Privacy Policy

Effective October 31, 2026

uCAD (ucad.app) is a drawing tool that runs in your browser. It is run by Mikhail Ivashchenko, an individual entrepreneur registered in the Republic of Armenia (“we”). This page says what we keep, what goes where, and what you can ask us to do. Questions: master@ucad.app.

Drawing without an account

You don't need an account to draw. Your drawings stay in your browser: uCAD saves your work there (in the browser's local storage) so it is still there when you come back, and files you save go to your own computer. We don't receive your drawings.

The browser also keeps your settings there (units, grid, the tools' options) and, if you add one, your own API key for an AI provider (see below).

Usage counters and server logs

• Usage counters. On ucad.app the app sends small anonymous notes to our own server: which features are used, how long a visit lasts, errors that happened, and the site you came from. They carry a random visitor ID kept in your browser, never anything from your drawing. We use them to see what works and what breaks. No third-party analytics, no advertising.
• Server logs. Like any web server, ours logs each request: the IP address, the browser's user agent, the page asked for and the time. The logs are kept for a limited time (they roll over as they grow) and are used to keep the site running and safe.
• Feedback. If you send feedback from the app, we receive your message, the email you leave (if any) and a little context (how many objects the drawing has, the tool in use, the window size and language).

Your account

An account is needed for the AI assistant and for keeping your drawings online. With one we keep:

• your email address, and whether you've confirmed it (when you sign up with an email, we send a link to it once, to check it's yours; our emails go out through Resend, the service that delivers them);
• your password as a one-way hash (scrypt) — we can't read it; or, if you sign in with Google, your Google account ID and the email Google confirms (nothing else from your Google account);
• your plan and, if you subscribe, the subscription's status, renewal date and the link to manage it, as our payment provider reports them;
• how much of the assistant's monthly allowance you've used, and a record of its requests (when, which model, how many tokens, what it cost) — not what was in them;
• your drawings. Once you're signed in, the drawing you work on is saved in your account by itself, so you can open it on any computer: the drawing, a small picture of it, and its history — what you asked the assistant, its answers, and earlier versions of the drawing's script. You can delete a drawing in Open.

When you're signed in, your browser keeps one cookie, ucad_s: the session that keeps you signed in. It is needed for the account to work and isn't used for anything else.

The AI assistant

When you ask the assistant something, the request goes with what it needs to do the job: your words, a description of the drawing (its objects, their names and sizes) and the script that built it, plus the results of its own steps. This goes to the AI provider that runs the model — through our server when you use uCAD's models (at the moment DeepSeek's model, reached through OpenRouter, which passes each request on to a company that hosts that model; the model list in the app says which model), or straight from your browser to the provider you chose when you use your own API key. For uCAD's models we ask OpenRouter to use only hosts that neither keep the requests nor train their models on them. Your requests and the assistant's answers are kept with the drawing in your account (its history, see above); the steps in between aren't kept. The providers handle the data under their own terms and privacy policies.

With your own API key, the key stays in your browser and is sent only to that provider; we never see it.

Payments

Subscriptions are sold by Lemon Squeezy, which acts as the merchant of record: it takes the payment and handles your card details, invoices and taxes. We never see your card. Lemon Squeezy tells us your email, the subscription's status and the link to manage it. See its privacy policy.

Who else gets data

Nobody else, apart from the services above that do part of the work: OpenRouter and the AI provider behind it (your assistant requests), Resend (the emails we send you), Lemon Squeezy (payments), Google (only if you choose to sign in with it) and the company we rent our server from (it stores what's on the server). We don't sell data and don't share it for advertising.

How long we keep it

Account data and your drawings are kept while you have an account. A drawing you delete is gone from your account at once and from our server within 30 days. Usage counts are kept by month. When you ask us to delete your account, we delete its data within 30 days, except what we must keep by law (payment records stay with Lemon Squeezy).

Your rights

You can ask us what we keep about you, to correct it, to delete your account and its data, or to stop using it. Write from your account's email to master@ucad.app and we'll answer within 30 days. If you're in the EU or the UK you can also complain to your data protection authority.

Children

uCAD's accounts aren't meant for children under 16. If you think a child has made one, tell us and we'll delete it.

Security

The site only works over HTTPS, passwords are hashed, the session cookie can't be read by scripts, and the server keeps account data out of the public website. No system is perfectly safe, though: if something goes wrong that affects your data, we'll tell you.

Changes

If this policy changes, the new version will be here with a new date. If the change is significant and you have an account, we'll let you know by email.