Privacy Policy
Last updated: September 3, 2026
Data we process
Draw My Loop may process account information, saved routes, public route pages, private GPX export history, Auto-Fit credit purchases, contact form messages, and technical security data.
Custom route orders
A custom route may be ordered without an account. We then process the email address, brief, area, distance and date preferences, optional reference image, Stripe payment status, and delivered files. Order links are signed, and images and GPX files remain in private storage. Working and delivery files are deleted no later than 90 days after closure or refund; information required for accounting obligations and transaction evidence may be retained for the applicable statutory period.
Routes and GPX exports
You can use the Studio without an account to draw, snap to roads, and download an image. A free account is required to export GPX, save, or publish a route. For signed-in accounts, export history is enabled by default: it privately stores the exact exported trace, its creation origin, a simplified vector target when one exists, and any completion feedback you add voluntarily (a Strava link or actual GPX). It never stores the uploaded source image or the raw text you entered.
Purpose, control, and retention of export history
This history lets you retrieve a GPX, helps improve route quality, and measures how the product fits real use. You may delete one export from My Collection or disable the history in Privacy. Disabling it deletes precise traces and their associated outcomes after confirmation. The data is also deleted with the account; only effectively anonymized aggregates may then be retained.
Algorithm quality measurement
A separate preference, enabled by default and available in Privacy settings, measures projections that were actually displayed. Only centered, normalized previews without location are transmitted: no GPS coordinate, IP address, identity, position, entered text, or image name is retained. Details expire after 90 days; daily aggregates without geometry may be kept longer. For signed-in accounts, the preference is synchronized in the profile. For visitors, it remains only on the device.
Auto-Fit trial security
To limit duplicate accounts, the site uses a strictly necessary HttpOnly cookie containing a random identifier, retained for 60 days, and may request a Cloudflare Turnstile challenge before the first free web trial. The system retains pseudonymized HMACs of the device, account, and IP address for no more than 60 days; these anti-abuse tables store no browser fingerprint, raw device identifier, or raw IP address.
Analytics and cookies
The site may use Vercel Analytics, PostHog, and Microsoft Clarity to understand product usage. Analytics cookies are controlled by the cookie consent banner where required. Coordinates, polylines, Strava links, and private artifact identifiers from export history are not sent to PostHog. The functional Auto-Fit security cookie is separate from analytics cookies.
Processors
The service uses Vercel for hosting, Supabase for authentication and database services, Stripe for payments, Cloudflare for bot verification, and OpenStreetMap/OSRM/Overpass for map and routing data.
Your rights
You can request access, correction, or deletion of your data by contacting the team. Signed-in users also have account deletion options in settings.
Contact
For privacy questions, contact durbaog02@gmail.com.