School Draw Privacy and Data Handling Statement

1. Data Controller Information

Application Name: School Draw

Purpose: A web-based SVG drawing tool designed for simple, accessible drawing and illustration

Data Controller: Shuistyle

Contact: hello@schooldraw.net

Last Updated: 10 March 2026

2. What Data We Collect and Process

2.1 Data You Create

2.2 Authentication Data (Required to Access Auth-Gated Tools)

Signing in with Google or Microsoft is required to access the full drawing toolset. Authentication also enables cloud storage saving. When you sign in, we process:

3. How We Use Your Data

3.1 Client-Side Drawing; Server-Side Access Verification

School Draw separates two distinct concerns:

• Drawing operations happen entirely in your web browser — your artwork is never sent to our servers
• Access control uses Firebase Cloud Functions (hosted in Europe — eu-west1) to verify that your email address is on the authorised access list before you can use the application. This involves transmitting your email address to our Cloud Function for comparison against the registered list
• Your drawings and personal artwork remain under your direct control at all times and are never sent to our servers
• We do not collect analytics, track usage behaviour, or profile users

3.2 Specific Uses

• Creating and Editing Drawings: Processing your drawing commands to render SVG graphics (client-side only)
• Saving Your Work: Storing drawings in your chosen location (browser storage, device download, Google Drive, or OneDrive)
• Auto-Save Functionality: Automatically saving your work to prevent data loss (only when enabled and you're signed in to cloud storage)
• Version History: Maintaining undo/redo history in your browser's memory during your session
• Authentication: Using OAuth tokens to securely access your Google Drive or OneDrive (only with your explicit consent)
• Access Verification: Sending your email address to our Firebase Cloud Function to verify you are on the authorised access list. Your email is checked against a registered list stored in Firebase Realtime Database. It is not stored a second time solely as a result of this check — only pre-registered email addresses (managed by an administrator) are held in the database

4. Where Your Data Is Stored

4.1 Browser Local Storage

When you save drawings to "Browser Storage," your data is stored in your web browser's local storage using the localStorage API. This data:

• Remains on your device only
• Is not transmitted over the internet
• Can be cleared at any time through your browser settings
• Is subject to browser storage limits (typically 5-10 MB)

4.2 Device Downloads

When you save drawings to your device, files are downloaded directly to your chosen location on your computer, tablet, or phone. We have no access to or record of these files.

4.3 Cloud Storage (Google Drive / OneDrive)

When you choose to sign in and save to cloud storage:

• Google Drive: Files are saved to a folder called "MyDrawings" in your Google Drive
• OneDrive: Files are saved to a folder called "SVGEditor" or "MyDrawings" in your OneDrive
• Your drawings are subject to Google's or Microsoft's privacy policies and terms of service
• We do not have access to your cloud storage or your files
• You control who can access your cloud-stored files through Google or Microsoft's sharing settings

5. Data Retention

6. Data Sharing and Third Parties

6.1 No Server-Side Data Sharing

Because School Draw operates entirely in your browser, we do not share your data with any third parties through our servers.

6.2 Third-Party Services (When You Choose to Use Them)

If you choose to sign in and use cloud storage integration:

6.3 No Analytics or Tracking

School Draw does not use:

• Google Analytics or similar analytics services
• Tracking cookies or advertising cookies
• Social media tracking pixels
• Any other tracking or profiling technologies

7. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

8. Data Security Measures

We implement robust security measures to protect your data:

8.1 Technical Security

• XSS (Cross-Site Scripting) Prevention: All user input is sanitised to prevent malicious code injection
• SVG Content Validation: All SVG content is validated and sanitised before processing to remove potentially dangerous elements
• Input Sanitisation: Filenames and user-provided text are sanitised to prevent path traversal and injection attacks
• Content Security: Dangerous SVG elements (script, object, embed, iframe, foreignObject) are automatically removed
• Event Handler Removal: All inline event handlers (onclick, onload, etc.) are stripped from uploaded or pasted content
• URL Validation: Dangerous URI schemes (javascript:, data:text/html, vbscript:) are blocked
• Secure Authentication: OAuth 2.0 protocols with industry-standard security practices
• Token Management: Access tokens are stored securely and automatically expire
• HTTPS Encryption: All communication with cloud services uses HTTPS encryption

8.2 Data Minimisation

• We only process the minimum data necessary for the application to function
• Authentication with Google or Microsoft is required to access auth-gated drawing tools; basic navigation of the landing page does not require sign-in
• We don't collect any data we don't need
• No tracking or analytics data is collected

8.3 Storage Limitations

• Browser storage is limited to 50 saved drawings to prevent excessive data accumulation
• SVG files are limited to 50 MB maximum size
• Browser storage content is limited to 2 MB per file

9. Cookies and Similar Technologies

9.1 Strictly Necessary Storage

School Draw uses browser local storage (not cookies) for essential functionality:

• Saving your drawings when you choose browser storage
• Storing authentication tokens when you sign in (temporary, session-based)
• Remembering your auto-save preferences
• Storing your last save location for convenience

9.2 Third-Party Cookies

Google and Microsoft may set their own cookies when you use their authentication services. These are governed by their respective privacy policies.

