Privacy Policy

At WhoDrew.io, we respect and value your privacy. This Privacy Policy outlines what information is collected, how it is handled, and how we safeguard your data while you enjoy our online drawing and deception game.

1. Information We Collect

WhoDrew.io is architected with privacy by design. We do not require accounts, logins, email verification, or financial information to play:

• Display Names: The nickname you choose upon entering a lobby is stored temporarily in server memory for the duration of the match and discarded when the room closes. The exception is a public game picked as the Drawing of the Day (see below), whose players' nicknames are kept and shown with it.
• Session Storage (Session Reconnection): We save a temporary anonymous session token and your nickname in your browser tab's sessionStorage (expires after a few minutes). This allows you to automatically rejoin your game if your connection drops.
• Theme Preference: Your chosen UI theme (dark or light mode) and a random anonymous device ID (used only to enforce lobby kicks) are saved locally in your browser.
• Contact Form: If you send us a message, we keep your name, email address, message and IP address so we can reply and prevent spam.
• Discord Activity: When playing inside Discord, we read only your Discord display name (the identify scope) to prefill your nickname.

2. Real-Time Gameplay Data

Drawing strokes, chat messages, and votes are transmitted in real time through encrypted WebSockets (WSS) to players in your specific game room. We do not sell user drawings or chat logs, and chat logs are never stored. The one exception is public matchmaking games: after a round ends, the finished drawing (as an image with the secret word and round outcome) and the nicknames and colours of the players in that round may be saved. Drawings that are not picked are deleted after 14 days. The best drawing of each day is shared in WhoDrew.io posts on social media such as Discord, Telegram and Instagram without any player names, and is kept in our Drawing Gallery and shown on the whodrew.io home page together with the players' nicknames as a shout-out. Private rooms are never featured. Contact us if you would like a featured drawing or your nickname removed.

Voice chat: Voice chat is optional and off until you choose to join it. Audio travels directly between the browsers of players in voice (peer-to-peer, encrypted by WebRTC) and is never recorded or stored; our server only helps the browsers find each other. If a direct connection isn't possible, audio may pass, still encrypted, through a relay server. Because the connection is direct, players you are in voice with can see your IP address. Voice is open in the lobby, during the interrogation and on the results, pauses while a round is being drawn, and you can mute yourself or anyone else at any time.

3. Analytics, Advertising & Cookies

We use Google Analytics (gtag.js) to monitor overall website performance, visitor volume, browser compatibility, and bounce rates. Google Analytics collects anonymized usage metrics using standard cookies. You can manage or block cookies through your browser settings without impacting your ability to play the game.

We also use DataFast to understand where visitors come from and how the website is used, such as pages viewed, referring sites, country and device type.

We also set one small first-party cookie, whodrew_cc, holding only your two-letter country code for 24 hours. It decides which festival theme you see and isn't used for advertising or tracking. Your daily play streak is kept only in your own browser's storage on the website; clearing your site data resets it.

Advertising: WhoDrew.io is free to play and is supported by ads served by Google AdSense on the home page, the lobby and the round results (never while a round is being played, and never inside the Discord Activity). Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. You can opt out of personalized advertising in Google Ads Settings, or opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info. Learn more about how Google uses information from sites that use its services. Visitors in the European Economic Area, the UK and Switzerland are asked for consent before personalized ads are shown.

Android and iOS apps: The WhoDrew apps run the same game as this website, so everything on this page applies to them too, with these additions:

• Push notifications (optional): The app only asks for permission after you finish a round, and you can turn notifications off at any time in the app's sound settings or in your phone's settings. If you allow them, we store your device's push token, the app's random anonymous device ID, your time zone, your daily play streak and your notification choices. We use these only to send WhoDrew notifications (for example "It's your turn to draw" or "Players are waiting for a game") and to avoid sending them at night. The token is delivered through Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS). This data is deleted after 60 days without opening the app, or when your phone tells us the token is no longer valid.
• Microphone: Used only for voice chat, and only after you turn it on. Audio is never recorded or stored.
• Ads in the apps: Instead of AdSense, the apps show a Google AdMob banner at the bottom of the home screen, the lobby and the round results, never while a round is being played. To serve and measure these ads, Google receives your device's advertising ID, IP address and basic device information, and may show personalized ads based on them. You can reset or delete your advertising ID, or opt out of personalized ads, in your phone's settings. Players in the European Economic Area, the UK and Switzerland are asked for consent first and can change their choice anytime under Ad privacy choices in the app's 🔊 settings. Learn more about how Google uses information from apps that use its services.

4. Data Retention & Security

All in-memory room information, player tokens, and stroke queues are purged immediately when a room is completed or abandoned. We utilize standard SSL/TLS encryption for all HTTP and WebSocket communications.

5. Children's Online Privacy Protection

WhoDrew.io does not knowingly collect personally identifiable information from children under the age of 13. Because our platform requires no registration or personal data submission, child safety and anonymity are respected by default.

6. Updates to This Policy

We may update this Privacy Policy from time to time. Changes will be posted to this page with an updated date.

7. Contact Us

If you have questions regarding this Privacy Policy or your data, please reach out via our Contact Us page or email us directly at [email protected].