PRIVACY POLICY
Your data, exactly.
This page lists what we hold, why, and for how long. It is short because we hold little. Last updated 10 September 2026.
Who is responsible
Mostafa Elleithy, trading as Redline (a sole trader), reachable at mostafa136885@gmail.com, is the data controller for Redline. The operator is established in the United Arab Emirates.
What we store, and why
| What | Why | How it is held |
|---|---|---|
| Email address | To identify your account and to send the one-time code that verifies it at sign-up. | In plain text; it is your sign-in name. |
| Password | To let you sign in. | Never stored as typed: only a salted scrypt hash. |
| Recovery code | To let you reset a forgotten password. | Only its hash. We cannot read the code back. |
| Your drawings, markups, checkpoints and preferences | To give you your workspace. | Encrypted at rest with AES-256-GCM, bound to your account so one account's data cannot be read as another's. This is server-side encryption: the service holds the key in order to serve you your own work. |
| Session cookie | To keep you signed in for up to seven days. | A random token in an HttpOnly, same-site cookie; the server keeps only its hash. |
| Connection address | To limit repeated sign-in attempts. | Used at the moment of the request; a hashed counter is kept for at most fifteen minutes and never tied to your drawings. |
| Subscription status and a Paddle customer reference | To know whether your account has access. | Received from Paddle's signed notifications. We never see or store your card details. |
We collect your email address only to identify your account and to send the one-time verification code at sign-up; we do not use it for marketing. We run no analytics and set no cookies other than the session.
Payments
Subscriptions are handled by Paddle.com as merchant of record. When you pay, Paddle collects the details a payment needs — card, billing address, tax information — under Paddle's privacy policy. Paddle tells us that a subscription exists, its status and its customer reference; nothing more.
Where it lives
The service runs on Render's infrastructure in Frankfurt, Germany, on encrypted storage. Render takes a snapshot of that storage every day and keeps it for at least seven days; we also keep encrypted backups whose key is held separately.
How long we keep it
- While your account exists: for as long as you keep it.
- After you delete your account: your data is kept, still encrypted, for thirty days so a mistaken deletion can be undone, then erased for good. Backups age out on their own schedule after that.
- Sign-in rate-limit counters: fifteen minutes.
Your rights
- Access and portability: download any drawing from your workspace at any time, as a portable project file that Redline can reopen.
- Correction: change your password from your workspace.
- Deletion: delete your account from your workspace; see above for the thirty-day window.
- Anything else, including questions and complaints, by email to mostafa136885@gmail.com. If you live in a jurisdiction with a data-protection authority you may also complain to it.
Who else sees it
Nobody, beyond the two providers named above: Render, which hosts the service, and Paddle, which takes payment. We do not sell or share your data, and we do not use it to train anything.
Changes
If this policy changes in a way that matters, we will show a notice in your workspace before it takes effect.