Privacy Policy

Effective and last updated: October 20, 2026

1. Who we are

Squiggle is operated by Code By Level LLC, a California limited liability company (“we,” “us”). We decide how and why the personal information described here is used, so we are the “controller” or “business” for it. This policy explains what we collect through the Squiggle website, web app and viewer links (the “Service”), why, who gets it, and what choices you have. It goes with our Terms of Service.

Questions, requests and complaints about privacy: [email protected].

2. Information we collect

Information you give us

• Account details. Your email address and, if you use a password, the password (we keep only a scrambled, one-way “hashed” version). If you sign in with Google, Google gives us your name, email address and basic profile details. We never see your Google password.
• Team details. A team’s name, its members’ email addresses and roles, and the email addresses of people invited to join.
• Boards. The diagrams you create: the labels, shapes, colors and connections on them, a title taken from the diagram, when each board was created and last changed, and which workspace owns it.
• What you say and type while presenting. Your browser turns your voice into text (see Section 4) and sends us the text. You can also type to a board. We use this text live, to draw the diagram and show captions. We do not save it as a transcript in our database, but the diagram built from it is saved, and the text can appear in our logs (below).
• Billing details. You enter payment details on Stripe’s pages, not ours. Stripe collects your name, card details, billing address and any tax details. We receive and keep a Stripe customer ID, your plan, number of seats, subscription status, billing period dates, whether the subscription will cancel, and records of Stripe events such as payments succeeding or failing. We do not store your card number.
• Messages to us. If you email us, we keep the correspondence.

Information we collect automatically

• Usage records. For each workspace and board: the live seconds presented, the total time viewers spent watching (a total, not who watched), the amount of AI processing used (token counts, with the model’s name), the overage minutes we report to Stripe, and timestamps. We use these to bill, to apply plan limits, and to track our costs.
• Live session information. How many presenters and viewers are connected to a board at a given moment.
• Server logs. Our servers log technical events. Access logs include your IP address, the address requested (for example, a board’s viewer-link address), the response status and the time. Application logs record what the Service is doing, including words spoken or typed to a board and the diagram commands the AI produced from them, along with a board identifier. Because of this, the words you say can appear in our logs.
• Technical details from our network provider. Cloudflare sits in front of the Service and processes details of each request, such as your IP address and browser type.
• Cookies. See Section 7.

Information from others

• Google, when you sign in with Google.
• Stripe, about the status of your payments and subscription.
• Team owners and admins, who give us your email address when they invite you.

What we do not collect

We do not receive or keep audio recordings of your voice. We do not collect precise location, advertising identifiers, contacts or biometric data. We do not ask for sensitive information such as health or financial details. Anything you say, type or draw is your choice, though, and the Service is not designed for regulated sensitive information (see the Terms).

3. How we use information

• To provide the Service. To run live sessions, turn your words into a diagram (by sending text to our AI provider), show the diagram and captions to you, your team and anyone you share a viewer link with, and save your boards.
• To manage accounts and talk to you. To sign you in, send sign-in codes, verification emails, password resets and team invitations, send service and billing notices, and answer your questions. We do not currently send marketing email.
• To bill. To charge subscriptions, measure live minutes, apply plan limits and report overage to Stripe.
• To keep the Service safe and working. To protect accounts, prevent fraud and abuse, find and fix problems, and keep the Service reliable.
• To understand and improve the Service. To measure costs, performance and capacity using usage and technical data. We do not use your boards or what you say to train AI models.
• To meet legal duties. To keep tax and accounting records, enforce our Terms, and respond to valid legal requests.

The AI only draws diagrams. We do not use it to make decisions about you that have legal or similarly significant effects.

4. Who we share information with

We use the service providers below. We share with each only what it needs to do its job.

We also disclose information:

• to the people you share it with, as described in Section 5;
• when the law requires it, or when we believe it is needed to protect people’s rights, safety or property, or to enforce our Terms;
• to a buyer or successor if we are part of a merger, sale or similar deal, and we will tell you if your information would be handled under a different policy;
• with your direction or consent; and
• in aggregated or de-identified form that does not identify you.

