Privacy Policy

Account information. When you sign up, our authentication provider (Clerk) processes your name, email address, and profile image. We store a copy of your name, email, role, and onboarding preferences to operate your account.

Content you save. Spaces you create and the items you save to them — including source URLs, titles, thumbnail images, tags, colors, and notes. Items you save privately are visible only to you and to collaborators you explicitly invite.

Usage activity. Actions such as saving an item are recorded to power features like trending suggestions and your weekly digest.

API keys you connect (optional). If you connect your own AI provider (Anthropic or OpenAI), your key is encrypted at rest and used only to perform AI actions you initiate.

• To provide, maintain, and improve Canvas and your workspace.
• To generate AI-assisted features you use (tagging, discovery, similarity search, and trend digests).
• To send you the weekly trend digest, if enabled — you can opt out at any time.
• To secure the service and prevent abuse.

We rely on trusted processors to run Canvas. Each receives only the data needed for its function:

• Clerk — authentication and account management.
• Supabase — database and file storage.
• Anthropic / OpenAI / Google — AI processing for the features you use. Where the app generates content on your behalf, only the minimal text needed is sent.
• Resend — delivery of transactional and digest emails.
• YouTube and Instagram (Meta) — when you save or view content from these sources, we display official embeds. We use Instagram’s oEmbed endpoint solely to render a saved post inside your private workspace, always attributed to the original creator with a link back to the source. We do not access your Instagram account or any private data.

We use strictly necessary cookies to keep you signed in and to secure your session. We do not use third-party advertising cookies.

We keep your information for as long as your account is active. You can delete spaces and items at any time. When you delete your account, we remove your personal data, except where we are required to retain it to comply with legal obligations.

• Access, correct, or delete your account data.
• Turn the weekly digest on or off in Settings → Notifications, or via the unsubscribe link in any digest email.
• Disconnect a connected AI provider key at any time.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. Contact us to exercise them.

Canvas is not directed to children under 16, and we do not knowingly collect data from them.

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.

Questions about this policy or your data? Email privacy@candesign.app.