Your drawings stay in your hands.

What this policy covers

This policy covers the Excalidraw Drive Sync Chrome extension and this guide website. The extension’s single purpose is to save, open, and manage Excalidraw drawings in your Google Drive, with visible save status and automatic saving of the current drawing.

There is no developer-operated data server. The extension has no advertising, analytics, behavioral tracking or data sales. This guide has no analytics tag, cookies set by site code, or third-party fonts and scripts; its assets are served with the site.

Drawing content

The extension reads Excalidraw scene content: elements, text, drawing settings, embedded images, and drawing names. When you save, this content goes directly to Google Drive under your account; when you open a drawing, it is downloaded from Drive into Excalidraw.

Content persists locally and in your Drive until you remove it. Drawings may contain personal or sensitive information that you put there. The extension does not extract sensitive categories or collect health information, payment information, or personal communications for a separate purpose.

Google sign-in and account information

Chrome’s identity API obtains Google OAuth access tokens. Those tokens are sent as bearer credentials only to Google APIs to perform your requested Drive operations. Chrome manages the token cache. The extension never reads your Google password.

When Chrome makes it available, the signed-in profile email is read to display it in the account footer. No identity.email permission is requested, so this value may be empty. The extension does not send that email to a developer server or keep a separate email database.

What stays in Chrome

Extension-local storage keeps the current drawing’s Drive file ID and name, saved-scene fingerprints and baselines, save timestamps, migration and cache information, loading state, and the one-time auto-save notice. These support drawing continuity, scene comparison and saving.

The Pause auto-save preference is stored in Chrome sync storage. Chrome may sync it to your other Chrome profiles or devices. Excalidraw also holds drawing content in its own local browser storage.

Scene comparison is used to decide what needs saving. It is not behavioral analytics. The extension does not collect clicks, keystrokes, location, or browsing history. Looking up an Excalidraw tab is functional routing and is not retained as web history.

Permissions, and why they’re needed

Google Drive: drive.file

The OAuth scope https://www.googleapis.com/auth/drive.file lets the extension create and manage its Excalidraw Projects folder and read, update, rename or delete files it created or that you explicitly authorized for the app. This is per-file access, narrower than full Drive access. It does not grant general access to every file in your Drive and is not an email or profile scope.

Storage

Stores drawing identity, save-state information, cache and preferences described above, and supports reading and replacing the local Excalidraw scene.

Identity

Handles Google sign-in, OAuth token retrieval and sign-out, and reads the signed-in profile email if Chrome provides it.

Tabs

Finds, opens or activates excalidraw.com tabs and routes drawing-readiness and open/apply messages between the popup, background worker and page. Tab URL access also prevents replacing a canvas in a live collaboration room. Unrelated tabs are not used for tracking.

Host access

• https://excalidraw.com/*: adds the pill and panel, observes the persisted drawing scene, applies selected Drive drawings, and loads packaged UI resources.
• https://www.googleapis.com/*: calls Google Drive v3 metadata, listing, download, create, upload, rename and delete endpoints for authorized drawings and their folder. Drawings and embedded images go directly to Google with the OAuth token.
• https://oauth2.googleapis.com/*: attempts to revoke the access token when you sign out.

Who receives data

Google receives drawings and authentication requests to provide the storage service you requested. Excalidraw runs the drawing page where you work. Their own privacy terms apply to their services. The developer receives no drawing content, tokens or profile email through a developer backend.

User data is not sold or transferred for advertising, analytics, creditworthiness, lending, unrelated personalization or other purposes unrelated to the extension’s single purpose. All executable JavaScript and UI resources are packaged with the extension; Google API responses contain drawing data, not remotely hosted extension code.

This static guide is hosted on GitHub Pages. GitHub may process ordinary hosting request information under its privacy statement. This site adds no analytics or advertising.

Retention and your controls

• Pause auto-save in the panel to stop automatic saves. New and Open still save the current drawing first.
• Sign out to clear cached Chrome tokens and attempt token revocation. Revocation is best effort. Signing out does not delete Drive drawings or clear your Excalidraw canvas.
• Revoke access through your Google Account’s connected-app controls at any time.
• Delete drawings you no longer want from Google Drive. Drive trash and retention follow your Google account’s settings and policies.
• Remove local data by clearing the relevant Excalidraw site data and extension storage, or uninstalling the extension. Local removal does not delete Drive files. Chrome sync behavior remains subject to your Chrome account settings.

No separate developer database retains your drawings or identity. Local records and Drive content remain until you remove them through those controls.

Questions and changes

For privacy questions or support, contact the developer. If data handling changes, this policy will be updated with a new effective date.