Privacy Policy

Canvas Chat stores your account, your canvases, and the API keys you add. Your keys are encrypted at rest and only ever used to run the generations you request. You can delete all of it, in the app, at any time.

• Account: your email address, the name you signed up with, and a hash of your password — never the password itself. A session cookie keeps you signed in; each session records the IP address and browser it was created from.
• Canvases: everything you put on them — prompts, model responses, node positions, canvas names, and per-canvas system prompts. Nothing is removed unless you delete it.
• Provider API keys: keys you add are encrypted at rest with AES-256-GCM before they reach the database. They are decrypted on the server only when used — to run a generation you requested, or to test a key when you save or re-test it — and are never sent to the browser. The interface only ever sees the last four characters.

Only to proxy the generations you request to the provider you chose (Anthropic, OpenAI, Google, or OpenRouter), plus a minimal validation call when you save or re-test a key. Generations run on your own provider account and are billed by that provider — Canvas Chat pays for no inference and adds no markup.

When you run a generation, the conversation path leading to your prompt and the canvas's system prompt are sent to the provider you chose, using your key. That provider's own terms and data policies apply to what you send it.

• We don't sell your data.
• We don't train models on your content.
• We don't use your keys for anything you didn't request.
• We don't run third-party advertising or tracking scripts.

Cookies are used only to keep you signed in. Your theme choice and small interface preferences live in your browser's own storage. That's it.

The app and its database run on Amazon Web Services in the United States.

You can delete your account from inside the app: user menu → Delete account. Deletion is immediate and removes your account, all canvases and their content, and your stored API keys — the database cascades the delete. If anything goes wrong, email us and we'll remove it by hand.

If this policy changes, the date at the top changes with it.

Questions about your data: emre0kirmizi@gmail.com