Privacy
Sketch It is a drawing game operated by Airship Labs LLC. This page explains what happens to information when you play the web game at sketchit.game or the iOS and Android apps. The game has no accounts or passwords. The only email address it asks for is through the optional app waitlist on the website. The entry screen links to Google Play and the App Store and no longer takes new sign-ups.
Players aged 13 to 17 need a parent or guardian's permission to play Sketch It. A parent or guardian can ask us to delete their child's data by emailing [email protected].
Privacy questions and requests: [email protected]. For gameplay help, see Support. For legal notices, use [email protected].
Last updated: November 2, 2026.
The short version
Rooms and scores are temporary. The game server keeps them only for the life of a room, two hours at most. Our own services run no player database and keep no drawing gallery, room history, or score history. The information below still leaves your device for a short time, so this page describes every party that receives it.
If you joined the app waitlist, our email provider keeps your email address and phone choice until you unsubscribe or ask us to remove them, as the App waitlist section explains.
Who receives what
- The room server (operated by Airship Labs LLC on Cloudflare) receives your server-assigned display name, your score, your private reconnect credential, the room code, and each drawing you submit. It saves your server-assigned display name, score, the room code and a one-way hash of your credential in its storage so a room survives a server restart, and deletes them when the room ends, two hours at most. Cloudflare’s backups of that storage may keep a copy for up to 30 days before it is deleted. It uses each drawing only to get a guess and never saves it.
- Other players in your room receive your server-assigned display name, score, and connection status. They never receive your reconnect credential, and they never receive your drawing.
- A third-party AI recognition provider receives a drawing image and generic picture-guessing instructions when the game asks for a guess. It never receives your name, score, credential, or the target word. The current provider is named below.
- Cloudflare, which hosts the room server, records connection metadata such as the request URL (including the room code) and request timing in Worker logs.
- Sentry (error monitoring) receives scrubbed error reports from the room server so we can fix problems. These reports contain no names, IP addresses, drawings, or other personal data.
- Vercel, which hosts the web page, and Cloudflare, which proxies it, process standard request data such as IP address and browser details to deliver the site.
- Loops, our email provider, receives the email address and phone choice you gave when you joined the app waitlist, through the room server. It never receives your drawings, name, score, credential, or room code.
Names, scores, and credentials
The server assigns a display name when you join; you do not type one. It adds a private credential that lets you reconnect to the same seat after a dropped connection. The server shares the server-assigned name and your score with the other players and keeps them only while the room exists. The credential stays between your device and the server.
Rooms, expiration, and deletion
A room ends after two hours, or when its last member has been gone for the 60-second reconnect window. Disconnected players are removed after 60 seconds. Ending a room deletes its display names, scores, credential hashes and prompts from the server’s storage. Cloudflare, which hosts the room server, may keep backup copies of that storage for up to 30 days for disaster recovery. We don’t access them, and they are then deleted. Drawings are never saved.
Drawings and AI recognition
When you change your drawing, the app sends that image through the room server to a third-party AI recognition provider, and the returned guess is turned into points. The request contains the drawing image, generic instructions for a picture-guessing game, and the model name. It does not contain your name, your score, your room code, your credential, or the target word. Other players never receive the image.
We send the image to obtain a guess. The provider also applies its abuse-monitoring and safety policies. How it uses and retains the image is governed by its API data policy and privacy policy. These requests do not rely on a zero-data-retention setting. If the provider changes, we update the line below; the rest of this page describes the data flow, not a particular vendor.
Current AI provider: OpenAI — privacy policy and API data controls.
OpenAI’s published API policy says inputs and outputs are not used for model training by default. Abuse-monitoring logs may contain them and are normally retained for up to 30 days; legal and safety exceptions can require longer retention. Image inputs flagged for possible child sexual abuse material may be retained for manual review, including when special retention controls apply. See the API data controls above for those exceptions.
Your agreement to AI recognition
Before you create or join a room, the app asks you to accept the Terms of Use and this policy, including sending your drawings to a third-party AI recognition provider. The checkbox starts unchecked, and nothing is sent until you accept it. If you leave it unchecked, drawings stay on your device and you cannot start a round, because a round depends on recognition.
