Control the drawing
Edit, invite, remove members, move to Trash, restore, and permanently delete.
Trust and control
Clear controls for who can see, change, and create.
Account access, drawing roles, live collaboration, read-only snapshots, and external-agent permissions each have a distinct job.
Access model
Participation without ambiguity.
Permission checks protect saved changes and live collaboration traffic.
Move the work
Edit, save, rename, and organize a drawing without receiving ownership controls.
Stay present
Open the drawing and participate in presence without sending canvas changes.
Account protection
Verified identity before invited access.
New accounts prove control of their email before they can sign in or claim an invitation.
01Single-use links
Email verification and password-reset tokens expire and cannot be replayed after use.
02Session invalidation
Changing or resetting a password invalidates older application sessions.
03Pending invitations
Access waits until the invited address is verified instead of trusting an unproven account.
Read-only sharing
Encrypted before the snapshot leaves the browser.
A shareable snapshot is encrypted client-side. Its decryption key lives in the link fragment rather than the snapshot storage request.
- Opens without an account.
- Remains separate from the original drawing.
- Cannot be used to edit the account drawing.
- Should still be shared intentionally: anyone with the full link can view it.
Working drawingFixed snapshot
External AI agents
Explicit approval. Scoped access. Visible connections.
Compatible MCP clients connect through OAuth. The consent screen identifies the client and the access it requests.
Approve
Nothing is shared until you sign in and allow the request.
Limit
Scopes separate drawing reads, drawing creation, and visual preference access.
Disconnect
Review clients, last use, and expiry in Settings, then revoke access at any time.
Deleting is reversible first. Owner-deleted drawings stay recoverable for 90 days.