Privacy

Who is responsible

The data controller is Adam Krobot, who runs Draw me a star. Contact for anything privacy-related: stars@drawmeastar.com.

What data and why

• Waiting list: your e-mail, the page language, where you came from (e.g. Instagram) and when you confirmed in the e-mail (double opt-in — without that click you won’t hear from me again) — to let you know when you can start a galaxy and to send occasional news. Legal basis: your consent, which you can withdraw at any time via the link in any e-mail or by writing to stars@drawmeastar.com.
• Account (sign-in with an e-mail link or with Google): your e-mail and name — so you can manage your galaxy, invitations and surprises. Legal basis: providing the service you sign up for.
• Galaxies and drawings: the galaxy name, photos of drawings, the author’s name and message, upload date — so the drawings appear in the galaxy they were made for. Legal basis: providing the service; drawings are uploaded voluntarily by their authors.
• Service e-mails: sign-in links, links to your galaxy, notices about new drawings and reveal reminders. Legal basis: providing the service.
• Technical data: IP address and browser details in server logs, for security and abuse prevention. Legal basis: legitimate interest.

Who can see it

• A galaxy can only be seen by people who have its link — unless its owner chooses to make it public in the universe. A sealed surprise can only be seen by its organiser until the reveal.
• The galaxy owner can hide any drawing; the author of a drawing can ask for it to be deleted.
• I never sell your data or share it for advertising.

Who helps me (processors)

Some processors are based or have servers outside the EU (USA). Transfers are covered by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

• Cloudflare, Inc. — website hosting, database, storage of drawings and e-mail forwarding.
• Brevo (Sendinblue SAS, France) — sending e-mails.
• Google — only if you choose to sign in with Google (see below).
• Donations to the Malý Noe Foundation are made on Darujme.cz (Via Foundation). You enter payment details directly there — I never see them; at most I see the total raised and the number of donors for a fundraiser.

Signing in with Google

If you sign in with Google, I receive only your e-mail address, name and, if available, profile picture. I use them solely to sign you in and to show your name in your account. I do not share them, use them for advertising, or use them to train AI models. Draw me a star’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies and browser storage

• A sign-in cookie — necessary so you don’t have to sign in on every page.
• Your browser remembers small things for you, like whether you want music on or a draft message. None of it is sent anywhere.
• No advertising or tracking cookies. If I turn on visitor statistics, they will be cookie-free (Cloudflare Web Analytics).

How long

• Waiting list: until you unsubscribe, at most 2 years after the last e-mail.
• Account and galaxies: until you delete them or ask me to.
• Drawings: until the galaxy owner or the author deletes them; deleting a galaxy deletes its drawings.
• Technical logs: only briefly, as set by Cloudflare.

Children

Children are welcome to draw — that’s part of the magic. If a child is under 16, please upload the drawing together with a parent, and don’t put more personal details in the name or message than needed.

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability. You can withdraw consent at any time. Just write to stars@drawmeastar.com — I’ll reply within 30 days. If you think your data isn’t being handled properly, you can complain to your data protection authority (in the Czech Republic: uoou.gov.cz).

Changes

If this policy changes, I’ll update this page and let you know by e-mail about significant changes. Effective from 27 October 2026.