Privacy
Last updated 31 July 2026
Roughline holds your notes, so it is worth being plain about what that means. This page describes what is collected, why it exists, who else sees it, and how to get rid of it.
What is collected
Your account
Signing in with Google gives Roughline your name, email address and profile picture. That is the whole of it — Roughline never receives your Google password and cannot read anything else in your Google account.
What you make
Everything you create is stored so it is there when you come back:
- Notes — the drawings, text and shapes on each canvas
- Images you paste or place on a canvas
- A small preview image of each canvas, used for the thumbnails in your library
- Your conversations with the AI, and which part of the canvas each belongs to
- To-dos, and the day they belong to
- Settings — theme, colour palette, whether you have been through first-run
Technical records
A session record keeps you signed in. A counter records how many AI requests your account has made, so that rate limits can be applied — it stores counts and timestamps, not the content of the requests. The hosting provider keeps standard server logs, including IP addresses.
What is not collected
There is no analytics SDK, no advertising identifier and no third-party tracker in Roughline. Nothing here is sold, and nothing is used to build a profile of you or to train anyone’s models.
When your notes are sent to an AI
Only when you ask. A canvas you never ask a question about is never sent anywhere for processing. It sits in the database and is served back to you.
When you select part of a canvas and ask something, what goes to the AI provider is the text and images from that part of the canvas, an image of the selection, and the earlier messages in that conversation so the reply makes sense in context. The reply comes back and is drawn onto your canvas.
Roughline uses OpenAI for this. Their API terms state that data submitted through the API is not used to train their models. If you would rather a note never reached a third party, do not ask a question about it.
Who else gets your data
Roughline is run by one person, not a company with departments. The services below are the complete list of third parties involved:
| Service | Purpose | What it receives |
|---|---|---|
| OpenAI | AI responses | The text and images from the part of a canvas you ask about, plus that conversation's earlier messages Only when you ask something. A canvas you never ask about is never sent. |
| Vercel | Hosting | Requests to the app, including IP address and standard server logs Serves the site and runs the API. |
| Prisma Postgres | Database | Everything in the account: notes, chats, to-dos, settings Where the data lives at rest. |
| Sign-in | Your name, email address and profile picture, once, when you sign in Roughline never sees your Google password. |
Your data is not sold, rented or shared with anyone else. It would only be disclosed further if the law required it.
Sharing a note yourself
A note is private to you unless you create a share link for it. Anyone holding that link gets the access you chose — view or edit — so treat it as a password. You can see and revoke sharing from the note itself, and revoking takes effect immediately.
How long it is kept
Your notes are kept until you delete them or delete your account. Sign-in sessions expire after 30 days. AI usage counters are kept for the rate-limiting windows they serve. When you delete your account, everything listed above is removed from the database immediately and permanently — see below.
Deleting your account
You can delete your account yourself, at any time, without emailing anyone:
- On iPhone or iPad — Settings tab, then Delete account.
- On the web — click your avatar, then Delete account.
You will be asked to type your email address to confirm. Deletion is immediate and cannot be undone: your notes, images, conversations, to-dos, settings and sign-in records are erased, along with any notes you had shared with other people. Anything someone else owns and shared with you stays theirs.
Backups of the database may hold a copy for a short period before rotating out. Nothing is restored from them except to recover from a failure.
Your rights
You can see everything Roughline holds about you inside the app — there is no hidden profile. You can correct it by editing it, export a note from the canvas menu, and delete everything with account deletion. If you are in a place with a legal right to access, correction, portability or erasure, exercising those rights takes no more than the steps above; write to heojay0309@gmail.com if you need something the app does not give you.
Where data lives
Roughline’s servers and database run in the United States, and OpenAI processes requests there. If you use Roughline from elsewhere, your data is transferred to and stored in the US.
Children
Roughline is not intended for children under 13, and accounts should not be created for them. If you believe a child has created an account, write to heojay0309@gmail.com and it will be deleted.
Security
Traffic is encrypted in transit. Sign-in is handled by Google — Roughline stores no passwords. Access to the database is restricted to the application. No service can promise perfect security, and this one does not.
Changes
If this policy changes in a way that affects what happens to your data, the date at the top of the page changes with it, and material changes will be announced in the app before they take effect.
Contact
Roughline is operated by Jay Heo. For anything on this page, including privacy requests, write to heojay0309@gmail.com. See also the support page and the terms.