Privacy Policy

This policy explains what personal information CanvasView collects, why we collect it, who we share it with and how long we keep it. CanvasView is run by Intentionality Software, Inc. (“we”). The policy covers the app at app.canvasview.dev and this website.

Two kinds of people use CanvasView:

• Customers create an account, belong to an organization and connect an AI agent to it.
• Viewers open a canvas that a customer shared with them. A viewer does not need an account.

A customer decides what their agent puts on a canvas and who can open it. We store and show that content for the customer.

What we collect and why

Your account

• Name and email address. These come from Clerk, our sign-in provider, when you sign up or sign in. We use them to run your account, to show your organization who did what, and to contact you about your account and billing.
• Organizations and roles. The organizations you belong to, your role in each (Admin or Member) and the invitations you send or receive. We use them to decide what you can see and change.
• Where you signed up from. When a new organization account is created, we record the IP address of that request and the country, region, city and network that Cloudflare associates with it. We use this to review new accounts and to spot abuse.
• Onboarding answers. After sign-up, we ask what you want to use CanvasView for and how many credits you think you need. We save a draft as you type. We use these answers to review your account before we open it or add credits. After approval, we record which agent you chose to connect, or that you skipped that step. Accounts created before the waitlist may also have answers from an earlier form and, if they used the onboarding chat, their messages and its replies.

Your organization’s keys, connections and settings

• API keys and agent connections. We store each key’s name, who created it, its first 12 characters so you can recognise it, and a hash of the key. We never store the full key.
• Data sources. The address and settings an Admin enters for a data source. Secret headers are encrypted. For each call a component makes through a data source, we record the source’s name, the kind of status it returned and the size of the request and response. We do not record the address called, the request or the response.
• Webhooks. The webhook address and its delivery status. We keep the signing secret so we can sign deliveries, and our database holds only a hash of it.
• Defaults and limits, such as canvas expiry, access settings and spending caps.

Canvases

• Canvas content. Everything a customer’s agent creates: titles, questions, notes, tables, charts, components, data and anything else it sends.
• What people enter on a canvas. Answers, with the name the person gives, plus comments, votes and other shared state. Everyone who can open the canvas, and the customer’s agent, can see shared state.
• Who opened a canvas. Each canvas keeps an access log. For a signed-in viewer it records their name and verified email address. For a viewer who is not signed in it records the name they typed, marked as unverified. It also records how they got access and when they first and last opened the canvas. The canvas owner and the Admins of the owning organization can see this log, and viewers are told that the owner can see they opened the canvas. A signed-in viewer also gets a list of canvases they recently viewed.
• Invitations. The email addresses a customer invites to a canvas. We email each invitation.
• Presence. While you have a canvas open, other people on it see your display name and where your pointer is.
• Reports. When someone reports a canvas, we record which canvas was reported and when. We do not record who reported it.
• The canvas’s agent. An editor can ask a canvas’s own agent to change or explain the canvas. To answer, we send the request, the canvas content the agent reads, and the results of the steps it takes to an AI model that Cloudflare runs for us. We keep a record of each run with the canvas: who asked, the model, how much it used and cost, and what it did. So we can fix problems and improve the agent, a full trace of each run is also logged with Cloudflare and with PostHog: what was asked, the canvas content, comments and answers the agent read, its replies, and the identifiers of the person, API key, canvas and organization involved. Cookie settings does not change this.

Billing

• Payments go through Stripe Checkout. Stripe collects your card details. We never receive or store them.
• We keep the Stripe customer and payment identifiers for your organization, its credit balance, and a record of credits granted, bought, spent, expired and reversed.
• We email billing notices, such as when credits are added.

Usage and feedback

• Usage records. For each request we record the operation, whether it worked, how long it took, sizes and counts, the account, the API key and canvas involved, and any amount charged. Usage records never contain canvas content, answers or component source code. We use them for billing, limits, cost tracking and fixing problems.
• Feedback from agents. When your agent sends us feedback, we keep the message with your account and read it to improve CanvasView.

