Privacy
Drawer holds the most sensitive paper a family owns. So this page says plainly what we store, what we do with it, and what we will not do — in ordinary sentences, not a template someone else wrote.
What Drawer stores
- Your documents, and the pages made from them so they can be read on a phone.
- The dates, amounts and reference numbers read out of each one, along with a proposed title and category. These are the point of the product: the reminders and the search run on them.
- Your email address, because that is how you sign in and how a household invitation reaches you.
- A push token for each device you sign in on, so a reminder can reach your phone. Notification text is deliberately vague by default, because a lock screen is semi-public.
- Where a forwarded document came from — the sender, the subject line and the time it arrived.
- A record of what happened in the household — a document filed, a date confirmed, an export taken — so an unexpected change can be traced back.
How documents are protected
Documents are encrypted at rest, with the keys held in hardware security modules. They are decrypted only for the moment it takes to read them, never to train anything, never for ads.
And here is the boundary, stated rather than glossed over. Our servers do open a document briefly — that is how the dates come out of it. The dates and facts extracted from it then stay readable to our servers, because a reminder is a scheduled job and search is a query that runs on our side, and both need those dates in readable form. Keys held on your own devices are the documented next step, not what this version does.
Plenty of apps would call the paragraph above something snappier. It would not be true of this one, and a privacy claim you cannot check is worth nothing. An external security review comes before the beta opens to families, not after an incident.
The reading is done by a model
Each document is read by an Anthropic model, which proposes a title and a category and pulls out the dates inside — and answers the questions you ask of your own paperwork. Anthropic does not train its models on what is sent through its API. Nothing you file trains anything, ours or anyone else's.
Nothing is filed on the strength of that reading alone. Drawer proposes and you confirm, and a reminder never fires on a date you have not confirmed.
What Drawer never does
- No ads. Not at launch, not at scale, not as a growth experiment.
- Nothing sold, shared or brokered to a data partner.
- No training on your documents.
Sharing inside a household
A household is one vault, and its members can open the documents shared with the household. A document kept private is not shared with the rest of your household.
That is a boundary between the people in your home. It is not a statement about what our servers do — those are covered by the section above.
Drawer sends two kinds of message: a one-time sign-in code, and a household invitation. There is nothing else, and no marketing send. A permanent bounce or a spam complaint puts an address on a suppression list, and nothing further is sent to it.
When you forward a document to your household address, the raw message is stored encrypted only until it has been read, then deleted. Anything left behind is removed within seven days.
The waitlist on this site
Joining the waitlist stores your email address, so we can write when your invite is ready. It also stores some ordinary detail about the visit — your IP address, browser, and the rough location and referring link Cloudflare reports on every request — which is there to tell us where interest is coming from as we open the beta.
It is used for that and nothing else. It is not sold or shared, and every launch email we send will carry a way to unsubscribe. Ask us and your row is deleted, address and all.
Export and delete
Full export, any time: every document in ordinary folders, plus your confirmed dates as a calendar file. You can read it without us, which is the point.
Delete is real. The key that reads your household's documents is destroyed straight away, and the files and records are removed. Backups age out within 35 days; until then a copy may still exist in one, and no request can reach into a backup to remove it. We would rather say that than leave you to find out.
Where your data lives
This website and its waitlist run on Cloudflare. Your documents, dates and account live in Amazon Web Services in the United States — the US East region, in Northern Virginia.
Changes, and how to reach us
If any of this changes, this page changes and so does the date below. Questions, a deletion request, or something here that reads wrong to you: prncvrm@gmail.com.
Last updated 8 September 2026. Drawer is in private beta.