Privacy policy

Who is responsible

minicanvas is run by the developer who makes it, who decides how the data described here is used and is responsible for it (the "controller", in data-protection terms). "We" on this page means them. Write to gradywetherbee@u.northwestern.edu about anything here.

Drawing without an account

Signed out, nothing you draw reaches this server. Your drawings are held in your own browser's storage. There is no account, no upload, and nothing on our side to collect.

That changes only when you choose it: signing in puts your drawings on the server so they survive a new browser and can be shared.

What is collected

• Your email address, which is how you sign in — there is no password — and a first and last name, if you give them.
• Your orgs: which orgs you are in, your role in each, and the invitations you send or receive.
• What you make: drawings (the scene, its name, the views you pin), share links, folders, components and collections, and the pictures and files you add, with their size.
• Who a drawing is shared with: when somebody adds you to a drawing by name or email address, that is kept with the drawing — even before you have an account, so it is waiting when you sign up.
• Your chats with a drawing: what you write to the AI chat, the files you attach, and its answers, kept so the conversation can carry on.
• The org's AI memory: notes the chat keeps for an org (conventions, preferences), written by the chat or by anybody in the org.
• An AI usage log: for each chat answer, who asked, in which drawing, which model, how many tokens and what it cost — used to keep each org within its allowance.
• An org activity log: who joined, left or was invited, role and setting changes, and memory edits, with the names as they were at the time.
• Subscription identifiers from Stripe, so we know which plan each org is on.
• A session for each sign-in, so the browser stays signed in.

Your card details are never collected, seen or stored — Stripe handles payment on their own pages.

Who can see what

• People in an org see each other's names and email addresses, and whatever the org's settings and each drawing's sharing let them open.
• An org's Admins, and roles they give the right to, can open every drawing in the org, see its activity log and, for those who manage billing, each person's AI usage. What you make in an org belongs to that org's workspace and stays with it if you leave.
• Anybody holding a share link can open that drawing, without signing in.
• Somebody you add to a drawing by email is emailed a link to it.

Where it is kept

• Hetzner hosts the servers and the database that hold your account, your orgs and your drawings.
• Amazon S3 holds the pictures and files inside your drawings. They are served back through this app rather than from a public bucket address.

We never sell your data

Your data is never sold, rented or traded to anybody. It is not used to build advertising profiles, and we do not use it to train machine-learning models.

Nobody at minicanvas looks at your drawings except where access is genuinely needed to fix a fault you have reported, to act on a report of abuse, or where the law requires it.

Who else is involved

These are the only third parties that handle any of it, and each does one job:

• Hetzner — hosting, as above.
• Amazon Web Services (S3) — file storage, as above.
• Stripe — payment and billing. They receive what they need to take payment, and the number of people in a paying org each month; we receive only identifiers and plan status back.
• Our email provider — receives your address in order to deliver sign-in codes, invitations, sharing notices and deletion confirmations.
• debounce.io — when you sign up, your address is checked against their list of disposable-email domains. This happens once, at sign-up.
• Google (Gemini) and OpenAI — only when somebody uses a drawing's chat: their message, the files attached to it or earlier in that conversation, the conversation so far, the drawing's contents, the org's component library and design-system stylesheets, and its AI memory are sent to produce the answer, under those companies' API terms. Nothing is sent unless somebody writes a message.

Dictating into the chat (the microphone in its prompt bar) uses your browser's own speech recognition. minicanvas receives only the words it writes into the field, never the sound; some browsers, such as Chrome, send the sound to their maker to turn into words, under that browser's terms. Nothing is ever read aloud.

Some of these are outside the UK and the EU, chiefly in the United States. Where data goes there, it does so under the safeguards the law provides for it, such as the standard contractual clauses in those providers' terms.

Share links and live editing

A share link is a long, unguessable address. Anyone holding one can open that drawing without signing in, so treat a link as the access it is. Deleting a link from the share panel stops it working at once, including for anyone already watching.

While people are editing together, each person's pointer position, where they are looking and the display name they chose are passed between the open browsers. Those are held in memory only and never written down — they are gone the moment everyone closes the page.

Cookies and browser storage

One cookie holds your session, set when you sign in. It is HttpOnly and SameSite=Lax, and over HTTPS it is Secure. Two more, each lasting at most a day, remember an invitation or a drawing you were opening while you sign in. All are needed for the service to work, which is why there is no cookie banner.

Your browser's own storage keeps your preferences (theme, typeface, toolbar) and, signed out, your drawings. It stays on your device.

There are no analytics, advertising or tracking cookies, and no third-party scripts on these pages.

How long it is kept

• A sign-in lasts until you sign out, until it has gone unused for 30 days, or for two years at most. Sign out everywhere, under your avatar, ends every sign-in at once.
• A deleted drawing disappears from every list and its links stop working at once; it is erased for good when its org or your account is deleted.
• A picture that no drawing points at any more is marked, and its bytes are deleted after about thirty days — long enough that an undo or a re-paste costs nothing.
• A chat with a drawing is kept until you clear it, or the drawing, org or account goes.
• Sign-in codes are erased within an hour of being sent, and deletion links within a day.
• Everything else is kept while your account or the org it belongs to exists.

Your IP address is used in memory to rate-limit requests so the service cannot be flooded. It is not stored as a record of you. Server error logs, which can include an email address, are kept only as long as needed to fix faults.

Deleting your account or an org

You can delete your account yourself: Delete account… under your avatar emails you a link, and opening it shows exactly what will go before you confirm. Orgs only you are in are deleted with everything in them; you leave any org other people are in, and what you made there stays with that org. Your name is taken out of other orgs' activity logs. An org's Admin can delete the whole org the same way, from its General settings, which also cancels its subscription.

Records Stripe keeps of payments, and anything we must keep by law, are not part of this.

Your rights

You can ask what is held about you, ask for it to be corrected, ask for it to be deleted, ask for a copy, or object to how it is handled — write to gradywetherbee@u.northwestern.edu. You can also take your drawings with you at any time without asking anybody: the download menu writes a single file that opens in any browser, with no server behind it.

If you are in the UK or the EU, you have these rights under the UK GDPR and the GDPR, and you may complain to your national data protection authority. We use your data to provide the service you signed up for (performing our contract with you), to keep it secure and working (our legitimate interests), and to meet legal obligations such as keeping billing records.

Children

minicanvas is not meant for children. You need to be at least 16, or the age of digital consent where you live if that is older, to make an account.

Changes to this policy

If what we collect or who handles it changes, this page changes with it and the date at the top moves.

Contact

Questions, or a request about your data: gradywetherbee@u.northwestern.edu.