Product analytics

We use PostHog to understand how people find and use CanvasView, from this website through joining the waitlist to a first canvas.

• On this website and in the app, including on shared canvases, we send a page view for each page you open. For a canvas, the page is reported as /c/:id, and the canvas’s identifier is sent beside it so we can report by canvas. We also send a few named events, such as a step of joining the waitlist being shown or one of the buttons on this website, like “Open sign-up”, being pressed.
• To connect your visits, PostHog keeps a random identifier in a cookie on canvasview.dev, which this website and the app share, and in your browser’s storage. The identifier holds no name, email address or other personal details. The cookie expires 365 days after it was last updated, and it is updated whenever you visit.
• When you sign in, your visits on that browser, including those from before you signed up, are linked to your organization’s account identifier, not to your name or email address. When you sign out, the browser starts a new random identifier.
• If you are in the European Union, the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, we ask before setting this cookie. Until you choose, page views are counted with an identifier that lasts only while the page is open, and nothing is stored in your browser. If you decline, we record that you declined and then send nothing more.
• Everywhere else, analytics is on until you turn it off. You can turn it on or off at any time in Cookie settings, at the bottom of every page of this website and the app. Your choice applies to both. If your browser sends Global Privacy Control, we treat it as turning analytics off. The first time you open a shared canvas without signing in, we ask for your name and for you to agree to the Terms and this policy. Agreeing there also allows the session recording described next, unless you are somewhere we ask before setting the cookie.
• Session recording. PostHog records sessions so we can see how CanvasView is used and fix problems. A recording shows what was on your screen and what you clicked, scrolled and moved to. If you are signed in, your sessions in the app are recorded while analytics is on. If you are not signed in, on a shared canvas or on this website, your session is recorded only after you agree to this policy on a shared canvas (where we do not have to ask before setting the cookie), accept in the cookie banner, or turn analytics on in Cookie settings. It is never recorded just because analytics is on by default where you are. Declining, turning analytics off or Global Privacy Control stops recording, and signing out stops it unless you had accepted.
• What you type into any field is hidden in a recording. Sign-in and account settings screens are left out, and so are secrets when the app shows them: a new API key, the webhook signing secret and a data source’s secret headers. A recording of a shared canvas shows the canvas content that was on your screen, including answers and comments. Components written by an agent appear as blank boxes, because they run in a sandbox that the recording cannot see into. The address of a canvas is recorded as /c/:id.
• If you share a canvas, the people you share it with are recorded only as described above: guests who are not signed in agree to this policy first, and are not recorded before they do.
• Apart from session recording, analytics does not capture clicks or text you type. The only clicks it counts are the named buttons on this website, and its events never carry canvas content.
• Our servers also send events about your organization’s account: it was created, joined the waitlist (and how many credits it asked for), was approved or declined (with the credits granted and how long it waited), connected an agent or skipped that step, created its first canvas, had a canvas opened by someone else or answered for the first time, bought credits, invited a member or gained one, and created, updated, checked or closed a canvas. They also report each answer submitted on a canvas, an agent sending feedback, and a request failing, with the reason. These carry the identifiers of the organization, canvas, person and API key involved, the key’s name, amounts, counts and values from fixed lists. Apart from the traces of a canvas’s agent described under Canvases, they never carry canvas content, people’s names or email addresses.
• When your agent connects to CanvasView over MCP, our servers also send an event for each connection, each time it lists the tools and each tool it calls. A tool call event carries the tool’s name, whether it failed, how long it took, the names of the arguments it was given, the name and version of the agent’s client, and the AI model if the agent reports one. The client and model names are whatever the agent sends. These events carry the account identifier and the API key identifier. They never carry the values of the arguments, what the tool returned or the text of an error. Cookie settings does not change the events our servers send.
• As with any web request, your browser’s requests to PostHog include your IP address and browser details.

What your browser keeps

Clerk uses cookies to keep you signed in. The app also keeps a few things in your browser’s local storage: your light or dark preference, the name you typed on canvases, random identifiers for each canvas you open without signing in (so your votes and comments stay yours), how you arranged a canvas’s panels, and whether you were an Admin or a Member the last time you opened the workspace, so its menu can appear at once when you come back. None of these are used for analytics.

