privacy policy

last updated 6 October 2026

drafty (the content engine for creators) helps creators write, plan and publish posts in their own voice. This page explains which personal data we process when you use drafty, why, and what rights you have. drafty is currently in a test phase.

who is responsible

Drafty LLC, Zephyr House, Fifth Floor, 122 Mary Street, George Town, PO Box 31493, Grand Cayman KY1-1206, Cayman Islands. Contact for anything about your data: drafty@methlabs.io.

what we process

• Your account. When you sign in with Google: your name, email address and profile picture. When you sign in with X: your X user id, username, name and profile picture (no email). We don’t keep the access tokens of these sign-ins.
• The waitlist. If you sign in before you’re invited, we keep your name and your email (Google) or X username on our waitlist, so we can reach out and let you in. It’s removed when you join — or whenever you ask us.
• What you create. Voice profiles (the handles and links you add, example posts, style notes, topics), drafts, images you upload or generate, your calendar, series, deals with sponsors, and the sources and accounts you follow.
• Posts we read for you. When you add your channels or role-model accounts, we fetch their recent public posts to learn a writing style. When you track a wallet, we read its public on-chain transactions.
• Connected accounts. If you connect X or a Telegram bot for publishing, we store the access credentials — encrypted — and the channels you choose. We also read the reach of posts published through drafty.
• Usage. How many posts and images you generated this month (for plan limits) and what was published when.
• Notifications. If you turn on push notifications, your browser’s push address.
• Technical data. Our servers log requests (IP address, time, page) to keep the service secure and working.

why, and on what legal basis

• To provide drafty to you — your account, writing and image generation, planning and publishing (Art. 6(1)(b) GDPR, performance of our agreement).
• To keep your place on the waitlist and let you in when it’s your turn (Art. 6(1)(b) GDPR, steps you asked for before an agreement).
• To keep the service secure, prevent abuse and fix errors (Art. 6(1)(f) GDPR, our legitimate interest).
• Push notifications only when you turn them on (Art. 6(1)(a) GDPR, consent — you can turn them off at any time).

We don’t sell your data, don’t show ads and don’t use your content to train AI models.

who else processes it

To provide the service we rely on these providers. They receive only what their part of the work needs:

• Hosting: OVHcloud.
• Anthropic (USA) — writes and analyses text: your prompts, voice profile and source material.
• Higgsfield — generates images: image prompts and the reference images you choose.
• Apify and twitterapi.io — fetch public posts of the accounts you add.
• X Corp. (USA) — sign-in with X; publishing and reach when you connect X.
• Telegram — publishing through the bot you connect.
• Google (USA) — sign-in with Google.
• Alchemy and Dune — public blockchain data for wallets and chains you track.
• Your browser’s push service (e.g. Google, Mozilla, Apple, Microsoft) — delivers notifications you turned on.

Some of these providers are located outside the EU/EEA. Where that is the case, the transfer relies on an adequacy decision (such as the EU–U.S. Data Privacy Framework, where the provider is certified) or on the EU standard contractual clauses.

cookies and storage on your device

We use only the cookies sign-in needs: a session cookie that keeps you signed in (for up to 7 days) and short-lived cookies that secure the sign-in itself. Your browser also stores a few preferences (the theme, the active profile, unfinished drafts). There are no tracking or advertising cookies.

how long we keep it

Your account and everything you created stay until you delete your account (settings › delete account) or ask us to. Sessions end after 7 days at the latest; server logs are deleted after 30 days. Connected accounts are removed when you disconnect them or delete your account.

your rights

You can ask for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you can object to processing based on our legitimate interest. Consent can be withdrawn at any time. Write to drafty@methlabs.io. You can also complain to a data protection supervisory authority.

changes

When drafty starts processing data differently, we update this page and the date at the top.