privacy

What we hold

What we collect

Your account. An email address or a mobile number — you need at least one, because it is how you sign in, and you can have both. A display name and handle. Optionally a short bio, a link, and a profile picture. When you make an account we ask for your birthdate to check you are old enough; we keep only the fact that you passed, never the date.

What you make. The scrapbooks, pages, images and captions you create or upload, anything you write in a club, and any report you send us from inside the app.

What you do here. Which clubs you belong to, whether you said you were coming to a meeting, whether you turned up, which days you used Drex while signed in, and your notification settings. If you pay a club’s dues, the amount and date of each payment and refund. Your card details go to Stripe, never to us (see Who we share it with).

Technical. A few essential cookies (see Cookies below) and a page-view count. When you sign in we note the internet address and browser the session came from, and we keep the same on a short security log of sign-ins and changes to your account. We keep a log of the emails and texts we sent you, so we can tell whether a message reached you.

Your rough location. On the welcome page and in show and tell we estimate which town you are in from your internet address, on our own server, so we can put clubs and open nights near you first. We don’t keep the address or the guess. On the page for becoming a host we use the guess to fill in your town for you to check; if you send us your answers, we keep the town you chose and that guess, never the address. (IP geolocation by DB-IP.)

If you ask to host. On the page for becoming a host we keep what you tell us about the club you’d like to open: your craft, your town, how big your group is and where it talks, where and how often you’d meet and what a night costs you. We also keep that you agreed to a call or email and when, and a phone number, an email and a best time to call if you give them. We save these when you tap “Yes, call or email me”, before the last step, so we can still reach you if you don’t finish; nothing is saved from what you type until you tap. If you don’t finish, we keep them for 90 days. We use them only to get in touch about hosting, and we never text you about it. Deleting your account deletes them, and you can ask us to delete them any time.

Why

What we use it for

To run your account and sign you in; to show your scrapbooks and your clubs to other people; to send you the notifications you asked for; to keep the place safe and deal with reports; and to understand roughly how many people visit.

The Sunday email. Once a week, on Sunday evening, we send (or, if it hasn’t started yet, will send) you an email with your clubs’ week ahead, where your challenges stand, notes from your hosts, and news about Drex itself. You can switch it to monthly or turn it off at any time, from the link at the bottom of it or in your notification settings.

When a club’s scrapbook is made by the robot, the words and photos everyone submitted to it are sent to the AI services named below under Who we share it with, and they are used only to make that scrapbook.

If we ever want to use your information for something not described here, we will update this page and say so.

Who else sees it

Who we share it with

We do not sell your personal information, and we never share it with anyone for their own marketing. A small number of services help us operate, and receive only what they need:

• Postmark — sends our email — sign-in links, notifications about your clubs, and the Sunday email.
• Twilio — delivers our text messages, when you have asked for texts.
• GoatCounter — counts page views. No cookies, no cross-site tracking, and the web address is cut to the page (plus which link you followed) before it leaves your browser.
• AI model providers — one or more of Google (Gemini), Anthropic (Claude), OpenAI, DeepSeek, xAI (Grok) or Mistral lay out a robot-made scrapbook from the words and photos in a club’s submissions. Which of them we use for which step changes as models improve, so we name every one we may use; whichever is in use receives only that club’s submissions, and only to lay out the scrapbook.
• Cloudflare — checks that a sign-in is coming from a person rather than a script, when that check is switched on.
• Hetzner — hosts the servers, in the United States, that run drex. and hold its database and uploads.
• Backblaze — holds an encrypted off-site copy of our nightly backup. It is encrypted before it leaves us, so Backblaze cannot read it.
• Google Fonts — serves the typefaces a published scrapbook uses, so when you open a scrapbook your browser makes an ordinary request to Google, which sees your internet address.
• Your browser’s push service (Apple, Google or Mozilla) — delivers the push notifications you switch on. Each message is encrypted before it leaves us, so the service passes it along without being able to read it.
• OpenStreetMap — turns the meeting address a host types into a point on a map, once, when it is saved, and supplies the streets for the little chart drawn around it.
• Komoot — suggests real addresses while a host types where their club meets. The letters typed into that one box go to Komoot’s place search through our server, so Komoot sees the text but not who typed it.
• Stripe — handles the money when a club collects dues. A host who switches dues on gets a Stripe account in their own name, and Stripe asks them for what the law requires to pay people; a member who pays dues enters their card on Stripe’s page, never on ours. We share your name and email with the host’s Stripe account so the receipt is addressed to you.
• GitHub — keeps our private list of things to fix. When you send us a report from inside the app we may copy it there — your words, your handle, the page you were on, the kind of device, and the screenshot if you attached one.

Anyone on the internet can see your profile page, the clubs you take part in and who is there, your star if you have one, the scrapbooks you contribute to, and every photo you upload to a club — a photo goes on your public wall the moment you upload it, before the scrapbook it is for comes out. These are public pages, and search engines can index them. Your email, phone number and settings are never shown. If a photo of you is somewhere you do not want it, ask us to take it down — see Your rights below.

We may also disclose information if the law actually requires it.

drex. runs on servers in the United States, and that is where your information is kept, wherever you are.

Cookies

Cookies and counting

Essential cookies only: the one that keeps you signed in, short-lived ones that carry a message from one page to the next, one that remembers you closed a club’s welcome note, a few that last no more than a day while an account is being made, to carry your address to the age question and remember how it was answered, one that ties a sign-in code to the browser that asked for it, and any set by the bot check that protects the sign-in form. There are no advertising cookies and no third-party trackers.

Your browser also keeps a few notes of its own — whether the reader’s sound is on, a celebration you have already seen — and those never leave it.

Our page-view counter does not use cookies and does not follow you between sites. Before anything leaves your browser, we cut the web address down to the page itself, keeping only a tag that says which link you followed, because the rest can carry a sign-in token or an email address. We do nothing different when your browser sends a “Do Not Track” signal, because nothing here tracks you across sites for it to switch off.

How long

How long we keep it

Your account and what you have made are kept while your account exists. Sign-in sessions expire once you stop using them, and you can sign out to end one immediately. Sign-in links and codes expire within the hour — a code texted to a phone, within minutes — work once, and are stored only as a hash, never in readable form. Remove your phone number and it comes off your account at once; our record of the texts we sent it keeps the number until your account is deleted, and if you ever replied STOP we keep the number on our do-not-text list after that too, so we never text it again. The list of days you used Drex is kept for 13 months.

Delete your account and we delete your personal information, other than anything we are legally required to keep. Our nightly backups hold a copy for about two weeks, and an encrypted copy of those sits off-site; a deleted account ages out of them rather than being edited out. The pages you made for a scrapbook that has already been published stay in it, photos included, under the name and picture you had when it came out — a published scrapbook is a finished thing, and we do not re-make it. Where the site itself names you alongside a scrapbook, it says the account was deleted instead. Tell us if you want a particular page or photo taken out of a published scrapbook.

Your say

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can withdraw consent for notifications at any time in your settings. If you are in the UK or the EU you also have the right to complain to your data protection regulator.

You can delete your account yourself from your account settings. For anything else, ask by emailing hi@drex.style from the address or number on your account, so we know it is you. We will not make it difficult.

Age

Children

You need to be at least 18 to have an account. If you believe someone younger has one, tell us at hi@drex.style and we will remove it.

The rest of the roll

Terms · Text messages · Child safety · Delete your account · hi@drex.style

In effect since 14 October 2026. If we change anything that matters, we will say so here and date it again.