When analytics is on, PostHog keeps a cookie on canvasview.dev and entries in local and session storage. They hold the random identifier described above, an identifier for your current visit, the recording settings PostHog gives us for our project, once you sign in your organization’s account identifier, and the first page you opened and the page that sent you there, with canvas links and anything after a “?” or “#” removed, plus any campaign tags that address carried, such as utm_source. We also keep your Cookie settings choice in a cookie on canvasview.dev for 365 days. Turning analytics off stops any recording and deletes PostHog’s cookie, and its storage on each site the next time you open it.

Who we share it with

We use these service providers to run CanvasView. Each receives only what it needs for its role.

• Cloudflare hosts the app and this website, runs our database and storage, keeps our logs and usage records, runs the AI models behind a canvas’s agent and logs those requests, and tells us the location of a sign-up request.
• Clerk handles sign-in, accounts and organizations, and holds your name, email address and sign-in details.
• Stripe processes payments and keeps the billing record for your credits.
• Resend sends our emails, including canvas invitations and billing notices.
• PostHog receives the product analytics and the session recordings described above, and the traces of each run of a canvas’s agent.

When an agent’s component uses an open-source package, we fetch it from a package service and check it against a public vulnerability database. These services receive package names and versions, not personal information.

Some things go where a customer chooses. A component calls a customer’s data sources through our proxy, with the settings the customer gave us. A customer’s agent reads canvases, answers and shared state through our API. The customer’s agent and its provider are the customer’s choice, not our service providers.

We do not sell personal information. We will disclose information if the law requires us to.

Who can see your information

• Your organization. Each canvas is either private, which means its owner and the organization’s Admins see it in their lists and through their agents, or shared with every member. New canvases are private unless an Admin changes the default. This setting does not change who can open a canvas by its link.
• Anyone with a link. If a canvas uses link access, anyone who has the link can open it.
• Our operators. To run the service, review new accounts and handle abuse, our operators can see account details: names, email addresses, organizations, sign-up location and onboarding answers, API key names and their first characters, canvas titles and status, billing and usage records, and feedback. Our admin tools do not show canvas content, answers, shared state or comments, and they never show API keys or webhook secrets.

Security

Components written by an agent run in a sandbox, and they reach data sources only through our proxy. Data source secrets are encrypted, and API keys are stored as hashes. Read more on our security page.

How long we keep it

• Canvases. A canvas expires 7 days after it is created unless the agent or the organization sets another time (from 1 hour to 90 days). After it expires it stays read-only for up to 30 days (30 unless the organization chose fewer), then it is deleted with its answers, shared state, comments and access log. A canvas the customer keeps does not expire until they stop keeping it.
• Deleting a canvas removes its content, answers, shared state, comments and access log at once. It cannot be undone. We keep a short record of the canvas, including its title, status and charges, for billing and abuse review.
• Event log (what agents and webhooks read about canvas activity): 30 days.
• Notifications: 90 days.
• Onboarding chat messages: deleted 180 days after the chat starts.
• Account, billing and usage records: kept while your account is open.

Your choices

• Customers control their canvases. They can set how long each one lives, choose who can open it and delete it at any time.
• You can change your name and email address in your account profile.
• You can turn product analytics and session recording on or off in Cookie settings, at the bottom of every page, or with Global Privacy Control.
• To ask for a copy of your personal information, to correct it or to delete it, or to close your account, email support@canvasview.dev. You can also contact us to exercise any rights you have under the law where you live.
• If you entered something on a canvas, the customer who owns it controls that canvas. We may refer your request to them.

Children

CanvasView is not meant for children. If you think a child has given us personal information, contact us and we will delete it.

Changes to this policy

When we change this policy, we will update it here and change the date at the top. If a change matters to how we use your information, we will tell account holders by email or in the app before it takes effect.

Contact

Intentionality Software, Inc.
217 6th Ave N, #43501, Nashville, TN 37219
support@canvasview.dev