Privacy Notice

Applicability

Published by Dravara, LLC. This notice describes the scope and practices stated below. Publication does not activate an unavailable service or, by itself, establish a user's agreement to a contractual provision.

A contractual provision requiring your agreement applies only where there is a legally effective agreement and only to the extent permitted by applicable law. Nothing published here makes privacy rights, other nonwaivable rights or Dravara's legal obligations depend on your accepting a contractual provision.

Third-party names and marks remain their owners' property, and their appearance does not imply affiliation, sponsorship, endorsement or participation. A partnership, acquisition, licensing or other commercial relationship requires a separate written agreement.

What we handle today

• Account and sign-in. You can sign in with a one-time code sent to your email address or, where offered, with your Google account; WorkOS is our identity provider for both. With a code, we process your email address and the code. With Google, you are redirected through Google and WorkOS, and we receive your email address, the name on your Google account, a reference Google uses to identify your account, which we store as a keyed digest, and the sign-in method used. In both cases we create a session and keep security evidence about it. We use this to create and access your account, keep you signed in and protect the account from misuse; it is handled by Dravara, by WorkOS, and by Google when you choose Google; account information is kept for the life of the account and any legally required period, an unfinished sign-in expires after ten minutes, and session records are kept until you sign out or the session ends or is revoked; you may close your account through the methods in Privacy Requests.
• Sign-in rate-limit records. A keyed digest of the email address and of the network address, derived when you request a code, used only to limit repeated attempts; held by Dravara; the record is reset or superseded when its window passes, and a scheduled deletion batch for spent records is defined but is not enabled in this release; no choice applies because the control is a security measure.
• Essential request and security records. Request metadata needed to operate and secure the service, from your browser; held by Dravara and its hosting provider; kept for the period needed for security and legal purposes; no choice applies because these records are necessary to provide the service.
• Support and contact submissions. The contact details and message you send, from you, used to respond to and handle your request; held by Dravara and the provider that delivers the message; kept for the period needed to handle the request and any legally required period; you choose what to send.
• Saved drafts and account content. Content you enter into an available feature, from you, used to provide that feature; held by Dravara; kept while the account or draft exists; you may delete content the feature allows you to delete.
• Browser choices and theme. Your privacy choices and theme preference, stored in your browser rather than sent to Dravara as a profile; see the Cookie and Storage Notice for the exact records and how to clear them.
• Optional analytics is not enabled. Analytics ships disabled for this property in this release, so no analytics identifier is set and no PUPMKT analytics provider receives information. Page views are counted by Cloudflare Web Analytics, which the hosting platform runs for this site; it is cookieless, stores nothing on your device and does not follow you to other websites. The Cookie and Storage Notice describes it. If a later release enables it, we will revise this notice before that processing begins.
• Inactive checkout, tax, payout, advertising, affiliate-attribution, session-replay, precise-location and AI-provider features are deliberately absent from this table. They are not processing information today, and a policy describing one does not activate it.

How we use providers, and how we protect information

• We use service providers for the functions identified above, and they may handle personal information only to perform those functions for Dravara. Separately, we disclose personal information when required by law, and we may disclose it where necessary to investigate or address a specific security incident, suspected fraud, or an actual or threatened legal claim. Public content is visible only when a feature actually publishes it; a private account record or saved draft is not public merely because PUPMKT has received it. We keep information for the periods or criteria stated above, including any necessary legal hold, and take reasonable measures to protect it. No method of storage or transmission is completely secure.
• Privacy Choices explains current browser storage and measurement, and how to contact us about your information. To ask about your information or make a privacy request, use the methods in Privacy Requests. Rights depend on applicable law; requesting assistance does not require agreeing to optional tracking. We publish material changes and preserve prior notices in the Policy Archive. Where additional notice or consent is legally required, we provide it before the affected processing begins.

Sale and sharing

• We do not sell personal information. We share personal information only as needed for the purposes described in this notice or as required by law. We do not share personal information for cross-context behavioral advertising. There is no advertising, affiliate-attribution or session-replay technology in the shipped build, and optional analytics is disabled, so there is no such flow to opt out of. If that changes, we will revise this notice and provide the applicable choice before the processing begins.