privacy

Skribbl is a desktop app that runs on your machine. There is no account, no server of ours that it talks to, and no analytics in it.

What stays on your machine

Your canvases and node positions, your terminal scrollback, your token and spend history, the links you draw between agents, and your list of recent projects. All of it is written to the app's own folder in your user data directory and never leaves it.

The one request Skribbl makes on its own

Eight seconds after launch, and every six hours after that, a packaged build checks GitHub Releases to see whether a newer version exists. It is a plain download of the release manifest. There is no request body, no identifier and nothing about you or your work in it. What GitHub learns is what any web server learns from any download: your IP address and the app version.

Development builds do not check at all.

The things that touch the network because you asked

Cloning a repository, opening a URL in a web preview node, and the coding agent itself. That last one matters and is worth being plain about: Claude Code, Codex, Gemini and Grok send your prompts and code to their own providers. That is what they do. They do it with your credentials, over their own connection, exactly as they would if you ran them in your terminal.

Skribbl never sees that traffic and never sits in the middle of it. It holds no API key and it proxies nothing.

How the token counter works

When an agent finishes a turn it tells Skribbl where its own transcript file is. Skribbl opens that file read-only and adds up the token counts the agent recorded. It reads nothing else, and the totals are stored locally.

The local channel, and its honest boundary

Agents talk to Skribbl through a small server bound to 127.0.0.1 on an OS-assigned port, authenticated with a token generated fresh each launch and stored in a file only your user can read. It is not reachable from your network. The trust boundary is any process running as you, which is the same boundary as your SSH keys.

Git

The git panel runs exactly four commands: status, diff, add and commit. It never pushes, pulls or fetches. Committing is local.

This website

skribbl.dev is hosted on Vercel and uses privacy-preserving product analytics with no session recording and no cross-site tracking, so that we can tell how many people reach the download. If you give us an email address, it is only ever used to tell you about Skribbl.

Questions

Ask, and we will answer specifically rather than in policy language.