Privacy Policy
Effective date: 2026-11-09
This policy explains what Drudgle collects when you use drudgle.com and the Drudgle app at drudgle.com/app, why, who else sees it, how long it is kept, and what you can do about it. It is written to meet the California Online Privacy Protection Act (CalOPPA) and Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). Where this policy says we, it means the controller named below.
1. Who we are
The controller of your personal data is Abel Mohler, trading as Drudgle, a sole operator based in North Carolina, United States.
Contact for anything in this policy, including requests about your data: privacy@drudgle.com. A postal address is available on request to the same mailbox.
Drudgle has no EU establishment. Our processing of data about people in the EU is occasional, carries low risk, and involves no special categories of data, so we rely on the exemption in GDPR Article 27(2) and have not designated an EU representative.
2. What we collect
Account data. When you sign in with Google, Google sends us your email address, your Google account identifier, and confirmation that the email is verified. We store the email, the identifier and the time of sign-in. We do not store your name, profile picture or Google password. If you create an API key in the app, we store its name, a hash and the first characters of the key, and when it was last used.
Content you submit. The business vision you describe, the testbeds and projects generated from it, the files those projects contain, your messages in the evolve and planning flows, and any feedback you send through the app, together with the page you sent it from and whether you agreed to be contacted about it. Content may contain personal data if you put it there; please do not include other people's personal data, credentials or secrets.
Payment data. When you buy credits, Stripe runs the checkout. We send Stripe your email address and your Drudgle account id, and Stripe sends us back the checkout session id and whether it was paid. We never see or store your card number, billing address or tax identifiers; Stripe holds those under its own policy.
Connected accounts. If you connect a Vercel account to deploy a project, we store the token you paste, encrypted at rest, together with the Vercel account and team names it belongs to. You can disconnect it at any time from the Account page, which deletes the token.
Technical data. Our servers and our hosting providers keep request logs that may include your IP address, browser type, the pages or API routes you requested and the time. Application logs record which account ran which task, for support and abuse prevention. We also keep aggregate metrics about the service that are not tied to you.
Analytics (only with your consent). If you accept analytics in the cookie banner, Google Analytics 4 records the pages you visit on drudgle.com and in the app, your approximate region, device and browser, and a random client id stored in the _ga cookies. Page addresses are sent as route templates, so project and testbed identifiers and query strings are never sent. Google signals and advertising features are switched off. Nothing is sent to Google Analytics before you accept, and nothing is sent if your browser announces a Global Privacy Control preference.
We do not knowingly collect data from children under 16, and the service is not directed at them.
3. Why we use it, and the legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Providing the service: your account, generating and storing projects, running evolve tasks, showing your dashboard | account data, content you submit | Performance of a contract (Art. 6(1)(b)) |
| Selling credits and keeping the ledger of grants and charges | account data, payment data | Performance of a contract; legal obligations in tax and accounting law (Art. 6(1)(c)) |
| Deploying a project to a provider you connected | connected accounts, project files | Performance of a contract, at your request |
| Security, abuse prevention, debugging and support | technical data, application logs | Legitimate interests (Art. 6(1)(f)): keeping the service working and fair |
| Answering your feedback | feedback, email if you opted in | Legitimate interests; your request |
| Understanding how the site is used | analytics | Consent (Art. 6(1)(a)), withdrawable at any time |
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for automated decisions with legal or similar effects on you.
4. Who receives it
Every recipient below is a processor acting on our instructions, except where the table says otherwise. The list was checked against the running configuration on the effective date.
| Recipient | What they do for us | What they receive | Where |
|---|---|---|---|
| Google (Google LLC) | Sign in with Google; Google Analytics 4 after you consent | sign-in: the fact you signed in to Drudgle; analytics: pages viewed, device and region, client id | United States |
| Stripe (Stripe, Inc.) | Payments and sales-tax calculation for credit purchases. Stripe is an independent controller of the card and billing data it collects on its checkout page. | your email and account id; card and billing details you enter on Stripe's page | United States |
| Cloudflare (Cloudflare, Inc.) | Hosts drudgle.com, serves the app, provides DNS and routes mail to our contact address | web requests to drudgle.com, including your IP address; email you send us | United States and Cloudflare's global network |
| Oracle Cloud (Oracle America, Inc.) | Runs our API, database, task workers and project storage | all account data, content and technical data | United States (Ashburn, Virginia) |
| OpenAI (OpenAI, L.L.C.) | Language models that plan and generate projects, and the embeddings used to search them | your business vision and project content, with your account id removed | United States |
| MiniMax (MiniMax, through its international API) | Language models that implement and evolve project code | your business vision, project content and the instructions you give the evolve flow, with your account id removed | MiniMax's international API; outside the United States and the EU |
| Vercel (Vercel Inc.) | Hosts a project you choose to deploy. Only used when you connect your own Vercel account. Vercel is an independent controller of your Vercel account. | the project files you deploy, under your own token | United States |
The language-model providers receive the text of your business vision and your project's files because that is what the service does with them. We pass through only the content, never your email or identifiers. Their retention of API inputs is governed by their API terms; we do not opt in to any training use of your content.
5. International transfers
Drudgle is operated from the United States and its providers process data there. If you use the service from the EU, the UK or Switzerland, your data is transferred to the United States and, for the MiniMax model service, to the region where its international API is operated. For these transfers we rely on the providers' standard contractual clauses and, where a provider is certified, on the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask us for details of the safeguards for any provider at the contact address above.
