Trust & Security

Unfiled inventions are confidential. This page lists what we do with your uploads, prompts and drawings, and how each commitment is carried out. If something here is unclear, or you need more detail for a security review, write to support@patentstroke.com.

Your content is not used for training

• We do not train or fine-tune any model on your uploads, prompts or drawings.
• Every AI request goes through OpenRouter with its "deny data collection" setting turned on, so it is only sent to model providers that OpenRouter lists as not collecting prompt data for their own use, such as training. A request that no such provider can serve fails instead of going elsewhere.
• The models we use today are Google Gemini models on Google's paid API. Google's terms for the paid Gemini API say it does not use prompts or responses to improve its products.

Encryption

• All traffic to PatentStroke uses HTTPS (TLS).
• Your account data and drawings are stored on Cloudflare, which encrypts its D1 databases and R2 object storage at rest (R2 uses AES-256).
• The keys we use to reach our providers are stored encrypted (AES-256-GCM) with a key that is kept outside the database.

Private by default

• Uploaded photos and sketches are sent to the model and then discarded. We do not store them, and uploads and prompts are not written to our logs.
• Generated drawings live in a private storage bucket with no public address. You see them only through links that expire after 10 minutes, or through pages that check you are the owner.
• We do not sell your content, publish it, or let search engines index it.
• A drawing is only visible to someone else if you create a share link for a sheet set. Each link has a random 128-bit ID, its page tells search engines not to index it, it never shows your original photos, and you can turn it off at any time. Once it is off, the link shows that it has expired.

Deleting your data

• Figures and sheet sets: delete them at any time from the sheet set page. Their stored files are deleted at the same moment.
• Generated results that you did not add to a sheet set are deleted automatically 30 days after they are generated.
• Your account: delete it at any time from Settings → Profile. Your account, drawings, sheet sets and share links are deleted right away, not just hidden.
• Backups: our database can be restored to an earlier point for up to 30 days (Cloudflare D1 Time Travel). After that, deleted data is gone from backups too, so everything is removed within 30 days of deleting your account. Stored drawing files have no separate backup copies.
• When payments are enabled, our payment processor keeps its own transaction records as tax and accounting law requires.

Who can access your data

• Only named staff accounts can open our admin tools, and each account has only the permissions its role needs. Actions that move money or change permissions need their own dedicated permission.
• Staff accounts for our admin tools and our infrastructure providers use multi-factor authentication.
• We do not open your drawings unless you ask us to in a support request.

If something goes wrong

If we confirm a security incident that affects your data, we will email the affected users within 72 hours of confirming it, with what happened, what data was involved and what we are doing about it.

Subprocessors

These are the companies that process data for PatentStroke today:

• Cloudflare — hosting, database, file storage and email forwarding.
• OpenRouter — routes AI requests to the model provider (with data collection denied, as above).
• Google — Gemini models (through OpenRouter) and, if you choose it, Google sign-in.
• Resend — account emails such as address verification and password reset.
• Waffo — payments, once checkout opens.

We update this list before we add a new subprocessor.

Security questionnaires

We are happy to answer your firm's or company's security questionnaire. Send it to support@patentstroke.com.

See also our Privacy Policy and Terms of Service.