Privacy Policy

Last updated: 2 July 2026.

Local-first by default

CompareMyDrafts compares your drafts entirely on your device by default. Unless you create an account and turn on cloud sync, your draft text is never uploaded, never sent to a server, and never stored by us — snapshots and settings are saved only in your browser's local storage on your machine.

If you turn on cloud sync, an end-to-end encrypted copy of your documents is stored on our servers so you can access them from another device. See "Cloud sync (optional, encrypted)" below for exactly what that means, what we can and cannot see, and its limitations.

Cloud sync (optional, encrypted)

If you create an account, CompareMyDrafts offers optional cloud sync so your drafts follow you across devices. Cloud sync uses zero-knowledge, end-to-end encryption: your passphrase and your encryption key are generated and used only on your device. We never receive your passphrase or your unencrypted documents.

• Processor: Supabase is our cloud sync infrastructure processor. It stores your encrypted data and account records and enforces access control on our behalf; it does not hold the keys needed to decrypt your documents.
• Data categories: account data (your email address and authentication metadata, such as sign-in timestamps); your documents, stored only as encrypted blobs we cannot read; and sync metadata (timing and size information, such as when a document changed and its encrypted size) needed to synchronize devices, which does not reveal document content.
• Purpose & legal basis: to let you access and edit the same drafts from more than one device. Legal basis: your explicit consent, given when you create an account and turn on cloud sync.
• Retention: your encrypted documents and account data are retained for as long as your account remains active.
• Deletion & account deletion: deleting an individual document removes its encrypted content from our servers; a small encrypted deletion marker (containing no document text) remains so your other devices learn the document was deleted, and it is erased when you delete your account. You can erase this browser's local data at any time from the account panel ("Erase this browser & switch account"). To delete your account entirely, email privacy@comparemydrafts.com; this permanently erases your account data, your encrypted documents, and your key material from our servers. Account deletion cannot be undone.
• Transfers: Supabase hosts our infrastructure and may process data in the region configured for our project, in accordance with Supabase's data-processing agreement and standard contractual safeguards for any international transfer.
• Sign-in email delivery: sign-in code emails are sent through a transactional email-delivery provider connected to our Supabase project.
• Breach notification: if we become aware of a security breach affecting your account data, we will notify affected users at the email address on file and describe the breach and any steps you should take, without undue delay and in line with applicable law.

Zero-knowledge limitations. Because your key material never leaves your device, we cannot read your documents — and if you lose both your passphrase and your recovery key, we cannot recover your data for you either. Two limits are worth knowing. First, if you choose "Keep me unlocked on this browser," we store a device-specific key that can decrypt your entire vault on that browser; treat that browser profile with the same care as a saved password. Second, "non-extractable" describes a protection local to that browser profile — the key cannot be exported from it by JavaScript — it is not a hardware security guarantee, and it does not protect your vault from someone who already has direct access to your operating-system user account.

Analytics

We use Umami, a privacy-preserving analytics tool, to count page views and anonymous interaction events (for example, which buttons are clicked). We do not use advertising cookies, we honour Global Privacy Control, and we never send your draft text or the full URL of the site that referred you — only a coarse category (such as "search" or "social"). You can disable analytics in the app's settings.

Waitlist email (EmailOctopus)

If you join the waitlist, your email address is processed by our email provider, EmailOctopus (Three Hearts Digital Ltd, 86–90 Paul Street, London EC2A 4NE, United Kingdom), to send you a double opt-in confirmation and, once you confirm, launch announcements for upcoming features. We send no general newsletter. You can unsubscribe from any email, which deletes your address from the list.

• Purpose & legal basis: your explicit consent, given when you confirm the double opt-in.
• Data stored: your email address and signup/engagement metadata (such as opens, clicks, and your IP address / inferred location).
• Storage region & hosting: within the European Economic Area, on Amazon Web Services servers in Ireland.
• International transfer: your data is stored within the EEA; transfers between the UK and the EEA rely on the UK adequacy decision, and EmailOctopus's data-processing agreement incorporates the relevant safeguards (Standard Contractual Clauses / UK IDTA) for any onward transfers.
• Processing agreement: EmailOctopus provides a GDPR-compliant data-processing agreement governing its processing of your data on our behalf.
• Retention: your address is kept until you unsubscribe or request deletion.

Your rights

You can request access to, correction of, or deletion of any personal data we hold (your waitlist email, and if you have an account, your account email and encrypted document data), and you can object to or withdraw consent at any time. Email privacy@comparemydrafts.comfor any data-rights request.

Contact

General questions: hello@comparemydrafts.com. Privacy and data requests: privacy@comparemydrafts.com.