A few authorized staff can see account, board and usage data when needed for support, security and billing.

5. Viewer links and teams

Viewer links. Every board has a viewer link. Anyone who has the link can open it without signing in and watch the board live. They see the diagram as it is drawn and live captions of what is said, including words that are still being recognized and may change. They do not see your name or email address, and we do not identify them, though their IP addresses appear in our server logs like anyone else’s.

The links are long and random, and we ask search engines not to list them. But a link works like a key, not a password: whoever has it can pass it on, and viewers can take screenshots or recordings that we cannot control. Today there is no setting in the app to switch a viewer link off. If you need one disabled, email us and we will help, for example by deleting the board.

Teams. In a team workspace, every member can open and edit the team’s boards, and can see the other members’ email addresses and the team’s usage. Owners and admins can also invite and remove people and manage billing. Team boards belong to the team, not to the person who created them.

6. Where information is processed

We and our providers process information in the United States. If you use the Service from outside the United States, your information is transferred to, and processed in, the United States, where data protection laws may differ from those where you live. Section 14 has more for users in the European Economic Area (EEA) and the UK.

7. Cookies and similar technologies

We use only the cookies the Service needs to work:

Signing in with Google and paying through Stripe happen on those companies’ sites, which set their own cookies. Cloudflare may also set cookies that help protect the site from abuse. If you block cookies in your browser, you will not be able to sign in.

The Service does not use advertising cookies, analytics cookies or tracking pixels, and it does not load third-party analytics, advertising or tracking scripts. It does not use your browser’s local storage. Our fonts and scripts are served from our own domain.

8. No sale of information, no ads, no tracking

We do not sell your personal information. We do not “share” it for cross-context behavioral advertising, which is the California-law term for giving it to advertisers or ad networks to target ads at you. The Service shows no ads, and we do not track you across other websites or apps. We have not sold or shared personal information in the past 12 months, and we do not knowingly sell or share the personal information of anyone under 16.

9. How long we keep information

We keep information only as long as we need it for the purposes above, or as the law requires. In particular:

• Accounts and boards. Kept while your account is open. Boards stay until you ask us to delete them or your account is closed. There is currently no button in the app to delete a board or an account. Email us and we will do it.
• What you say and type. Not saved as transcripts in our database. A few recent sentences are held in server memory while a board is live, to give the AI context. They are discarded a short time after the last person leaves the board, or when the server restarts. The diagram built from them is saved as part of the board.
• Logs. Our access and application logs, which can contain IP addresses and spoken words, are held by our hosting provider, Railway, for a limited period set by its service, and then deleted.
• Billing and usage records. Kept for as long as we need them for accounting, tax, fraud-prevention and legal purposes, and to handle billing disputes.
• Sessions and invitations. A sign-in session lasts about two weeks. A team invitation expires after 7 days.
• Support emails. Kept as long as needed to help you and to keep records.
• Backups. Deleted information may remain in our providers’ backups for a limited time before it is overwritten.

When you ask us to delete your account, we delete or de-identify the account data, the boards and the usage records that belong to it, except for what we must keep, such as billing and tax records, or what we need to prevent fraud and abuse or to handle legal claims. If you are the only member of your workspace, we delete the workspace and its boards. A team’s boards belong to the team, so for a team we will work with its owner.

10. Security

We protect information with reasonable measures, including encrypted connections (HTTPS), hashed passwords, hashed invitation tokens, long random viewer-link addresses, and limits on who can reach our systems. Card details are handled by Stripe and never touch our servers. No system is completely secure, though, so we cannot guarantee that information will never be accessed, lost or disclosed. If a breach affects you, we will tell you as the law requires. Please keep your password and your email account safe, and report security problems to [email protected].

