Privacy Policy

This policy explains what data PatentStroke ("we", "us") collects when you use patentstroke.com and the PatentStroke app, why we collect it, who processes it for us, and how you can see or delete it. The short version: we do not use your content to train AI models, your drawings are stored privately, and you can delete them, or your whole account, at any time.

Questions or requests: support@patentstroke.com.

What we collect

Account data. Your name, email address and a hashed password when you sign up with email, or your name, email address and profile picture from Google when you use Google sign-in. We record when you verified your email address.

Sign-in data. For each signed-in session we keep the IP address and browser user agent that started it, so you and we can spot sign-ins that are not yours. Sessions end when you sign out or when they expire.

Your content.

• Photos and sketches you upload are sent to the AI model to make your drawing and are then discarded. We do not store them, and we do not write uploads or prompts to our logs.
• Text you paste (method steps, claims, system descriptions) is sent to the AI model in the same way. The diagram that comes back contains your wording, so it is stored in private file storage like a drawing, never in our database.
• Generated drawings and diagrams are stored in a private storage bucket that has no public address.
• Sheet sets you build, and the figures in them, are stored privately until you delete them.

Before you sign up, a photo or text you pick on our pages stays in your own browser (local storage) for up to 24 hours so it is still there after sign-up. It is not sent to us until you press Generate.

Usage and billing records. For each generation we record its type, status, the model used, its cost and the credits charged or refunded, but not your input. We keep your credit balance and history, orders and subscriptions, support tickets you send, and product events such as choosing a plan. When you sign up we record where you came from (referrer, UTM campaign tags and country), once, to understand which channels bring users.

Payment data. When checkout is open, payments are handled by our payment processor. We receive the order status, amount and the last details the processor shares with us; we never receive or store full card numbers.

Technical data. Our hosting provider processes IP addresses to deliver the site and protect it from abuse, and we use IP addresses briefly to rate-limit requests.

How we use it

• To run the service: sign you in, generate and store your drawings, keep your credit balance, and send account emails such as email verification and password resets.
• To keep it safe: rate limits, blocking throwaway email addresses, and detecting abuse of the free credits.
• To support you when you write to us.
• To improve the product using aggregate numbers (for example, how many generations succeed). We do not look at your drawings unless you ask us to in a support request.

We do not sell your personal data, we do not share it for cross-site advertising, and we do not use your uploads, prompts or drawings to train or fine-tune any AI model.

Legal bases, where they apply: performing our contract with you (running the service), our legitimate interests (security, abuse prevention, product improvement), consent (optional cookies, where we ask), and legal obligations (tax and accounting records).

AI models used

Your photos, sketches and text are processed by these models, all reached through OpenRouter with its "deny data collection" setting turned on, so each request only goes to model providers that OpenRouter lists as not collecting prompt data for their own purposes, such as training:

• Line art from photos: Google Gemini 3.1 Flash Lite Image.
• Line art from hand sketches: Google Gemini 3.1 Flash Image (Nano Banana 2).
• Drawing check (looks for stray text or leader lines in line art): Google Gemini 3.1 Flash Lite.
• Flowcharts and block diagrams: Google Gemini 2.5 Flash Lite, with Google Gemini 3.1 Flash Lite as a fallback.

If we change a model, we update this list and the one in our Terms of Service.

Who processes data for us

• Cloudflare — hosting, database, file storage and email forwarding.
• OpenRouter — routes AI requests to the model provider.
• Google — the Gemini models above, and Google sign-in if you use it.
• Resend — sends account emails.
• Waffo — payments, once checkout opens.
• Umami — cookieless page-view and button-click counts, on an instance we run ourselves. It never receives your uploads, prompts or drawings.

We update this list, and the one on our Trust page, before we add a new subprocessor. These providers may process data in the United States and other countries; we rely on their contractual safeguards for transfers.

Cookies and local storage

We use a session cookie to keep you signed in and a few cookies or local-storage entries for preferences such as theme and, if shown, your cookie choice. We do not use advertising cookies. For page analytics we use Umami, which counts page views and button clicks without cookies and without storing your IP address.

How long we keep data

• Uploads: not stored; discarded once the model has answered.
• Generated results that you did not add to a sheet set: deleted automatically 30 days after they are generated.
• Sheet sets, figures and share links: until you delete them or your account.
• Your account and its records: until you delete your account.
• Backups: our database can be restored to an earlier point for up to 30 days. After that, deleted data is gone from backups too. Stored drawing files have no separate backup copies.
• Payment records: our payment processor keeps transaction records for as long as tax and accounting law requires.

Your choices and rights

• Delete figures and sheet sets at any time from the sheet set page. Their files are deleted at the same moment.
• Turn off a share link at any time; the link then shows that it has expired.
• Delete your account at any time from Settings → Profile. Your account, drawings, sheet sets and share links are deleted right away, not just hidden.
• Access, correct or get a copy of your personal data, or object to how we use it, by writing to support@patentstroke.com. We answer within 30 days. Depending on where you live (for example in the EU, UK or California) you may also have the right to complain to your data protection authority.

Security

Traffic is encrypted with HTTPS. Our database and file storage are encrypted at rest by Cloudflare. Drawings are only reachable through links that expire after 10 minutes or through pages that check you are the owner. Admin access is limited by role, and staff accounts use multi-factor authentication. If we confirm a security incident that affects your data, we will email affected users within 72 hours of confirming it. See our Trust page for details.

Children

PatentStroke is not directed to children under 16, and we do not knowingly collect their data.

Changes to this policy

When we change this policy we update the date at the top. If a change affects how we use your content, we will tell signed-up users by email before it takes effect.

Contact

support@patentstroke.com