Privacy Policy

1. What We Collect

When you create an account, we collect your email address and account identifiers through Supabase Auth. If you use Google sign in, Google may provide your name, email address, profile image, and account identifier so we can create and manage your VoidCanvas account.

We also store credit balances, free-credit reset information, purchase-related identifiers, security and abuse-prevention records, and basic technical data needed to operate the Service.

We use Vercel Web Analytics to understand visits to public pages and Studio launch pages. It provides aggregate page views, referrers, approximate location, and browser and device information without analytics cookies. We remove query strings and fragments from tracked page URLs and exclude authentication, account, password-reset, checkout, and unknown routes. We do not send prompts, source files, images, generated output, account identifiers, or project contents as analytics event properties.

2. Prompts, Uploaded Files, Photos, and AI Output

When you run an AI workflow, the prompt, settings, and the specific source material or photos required for that job are sent through the VoidCanvas AI proxy (hosted on Supabase Edge Functions) to our AI inference provider, OpenRouter (which routes requests to underlying language and vision models such as Anthropic's Claude), so it can generate your requested output.

How uploaded files and sensitive inputs are handled depends on the tool: (a) In DashForge, Excel and CSV files are read in your browser; free prototype previews run locally on your device, while AI-planned dashboards send column names, summary statistics, and a small sample of rows to the AI provider. (b) In SlideForge, DocuForge, and Flashcard Studio, text is extracted from uploaded PDFs, Word documents, or text files in your browser and sent with your request when you generate or revise. (c) In FloraLens and ToyLens, plant and toy photos are resized in your browser and sent to the AI vision model for identification. (d) In CVForge and AI Tracker, work history, personal details, or habit and health tracker fields you include in your brief are sent to the AI model to build or revise your CV or tracker structure, while your daily log entries and saved versions stay in your browser on your device.

Current Studio projects and their local version history are stored in your browser (IndexedDB and localStorage) on that device. They are not synchronized to your VoidCanvas account or shown in the account dashboard.

3. Payments

Credit purchases are processed by LemonSqueezy, our merchant of record. VoidCanvas receives purchase status and related order identifiers so credits can be added securely and only once. VoidCanvas does not store your full card number or full payment credentials.

4. Browser Storage

VoidCanvas uses browser storage to keep your authentication session, remember a device client identifier for credit accounting, and store your Studio projects and local version history on your device. Clearing site data removes device-local Studio projects and may change how the browser is recognized for guest credits.

5. How We Use Data

We use data to provide AI workflows, authenticate users, account for credits, process purchases, preserve service security, prevent abuse, diagnose failures, understand which public pages and Studios visitors use, and communicate with you about your account or the Service.

We do not sell personal data or build advertising profiles from your prompts, uploaded files, photos, or Studio projects.

6. Third-Party Service Providers (Processors)

VoidCanvas relies on the following third-party processors to operate the Service: (1) OpenRouter (and underlying model providers such as Anthropic) for AI text and vision inference when you run a paid or free-credit AI workflow; (2) Supabase for authentication, PostgreSQL database storage of accounts and credit balances, and Edge Functions hosting our API proxy; (3) LemonSqueezy for payment checkout and order webhooks; (4) Cloudflare Turnstile for anonymous guest verification and bot protection; (5) Vercel for frontend web hosting and aggregate cookie-free web analytics; and (6) Google when you choose to sign in with Google OAuth.

Each processor handles only the data required for its role according to its own security and privacy terms. Please avoid uploading confidential, regulated medical, or government-ID documents that you do not want processed by an external AI model provider.

7. Security

We use safeguards including HTTPS, server-side AI credentials, Supabase Auth, row-level database controls, restricted service credentials, request validation, rate limits, HTML export sanitization, and source-aware credit accounting. No online service can guarantee perfect security.

8. Retention

Account and credit records are kept while needed to operate the Service, preserve purchases, prevent abuse, and meet legal obligations. Studio project history is kept in your browser on your device for 15 days after it was last saved, and is removed sooner if you delete it or clear site data. Payment and security records may be retained longer when reasonably required.

9. Your Choices and Rights

You may use the guest allowance without creating an account. You can sign out, delete local Studio versions inside each tool, clear browser site data, or contact us at hello@voidcanvas.xyz to request access to, correction of, or deletion of your account data. Clearing browser data permanently removes local Studio projects, so export anything you want to keep first.

If you request account deletion, we will delete or anonymize personal data associated with your account unless limited records must be retained for legal, security, tax, payment, or abuse-prevention reasons.

10. Children

VoidCanvas is not intended for children under 13. Contact us if you believe a child has provided personal data.

11. International Processing

VoidCanvas serves users globally, and our service providers (including Vercel, Supabase, OpenRouter, Cloudflare, and LemonSqueezy) may process data in the United States and other countries where their infrastructure operates.

12. Changes

We may update this policy when the Service, providers, or legal requirements change. The current policy and effective date will remain available on this page.