Privacy

Who we are

drawee is operated by an individual, not a company. We hold AI provider credentials on behalf of the people who own them, and pass requests to the provider so that the app asking never takes custody of the credential. Write to support@drawee.dev with anything on this page.

Two kinds of people use drawee

End-users connect a credential of their own — an API key, or a ChatGPT subscription — through someone else's app, on connect.drawee.dev. Tenants are the companies that integrate drawee, and the staff who use the console on drawee.dev. The two are held separately and this policy describes each in turn.

What we hold when you connect a credential

• The credential itself, encrypted. One AES-256-GCM data key per connection, wrapped by a key that belongs to you, wrapped in turn by a single master key held in AWS KMS. The ciphertext is bound to its own row, so a copy moved elsewhere stops decrypting rather than being misread as someone else's. It is decrypted for one purpose: to make a request you authorised an app to make.
• A fingerprint of that credential — a one-way HMAC under a secret held on the server. It is what lets us recognise the same key connected a second time instead of storing a duplicate, and what lets you prove a key is yours on /recover without us keeping the key in any form we could search.
• An email address, only if you chose to add one after your credential worked. It is never asked for first and always skippable. If you skip it, your account carries a generated address at guest.invalid and no address of yours.
• A passkey, if you saved one: its public key, its credential id, and the facts your browser reports about it — device type, whether it is backed up, which transports it supports. The private half never leaves your device and we never see it.
• For a ChatGPT subscription, the OpenAI access and refresh tokens, sealed in the same envelope as a key, plus the ChatGPT account id and three non-secret facts read from the id token: your plan type, your ChatGPT user id, and whether the workspace is a FedRAMP one.
• One record per request made with your credential: the model, the provider, whether it was a key or a subscription, which credential was tried first if another one served, input, output, cached and reasoning token counts, a cost, the latency in milliseconds, the time, and which app, project, organization and environment it belonged to.
• A record of each decryption of a credential, written to an append-only audit trail: what happened, which app caused it, which connection, whether it succeeded, the provider, and the credential type.
• A session, while you are signed in on connect.drawee.dev: the session token, its expiry, and the IP address and browser user agent the request arrived with.

What we never hold

Prompts and responses are not stored. The gateway forwards your request body to the provider unchanged and streams the answer back. A copy of that stream is read once, in passing, to pull out the model name and the token counts in the record above; nothing from it is written down. Error bodies from providers are never logged either, because providers put fragments of API keys in them.

We never learn what an app calls you. There is no table mapping a tenant's own user id to a drawee user, no header that would carry one, and no way for a tenant to name a user who did not authorise it. The OAuth token a tenant holds is the only answer to “which user”, and it exists only because you approved that app.

What we hold for a tenant

• The organization — its name and slug, the email address and role of each member, and any pending invitations. Console sign-in is by emailed link or passkey; there are no passwords.
• Projects and their clients — OAuth client ids and secrets, redirect URIs, the scopes a client may ask for, and the app name shown to end-users on the consent screen.
• Management API keys, an organization property used from CI. They act as the tenant and can never be used for inference.
• Billing, through Autumn and Stripe behind it: the organization as a customer, its projects, and counts of connected active users per project per month. Card details are handled by Stripe and we do not hold them.

Who else processes this

• AWS KMS — holds the master key that wraps every credential key.
• Vercel — hosts drawee.dev and connect.drawee.dev.
• Cloudflare Workers — runs the gateway that proxies inference requests.
• Neon — hosts the database everything above is stored in.
• Resend — sends sign-in links and organization invitations.
• Audkit — keeps the credential decryption trail.
• Autumn and Stripe — tenant billing and payment.
• The AI provider you chose — OpenAI, Anthropic or Google. Your request reaches them under your own credential, and what they do with it is covered by your agreement with them.

Keeping and deleting

• Cutting off one app ends that app's reach: the grant is marked revoked, its access and refresh tokens are deleted, and the gateway checks again on every request. Nothing about the credential changes — it still works for every other app you allowed.
• Removing a credential deletes its ciphertext outright and revokes every grant that named it, in one transaction.
• Deleting your key rows makes every credential you ever connected unreadable at once, and atomically. There is no second copy anywhere for the ciphertext to be decrypted from.
• Usage records and the monthly counts built from them outlive the project they describe, because a tenant's past invoices depend on them. They hold identifiers and numbers, never content.

Your side of it

• Your account page on connect.drawee.dev lists every credential you connected and every app that can currently reach it, with an off switch beside each one. It does not go through the app that asked you, which is the point of it.
• /recover takes the credential itself as proof, if you saved nothing at all, and shows the same off switches for that one credential. It cannot sign you in, attach an email, show anything else on the account, or read a credential back out.
• Or write to us at support@drawee.dev.

Cookies

A session cookie on the origin you signed in to. Each origin keeps its own cookie — a console session on drawee.dev is not a session on connect.drawee.dev, and neither cookie is readable by the other. The console sets one more, drawee_env, remembering whether its Sandbox / Production switch is set; it authorises nothing. There is no analytics, advertising or tracking script on any page of either origin.

Changes

If this policy changes, the date at the top changes with it. The version at this address is always the current one.