9.3 No Tracking Cookies

We do not use any advertising, analytics, or tracking cookies.

10. Children's Privacy

School Draw is designed to be accessible to users of all ages, including children. We take children's privacy seriously:

10.1 Protection for Young Users

• Accessing the full drawing toolset requires signing in with a Google or Microsoft account; parental or guardian consent should be obtained before children sign in
• We do not knowingly collect personal information from children under 13 without parental consent — schools and parents should ensure appropriate accounts and permissions are in place before students use the application
• Once authenticated, drawings can be saved to the device without using cloud storage
• We do not use children's data for any purpose other than verifying access and enabling cloud save if chosen

10.2 Parental Guidance

We recommend that:

• Parents or guardians supervise children's use of cloud storage features
• Parents control whether children sign in with Google or Microsoft accounts
• Parents review and manage cloud storage permissions for children's accounts
• Children under 13 should not sign in with their own accounts without parental consent

11. International Data Transfers

11.1 Client-Side Processing

Because School Draw operates entirely in your browser, your data is not transferred internationally by our application.

11.2 Cloud Storage Transfers

If you choose to use Google Drive or OneDrive:

• Your data may be transferred to and stored in Google's or Microsoft's data centres, which may be located outside the UK or EEA
• Both Google and Microsoft have implemented appropriate safeguards including:
  • Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
  • Compliance with UK GDPR requirements
  • Additional security measures for international transfers
• You consent to these transfers when you choose to sign in and use cloud storage

12. Data Breach Notification

12.1 Our Responsibilities

In the unlikely event of a data breach affecting our application:

• We will notify the ICO within 72 hours if required by UK GDPR
• We will notify affected users without undue delay if there is a high risk to your rights and freedoms
• We will take immediate steps to contain and remedy the breach

12.2 Limited Risk

Because School Draw does not collect or store your data on our servers, the risk of a data breach affecting your information through our systems is minimal. Your primary data security depends on:

• Your device's security (for browser-stored drawings)
• Your Google or Microsoft account security (for cloud-stored drawings)
• Your browser's security settings and updates

13. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect:

• Changes in UK GDPR requirements or guidance from the ICO
• Changes to our application features or functionality
• Changes to third-party services we integrate with
• User feedback and best practice improvements

13.1 Notification of Changes

When we make significant changes:

• We will update the "Last Updated" date at the top of this document
• We will display a prominent notice in the application
• For material changes affecting your rights, we will seek your consent where required

13.2 Reviewing Changes

We encourage you to review this Privacy Statement periodically to stay informed about how we protect your data.

14. Your Consent

14.1 Accessing School Draw

To use School Draw's drawing tools, you must sign in with Google or Microsoft. By doing so, you consent to:

• Verification of your email address against the authorised access list via our Firebase Cloud Function
• Processing of your drawing data locally in your browser
• Storage of your drawings in browser local storage (if you choose this option)
• Storage of application preferences in browser local storage

14.2 Using Cloud Storage Features

When you sign in with Google or Microsoft, you explicitly consent to:

• Authentication through Google OAuth or Microsoft MSAL
• Storage of authentication tokens in your browser's local storage
• Access to your Google Drive or OneDrive for saving and loading drawings
• Creation of folders in your cloud storage for School Draw files
• Processing of your drawings and account information as described in this statement
• International data transfers to Google or Microsoft's data centres

14.3 Withdrawing Consent

You can withdraw your consent at any time by:

• Signing out of the application
• Revoking School Draw's access in your Google or Microsoft account settings
• Clearing your browser's local storage
• Deleting your drawings from cloud storage
• Stopping use of the application

15. Complaints and Supervisory Authority

15.1 Contact Us First

If you have concerns about how we handle your data, please contact us first using the details at the top of this document. We will do our best to resolve any issues promptly.

15.2 Right to Complain

You have the right to lodge a complaint with the UK's supervisory authority:

16. Legal Basis for Processing

Under UK GDPR Article 6, we process your data based on:

17. Accessibility of This Statement

We are committed to making this privacy statement accessible to all users:

• This statement is written in clear, plain language
• We avoid unnecessary legal jargon where possible
• Tables and formatting make information easy to scan
• This statement is available as an HTML document that works with screen readers
• If you need this information in a different format, please contact us

18. Additional Information for Specific Users

18.1 Educational Institutions

If School Draw is used in schools or educational settings:

• Sign-in with Google or Microsoft is required to access the drawing tools; schools should ensure students have appropriate institutional accounts before using the application
• Teachers should review this privacy statement before recommending School Draw to students
• Schools must ensure they have appropriate consent from parents/guardians before students sign in, as authentication involves processing the student's email address for access verification
• Use institutional Google Workspace for Education or Microsoft 365 Education accounts, which provide additional safeguards for young users
• Schools are responsible for ensuring their use of School Draw complies with their own data protection policies and any relevant safeguarding obligations

18.2 Business/Professional Users

If you use School Draw for business purposes:

• Ensure your use complies with your organisation's data protection policies
• Be aware that drawings saved to cloud storage are subject to your organisation's Google Workspace or Microsoft 365 policies
• Consider using browser storage or device downloads for sensitive business information