookies
Signing in sets a Draw It session cookie in your browser. It is strictly necessary: without it a sign-in does not persist. It is removed when you sign out.
Your preferences (last list, round count, seconds, volume) and the id of a game in progress live in your browser's own storage. They are not sent to us; clearing your browser data clears them.
Google's own cookies may be used through the Google Tag Manager described above. There are no other third-party cookies.
How we protect it
An IP address is stored as an HMAC keyed with the app's own secret. Not a plain hash, because the whole IPv4 space can be precomputed. Game session keys are stored as digests too, so a database leak does not hand over live sessions.
Erasing a viewer removes the rows from the database: nothing is hidden, flagged or replaced with a "[deleted]" placeholder. Even the audit record of the erasure holds a keyed digest of the person's id, never the id itself.
A streamer's "ignore this viewer" row survives an erasure: that row is what keeps you off the leaderboard, and deleting it would put your name back the next time you guessed correctly. It holds your numeric id and no name, and if you want it gone too, the channel's owner can remove it.
Word lists stay on the server; a browser is sent two candidates per round and nothing more. That is as much about protecting the game as about privacy.
Contact
Write to us with any privacy question, objection or deletion request. Draw It is operated by Blamity, which is the data controller for the processing described here.
If this text changes
This page ships with the app: when what we store changes, this text changes in the same release. The "last updated" date at the top tells you which version you are reading.