11. Your choices and rights

Wherever you live, you can ask us to:

• give you access to the personal information we hold about you, and a copy of it;
• correct information that is wrong;
• delete your account and data;
• export your data in a portable form (you can also export any board as a PNG or SVG image from the board itself); and
• limit or stop some uses of your information.

Email [email protected] from the address on your account. We will reply within 45 days, and tell you if we need longer. To protect your account, we may ask you to confirm your request from your account’s email address, or for a little more information to confirm it is you. We do not charge for requests, unless one is clearly excessive.

You also have controls of your own:

• Your browser lets you turn the microphone off at any time, and type to the board instead.
• You can cancel a paid plan on the Billing page.
• Team owners and admins can remove members and revoke invitations.
• You can remove Squiggle’s access from your Google account settings.
• You can block cookies in your browser (see Section 7).

12. California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the rights below. The table shows the categories of personal information we collected in the last 12 months.

We collect and use this information for the purposes in Section 3 and disclose it to the kinds of recipients in Sections 4 and 5: hosting, content-delivery, email, payment and AI service providers. We do not collect biometric information, precise geolocation or protected characteristics, and we do not build profiles about you from inferences. The retention periods are described in Section 9.

Your rights. You have the right to:

• know and access what personal information we collect, use and disclose about you, and get a copy of the specific information (up to twice in 12 months);
• delete personal information we collected from you, with some exceptions the law allows;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information. We do not sell or share it, so there is nothing to opt out of;
• limit the use of sensitive personal information. The only sensitive information we collect is your log-in details, and we use it only to sign you in and secure your account, so the law does not require a separate limit, but you may ask us anything about it; and
• not be treated differently for using these rights. We will not deny you the Service, charge you different prices or give you worse service for it.

How to make a request. Email [email protected]. You do not need an account to ask, but to protect your information we have to verify your identity first. We do that by matching your request to the email address on the account and, where needed, by sending a confirmation to that address or asking for a little more detail. We cannot act on a request we cannot verify.

Authorized agents. You can use an authorized agent. We will ask for your signed permission or proof of a power of attorney, and we may still contact you directly to verify your identity.

Other California rights. We do not disclose personal information to third parties for their own direct marketing (California Civil Code section 1798.83). If you are a California resident under 18 with an account, you can ask us to remove content you posted.

13. Do Not Track

Some browsers send a “Do Not Track” signal. There is no common standard for what a website should do when it receives one, and the Service does not change how it works in response. In practice it makes no difference, because the Service does not track you across other websites or apps and allows no third parties to collect information about your activity on it for advertising or analytics. For the same reason, there is nothing for a Global Privacy Control signal to opt you out of: we do not sell or share personal information.

14. Users in the EEA and the UK

If you are in the EEA or the UK, we are the controller of your personal information. We rely on these legal bases:

• Contract: to provide the Service you asked for: your account, boards, live sessions, subscription and billing.
• Legitimate interests: to keep the Service secure, prevent abuse, fix problems, track our costs and improve the Service. We weigh these against your rights and interests.
• Legal obligation: to keep tax and accounting records and respond to valid legal requests.
• Consent, where the law requires it. For example, you choose whether to let your browser use the microphone, and you can withdraw that at any time in your browser settings.

We process information in the United States. When we transfer personal information from the EEA or the UK to the United States, we rely on safeguards the law recognizes, such as standard contractual clauses or a provider’s participation in an approved data-transfer framework, where available.

You have the right to access, correct, delete and export your personal information, to restrict or object to its processing, and to withdraw consent. Email [email protected] to use them. You can also complain to your local data protection authority.

15. Children

The Service is not directed to children under 13, and you must be at least 13 to use it. People aged 13 to 17 need a parent or guardian’s permission. We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. If you think a child under 13 has given us information, email [email protected].

16. Changes to this policy

We may update this policy as the Service or the law changes. The date at the top shows the latest version. For a material change, we will tell you by email or in the Service before it takes effect.

17. Contact

Code By Level LLC
Privacy requests, questions and complaints: [email protected]