Who operates this service
Super Excalidraw is operated by LIN SI. This policy covers the hosted website and its remote MCP connection. For privacy questions and requests, contact silinwork@gmail.com.
If you run an independent local copy, its local board files are separate from this hosted service. There is no automatic synchronization between local and hosted boards.
Information we process
Account information: Google sign-in supplies a verified account identifier and email address, and may supply a display name. We use the identifier to create or find your private workspace. We request only the openid and email permissions; this does not grant access to Gmail, Google Drive, or your Google password. We do not store Google's access or refresh tokens.
Board content: we store the boards you save, including text, shapes, embedded image files, board titles, summaries, tags, folders, and save timestamps. Content you put in a board may include personal information, so choose what you share with care.
Connection information: we process website sessions, temporary sign-in and authorization requests, and MCP client registrations and grants to authenticate requests and enforce workspace access. Dedicated review and internal test accounts also have stored password hashes and login-attempt limits.
Operational information: hosting infrastructure processes request and security information such as IP addresses, request paths, timestamps, and errors. Application diagnostics redact query strings. Do not put credentials or unnecessary personal information in board titles or URLs.
Why we use this information
We use this information to sign you in, keep workspaces separate, save and retrieve boards, carry out the edits you request, connect authorized MCP clients, prevent abuse, diagnose failures, and respond to support and deletion requests.
Super Excalidraw does not run its own conversational AI or use your boards to train a model. It does not add advertising or analytics cookies to these pages.
Service providers and connected AI tools
Cloudflare hosts the service and processes account and board data using its database, object storage, and authorization storage services. Google processes the Google sign-in flow. Sending email to our support address also uses the email provider's infrastructure. These providers may process data in different countries under their own service terms and privacy practices.
The canvas loads Excalidraw fonts from esm.sh. That font service receives the network information needed to deliver font files, such as your browser's IP address and request headers; our service does not send board content to it.
When you connect ChatGPT or another MCP host, that host can use the access you authorize to work with your workspace. Model-facing tools return board metadata and relevant element context; the embedded canvas can read and save complete board documents. A connected host also processes your conversation and tool interactions under its own policies. Super Excalidraw does not maintain a separate conversation history.
Only connect hosts you trust. Disconnecting a host stops future access when its authorization is revoked, but does not remove information already included in that host's conversations, exports, or records. Contact that host for deletion of its copies.
How long data is kept
We retain account information and saved boards while your account remains in use, until you delete a board or request account deletion. A board deletion removes it from the active catalog immediately and queues its stored files for cleanup. Board deletion has no trash or user-facing restore feature.
After verifying an account-deletion request, we complete deletion from active systems within 30 days. This covers the account, workspace catalog, stored board files, website sessions, and MCP authorizations. You will lose access to those boards; export anything you want to keep first.
Deletion from active systems is separate from the expiry of infrastructure records. Cloudflare runtime logs may remain for up to seven days. Database recovery history may remain for up to 30 days after active data is deleted and expires under Cloudflare's recovery settings. These recovery copies are not available as a board-history feature. We do not promise immediate erasure of every provider-held copy.
Messages you send to support are handled separately from board storage. We keep them while resolving your request; you may also ask us to delete that correspondence. We will explain any information that must be retained to meet a legal obligation or resolve a dispute.
Your choices and requests
You can edit, export, and delete your boards, remove browser cookies, and disconnect an MCP host. To request access to, correction of, or deletion of account information, email silinwork@gmail.com. We verify account ownership before disclosing or deleting data; never send your password, Google client secret, or access tokens.
There is currently no self-service account-deletion button. Support handles verified requests using the deletion process described above. If this policy changes, we will publish the updated version and date on this page.
A direct line for help
Questions about your account, your data, or these pages? Contact us by email.
silinwork@gmail.comOperated by LIN SI