6. How long we keep it
| Data | Kept |
|---|---|
| Account data | Until you delete your account. |
| Content you submit (visions, projects, files, feedback) | Until you delete the project or your account. Feedback is kept until it has been triaged and for up to 24 months afterwards. |
| Credit ledger (grants, purchases, charges) | 7 years from the transaction, for tax and accounting records. The Stripe session id is kept with the purchase record. |
| Connected-account tokens | Until you disconnect the account or delete your account. |
| Request logs | 14 days. |
| Service metrics (not tied to you) | 30 days. |
| Analytics (Google Analytics) | The _ga cookies last 13 months. Event data retention in our Google Analytics property is set to the shortest period Google offers. |
| Your cookie choice | 13 months in your browser, or until the policy version changes and we ask again. |
Deleted data may persist in backups for a short time before those are overwritten.
7. Your rights and choices
You can at any time:
- Access the data we hold about you and receive a copy in a portable format.
- Correct it where it is wrong.
- Delete your account and its content. Email us from the address on your account and we will delete it within 30 days. If you use the API,
DELETE /api/v1/auth/mewith your token deletes the account immediately. - Delete a project from the dashboard, which removes its files and generated content.
- Withdraw consent for analytics with the Cookie settings link in the footer of every page, or with the analytics switch on your Account page. Withdrawal takes effect immediately and deletes the
_gacookies; it does not affect what was collected before. - Object to processing based on our legitimate interests, and ask us to restrict processing while we check a request.
- Complain to a supervisory authority. In the EU that is the data protection authority of the country where you live or work; in the UK it is the Information Commissioner's Office.
To exercise any of these, email privacy@drudgle.com from the address on your account, or tell us how else we can verify it is you. We answer within 30 days and never charge for a first request.
8. California residents
CalOPPA requires us to tell you the following.
- Categories of personal information we collect: identifiers (email, account id, IP address), commercial information (credit purchases and usage), internet activity (pages and routes requested; analytics only after you accept), and the content you choose to submit.
- Categories of third parties we share it with: the service providers in section 4. We do not sell or share personal information as those terms are defined in California law.
- How to review or change your information: section 7, or email the address above.
- How we tell you about changes to this policy: section 10.
- Do Not Track and Global Privacy Control. Our site honours the Global Privacy Control (GPC) signal: when your browser sends it, we treat it as a refusal of analytics, load no Google Analytics, and show no banner. We do not respond to the older Do Not Track header, because it carries no agreed meaning; use GPC or the cookie banner instead.
- Third parties collecting information over time and across sites: none, unless you accept analytics, in which case Google Analytics collects your activity on drudgle.com as described in section 2. Google does not use that data for advertising on our behalf.
Drudgle is below every threshold of the California Consumer Privacy Act, so that Act does not currently apply to us; we give you the rights in section 7 regardless of where you live.
9. Cookies and browser storage
This section lists everything drudgle.com stores in your browser, and the rules we follow.
Strictly necessary storage is needed for the service you asked for and is used without asking. Analytics storage is set only after you accept it in the cookie banner, and never when your browser sends a Global Privacy Control signal. You can change your choice at any time with Cookie settings in the page footer, or on the Account page when signed in. We ask once per browser; your choice is remembered for 13 months, and we ask again if what we ask for changes.
| Name | Purpose | Lifetime | Legal basis |
|---|---|---|---|
drudgle_access_tokenlocalStorage · strictly necessary | The signed-in session's API token. Lets the app call the Drudgle API as you and lets the site header show your dashboard link. | Until sign-out. The token itself expires 30 minutes after issue and is renewed silently. | Needed to provide the service you signed in for (ePrivacy Art. 5(3) exemption) |
drudgle_refresh_tokenlocalStorage · strictly necessary; keeps you signed in | Renews the access token so you are not asked to sign in again. Valid for 7 days after your last visit, as the sign-in screen states. | Until sign-out, or 7 days after your last visit. | Needed to provide the persistent sign-in you chose |
drudgle_consentlocalStorage · strictly necessary | Records your cookie choice: the policy version, whether you allowed analytics, and when. | 13 months, or until the policy version changes. Not written when your browser sends GPC unless you make a choice on the Account page. | Needed to remember your choice (ePrivacy Art. 5(3) exemption) |
_gacookie, first-party · analytics | Google Analytics client id, a random number that tells page views from the same browser apart. | 13 months after it was set or last renewed. Deleted when you withdraw consent. | Your consent |
_ga_ZZN8RYRC9Dcookie, first-party · analytics | Google Analytics session state for our property. | Same as _ga. | Your consent |
We use no sessionStorage, IndexedDB, service workers or server-set cookies. Fonts are served from our own domain. The "Sign in with Google" button on the sign-in screens is loaded from Google only on those screens; the cookies Google sets inside its own button belong to Google and its domain, not ours. Stripe runs its checkout on its own domain, with its own cookies, only after you click "Buy credits".
10. Changes to this policy
When we change this policy we update the effective date at the top. For changes that affect what we collect or who receives it, we also show a notice on drudgle.com and in the app for at least 14 days before the change takes effect, and we ask for your cookie choice again where consent is involved. Earlier versions are available on request.
11. Contact
privacy@drudgle.com — Abel Mohler, trading as Drudgle, North Carolina, United States.