Privacy policy

Last updated 27 September 2026 · Version 2026-09-27

Who we are

Scribit is a free, shared whiteboard run by Scribit. We’re responsible for your personal information. Questions or requests go to contact@scribit.live.

The short version: we keep what we need to run Scribit and keep it secure. No ads, no selling your data, no tracking you across other sites.

What we collect

Your account: your name, email address and whether you’ve verified it, and a one-way hash of your password (never the password itself).
Profile picture, if you add one. We resize it and strip hidden details such as location before we save it.
Sign-in security: your authenticator secret (encrypted) and hashed recovery codes if you turn on MFA, the devices you’re signed in on with when each was last used, and a log of security events such as sign-ins, password changes and data exports.
Your work: boards and their recent history, notes, comments, votes and other workshop content, tags and labels, and boards you’ve saved.
Workspaces: which workspaces you belong to and your role in each.
Feedback you send us, including technical details and a screenshot if you choose to add them.
Your internet address, used briefly to limit repeated sign-in attempts and other abuse. We keep it only as a scrambled counter that clears itself within an hour. It isn’t written to our security log.

If you open a shared board as a guest, the name you type is shown to the others on that board.

How we use it

To run Scribit: sign you in, save your boards and share them.
To keep accounts safe and stop abuse.
To send emails you need, such as verification, password reset and security notices. We don’t send marketing email.
To improve Scribit, using overall statistics from the data we already hold, such as how many boards are created.

We don’t show ads, we don’t sell or rent your information, and we don’t track you across other websites.

Who can see your content

The people you work with can see boards according to their workspace role. Anyone with a link you share can open that board with the access you chose. Scribit’s administrators look at accounts or boards only for support, security or legal reasons, and every administrator action is logged.

Service providers

We use a few trusted providers to run Scribit:

Railway hosts the app and its database, in the Singapore region.
Resend delivers our emails, so it receives your email address and the message.
tldraw makes the whiteboard software. Your browser loads its fonts and icons from tldraw’s content network, which sees your internet address as any website would.
Sentry, if we turn it on, receives error reports in its EU region. We remove board content from those reports.

Data outside your country

Your information may be stored or processed outside the country you live in, including in Singapore, the United States and the EU. We use reputable providers with appropriate safeguards for your data.

Cookies and browser storage

We use only what Scribit needs: a cookie that keeps you signed in, a short-lived cookie during sign-in, and browser storage for things like your theme, your last workspace, and board changes that haven’t synced yet. There are no advertising or tracking cookies.

How long we keep it

Your account and boards: until you delete them or your account.
Deleted boards: in the trash for 30 days, then gone for good.
Security log: 90 days.
Signed-in devices: removed after 30 days without use. Expired reset and verification links are cleared daily.
Feedback: screenshots for 30 days; resolved feedback for 180 days.
Backups: replaced within about a week.

Your choices and rights

See and download your profile, the boards you created, your workspace memberships, and your comments and votes in Settings, Data.
Correct your name and picture in Profile, and your email in Sign-in and security.
Delete your account in Settings, Data. Your personal boards go with it. Boards in a team workspace stay with the team, and copies others have downloaded can’t be recalled.
Change your mind about optional things, such as your profile picture or authenticator sign-in, at any time.
Complain to us first at contact@scribit.live. You can also contact your privacy regulator: the Office of the Australian Information Commissioner in Australia, or your local data protection authority in the EU or UK.

Children

Scribit is for people aged 13 and over. Under 18s need a parent or guardian’s permission. If you think a child under 13 has an account, tell us and we’ll remove it.

Keeping it secure

Connections to Scribit are encrypted. Passwords are hashed, authenticator secrets are encrypted, and you can turn on authenticator sign-in (MFA) and sign out other devices in Sign-in and security.

Changes to this policy

If we change this policy in a way that matters, we’ll tell you before it takes effect. The date and version at the top show which version you’re reading.

Contact

Email contact@scribit.live with any question about your information.