Privacy

Who is responsible for it

Ronkatil B.V., Plataanstraat 7, 6573 XP Beek, Gelderland, the Netherlands. KvK 96968176 · BTW NL867854571B01. The company has no parent company and no investors. There is no data protection officer. A one-person company is under no obligation to appoint one, and appointing myself would be theatre. Questions go to achilleas@kromdraw.com.

If your organisation put personal data into Kromdraw, you are the controller of it and Kromdraw is a processor. The data processing agreement page covers that relationship.

What is stored

Your account

Your email address, the name you chose, and a bcrypt hash of your password. The password itself is never stored and can't be read back out.

Your sessions

Each time you sign in, a row records the IP address and browser string of that session and when it was last used. It is what makes signing out of your other devices possible, and it is what the sign-in rate limit counts against.

Which pages you open

Opening a page writes a row naming it: your IP address, the browser and operating system it reported, where you arrived from, and the page you landed on. Background requests the page makes for itself are not counted. It is Kromdraw's own, stored in Kromdraw's own database, and no other company receives it. It is what tells me which parts of the app are used and which pages people leave from.

Changes to your account

When your name, email address or password changes, a row records what changed and who changed it. The same happens when an account or an organisation is disabled. It is what makes "your password was changed" answerable rather than a guess.

What you draw

The contents of your boards, the images you upload into them, comment text with the name shown against it, and sticky notes with the name of whoever wrote them. What ends up in there is up to you. I don't read your boards, index them for anything but your own search, or use them to train anything.

Guests on a live link

A guest types a display name and gets a token stored in their own browser. Only a hash of that token is kept here, and it is what lets that person edit their own comment and nothing else. No account, no email address.

Cookies

Two, both set by Kromdraw itself and both needed for the site to work. One carries the token that stops another site submitting a form as you; it is set on every page and ends when you close the browser. The other is set when you sign in and holds a signed reference to your session: it is marked HttpOnly, so no script can read it, and SameSite=Lax, so another site can't make your browser use it, and it expires 30 days after you last used Kromdraw. The page records described above set no cookie: a visit is recognised for four hours by a hash of your masked IP address and browser string, which is computed on the server and never stored in your browser.

No cookie here belongs to anybody else. There is no tracking pixel, no advertising network, no third-party script, and no font loaded from somebody else's CDN since 25 August 2026.

How long it is kept

• Sessions. A session expires 30 days after it was last used, and expired sessions are removed automatically.
• Import files. The archive you uploaded is deleted from storage 30 days after the import finished. The record that it happened stays, since it is small and it is the history of what came in.
• Export files. The ZIP an export builds is deleted seven days after it finishes. It is the most concentrated file in the system, being every board in an account with every comment in it, so it doesn't sit around.
• Boards and folders you delete. Moved to a trash you can restore from. Nothing empties that trash automatically yet. Automatic deletion after 30 days is planned.
• Page records. After 90 days a record keeps only the first part of the IP address (129.1.3.2 becomes 129.0.0.0), the browser name and major version instead of the full browser string, and loses the visit hash. What stays is enough to count pages and browsers over time, and no longer enough to pick out a device.
• Everything else. For as long as your account exists.

Who else can see it

Five companies, named with what each one can see, on the subprocessor list. All five are European.

Your data isn't sold and isn't shared with anybody else. If a legal order ever arrives, I will tell you unless I'm forbidden from telling you.

Where it is

In the EU, on machines named individually on where your data lives. Nothing is transferred outside it.

What you can ask for

Under the GDPR you can ask for a copy of your data, ask for it to be corrected, ask for it to be deleted, object to processing, and complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens.

Portability is the one you don't have to ask for. There is an export button, it produces a file another tool opens, and this page describes what comes out of it.

To delete an account, or an organisation you own, email achilleas@kromdraw.com from the email address registered to that account. I use that address to verify the request and complete deletion from the live service within 30 days. That includes archived boards, imports and completed exports. Encrypted backups age out within a further 90 days and are not used for anything except disaster recovery while they remain.

The legal basis

Performance of the contract for everything needed to run the account. Legitimate interest for the security records, meaning the session log and the rate limits, which exist to keep other people out of your account [to confirm: this framing needs a lawyer's eye]. Nothing here relies on consent, since nothing here is an optional extra.

Changes to this page

The date at the top is the last time it changed. A change to what is collected or who sees it gets published on this website and emailed to every account holder at least 30 days before it takes effect, unless a legal or urgent security reason requires a change sooner.