Privacy Policy.

1. Introduction

This Privacy Policy explains how Canvas Map (canvasmap.io) — operated by Moshe Shladov (the "operator", "we", "us") — collects, uses, shares and protects personal data when you use the Service. It should be read together with our Terms of Use. If you do not agree with this policy, please do not use the Service.

2. Data we collect

• Account data — email address and authentication identifiers when you sign up with email or Google; account creation and sign-in timestamps.
• Board content — the boards you create and the images, notes, sketches, positions and titles they contain, when you use a registered account.
• Sharing data — email addresses you invite to a board and the permission level you assign.
• Messages — the name, email, subject and message you submit through the contact form.
• Technical data — IP address, browser and device information, and security or error logs generated by our hosting providers.

We do not knowingly collect data from children under 16, and we do not sell personal data.

3. Guest mode

In guest mode no account is created and your board is stored only in your browser's local storage on your device. That content is not transmitted to or stored on our servers, and it is not accessible to us. Clearing your browser data, using private browsing, or switching browser or device will remove or hide the guest board, and we cannot recover it.

4. How we use data

• to create and authenticate your account and keep you signed in;
• to store, sync and display your boards across your devices;
• to deliver sharing invitations and collaboration features;
• to respond to messages and support requests;
• to secure the Service, prevent abuse and diagnose technical problems;
• to comply with legal obligations.

Where the GDPR or similar law applies, our legal bases are performance of a contract (providing the Service), legitimate interests (security, abuse prevention, product reliability), consent (where required, for example optional communications), and compliance with legal obligations.

5. Service providers

We use trusted processors to operate the Service, including cloud database, authentication and file-storage infrastructure, application hosting, and an email delivery provider used to send invitation and account emails. These providers process data on our behalf under contractual confidentiality and security obligations, and may store data outside your country, including in the United States, using recognised transfer safeguards where required.

We disclose personal data to others only with your instruction (for example when you share a board), when required by law or valid legal process, or to protect our rights, users or the security of the Service.

6. Cookies and local storage

We use strictly necessary cookies and browser storage to keep your session active, remember interface preferences such as theme and canvas viewport, and store guest boards. We do not use advertising cookies. You can clear this data through your browser settings, though doing so will sign you out and may delete a guest board.

7. Security

We apply reasonable technical and organisational measures, including encrypted transport (HTTPS), row-level access controls that restrict boards to their owner and invited members, and private file storage accessed through time-limited signed URLs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. As set out in the Terms of Use, our liability for security incidents, data loss or unauthorised access is limited to the maximum extent permitted by law.

8. Retention

We keep account and board data for as long as your account is active. When you delete a board it is removed from your workspace, and when you delete your account we delete or anonymise associated personal data within a reasonable period, except where retention is required by law or necessary to resolve disputes. Contact-form messages are retained for as long as needed to handle the request. Backups and logs may persist for a limited additional period.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent. You can exercise these rights by emailing shladov@gmail.com. We will respond within the time required by applicable law and may need to verify your identity first. You may also lodge a complaint with your local data-protection authority.

10. Changes to this policy

We may update this Privacy Policy as the Service evolves. The current version is always published on this page with its "last updated" date. Material changes will be highlighted in the app or by email where appropriate, and continued use after the effective date constitutes acceptance.

11. Contact

For any privacy question, use the contact form or email shladov@gmail.com.