Privacy Policy
Effective: July 26, 2026
DraftView ("we", "us", "our") takes privacy seriously. This policy explains what we collect, why we collect it, how long we keep it, and what you can ask us to do with it.
1. What We Collect
Account data. Your email address, and the basic profile details your Git host shares with us when you sign in (username, avatar, account ID). If you sign in with an email link instead, we only hold your email address.
Organization data. Team name, member roles, and invitations, so we know who is allowed to see which reviews.
Repository content. To show you a pull request, we read the documentation files it touches and keep a copy for the life of that review. This is what lets reviewers reopen a review, see what changed since they last looked, and work without a Git account of their own. We read only the files a review needs. We do not clone repositories.
Review data. Comments, suggested edits, sign-offs, and the timestamps around them. Sign-off records are kept as an append-only history, because their whole purpose is to be a reliable record of who reviewed what and when.
Billing data. Handled by our payment processor. We keep the identifiers needed to match a subscription to your organization. We never see or store card numbers.
Usage data. Product analytics such as page views and feature usage, plus ordinary server logs. We use a third-party analytics provider for this. We do not run advertising trackers and we do not follow you around other websites.
2. Why We Use It
- To run the Service and show you your reviews
- To send transactional email: sign-in links, invitations, and review notifications
- To bill your organization and support your account
- To fix problems and decide what to build next
We do not sell your data, we do not share it with advertisers, and we do not use your repository content or review activity to train machine learning models.
3. How Long We Keep It
Review content stays until the review is deleted or your organization removes it. Delete your account and we remove your personal data and the reviews you own, other than records we are required to keep for tax and accounting purposes. Backups roll off on their own schedule, so deleted data can persist in backups for a short window after removal.
4. Where It Lives
DraftView runs on established cloud infrastructure in the United States. Data is encrypted in transit and at rest, and access tokens get an extra layer of encryption on top of that. If you are in the EEA or the UK, transfers rely on standard contractual clauses. Our Security page covers our practices in more detail.
5. Service Providers
We rely on a small set of vendors to operate DraftView. They are bound by contract to process data only on our instructions.
If your organization needs the named list of subprocessors for a vendor review, email us and we will send the current one.
6. Your Choices
You can:
- Export a copy of your data from your account settings
- Delete your account, and with it your personal data, from your account settings
- Correct your email address or ask us to correct anything else
- Unsubscribe from anything that is not required to operate your account
Depending on where you live you may also have the right to object to processing or to lodge a complaint with your local data protection authority. To use any of these rights, or if you would rather we handled it for you, email help@draftview.app.
7. Cookies
We set a session cookie to keep you signed in and a small number of cookies for analytics. No advertising cookies.
8. Children
DraftView is a tool for workplaces. It is not intended for anyone under 16, and we do not knowingly collect their data.
9. Changes
We may update this policy. If a change matters to you, we will say so by email or in the app before it takes effect. The date at the top of this page shows the latest revision.