In a browser, your acceptance is stored on this device until you withdraw it or clear the site’s data. In the mobile app, it is stored on the device until you withdraw it or clear the app’s data. You can withdraw at any time from the app: no further drawings are sent, queued guesses are discarded, and any room you are in is left. Images already sent to the provider cannot be recalled.
This browser
The web game keeps your player ID and room credential in this tab’s session storage so that a reload can reconnect you. It does not keep a name, drawings, or scores there. Leaving the room or the server ending the room clears those values, and closing the tab session clears them too. If your browser blocks storage, the current connection still works, but a reload cannot recover the room.
The native apps
The iOS and Android apps keep the same information — player ID, room credential, room state (including the assigned names), and the current drawing — only in the app process’s memory. They write none of it to disk. Backgrounding the app closes the connection; returning within 60 seconds reconnects. Force-quitting, an operating-system termination, or a JavaScript reload ends local recovery, and the app returns to the entry screen.
The apps include no advertising, analytics, or crash-reporting SDK. Drawing is rendered locally with Skia. Update delivery through expo-updates is disabled until an Expo project is linked; if it is enabled, the app would contact Expo’s update service to fetch new JavaScript.
App waitlist
The iOS and Android apps are in the app stores, and the website’s entry screen links to both listings. The page takes no new sign-ups. This section covers the addresses already on the list. You do not need to have joined it to play, and joining it did not need the play agreement. The apps themselves never ask for an email address.
When you joined, the page sent the email address you typed to the room server. Sign-ups recorded a phone choice (iOS, Android, or both). The room server checked the sign-up, recorded the time of your latest one, and added you to the Sketch It waitlist at our email provider.
We use your address to tell you when the app is out and share Sketch It news.
The waitlist is for ages 13 and up.
We keep your address until you unsubscribe or ask us to remove it. Removal takes your address off the waitlist and clears your phone choice and sign-up time. We delete your whole contact from the provider only when nothing else there uses it: no other Airship Labs LLC mailing list or product holds it or added details to it, and you have not unsubscribed from all Airship Labs LLC email, because deleting the contact would erase that choice. Otherwise only the waitlist entry and those Sketch It details are removed. Each email has an unsubscribe link. To be removed, email [email protected] from that address; we act on requests within 30 days.
Current email provider: Loops — privacy policy.
Server logs and retention
The room server runs on Cloudflare with Workers Logs and tracing enabled. For each request, Cloudflare records metadata — the method and URL, which includes the room code, request timing, and the status of the outbound request to OpenAI. The game’s own code does not write names, credentials, drawings, or provider responses to those logs. For each waitlist sign-up it writes one line with the outcome, the chosen phones, and the timing, never your email address or IP address. Cloudflare retains this observability data for 3 days on its Free plan and 7 days on its Paid plan, then deletes it. See Cloudflare’s privacy policy.
Measurement (web only)
The website uses Vercel Web Analytics and Vercel Speed Insights to count visits and measure page speed. Neither sets cookies, and neither builds a profile of you across sites; visitor sessions are discarded after 24 hours, and reports are aggregate traffic and performance.
Web Analytics also counts actions on the website once our servers confirm them: joining the app waitlist, with only the phone choice on that sign-up (new sign-ups are iOS; earlier ones may be iOS, Android, or both); creating a room; finishing a round; opening the pricing page; starting checkout; opening the iPhone page; and following that page’s links to the App Store, Google Play, the web game, and pricing. These counts never include your email address, name, room code, drawings, or anything you type. A host who buys a pass gives an email address so the pass can be found again. Stripe processes the payment. We store that email, the pass expiry, the consent text and time, and the email code used to sign in. The code is kept only until it is used or it expires.
Neither product ever receives a room invite code. A page whose address carries one is left out of the Web Analytics visit counts entirely, and its Speed Insights measurements are labeled only /join/[code]. The native apps have no measurement SDK.
Questions and deletion
We do not run a player database, so there is usually nothing to delete once a room has ended. If you have a privacy question, or believe a room is still holding your data, email [email protected] with the room code and approximate time. We will look into what can be removed. Data that a room or provider has already discarded cannot be recovered or deleted again. To remove your email address from the app waitlist, email us from that address.
Changes
We may update this page as the game changes. A material update changes the date shown at the top.