This policy explains what data Canvas handles and why. It applies alongside the Terms of Service. Short version: I collect as little as possible, and the tool is built to keep it that way.
1. Summary
- Canvas is a personal photo-composition tool. There are no advertising or tracking cookies, and no third-party analytics.
- Photos come from Unsplash. The photo URL or ID you paste is sent to my server, which resolves it through Unsplash’s official API.
- Your work-in-progress stays in your browser (localStorage) — it never leaves your device until you choose to Save.
- If you Save a composition it is stored on my backend and, once a moderator approves it, shown publicly — including the author name and categories you typed.
- Rate limiting counts requests per IP in memory only. IP addresses are not written to a database or disk, and the counters reset when the service restarts.
2. Who is responsible
The data controller for this site is Ioan Biticu. For any privacy question or request, email ioanb7code@gmail.com.
3. What I handle and why
| Data | When | Why |
|---|---|---|
| The Unsplash photo URL / ID you paste | When you load a photo | To resolve the image via Unsplash's API |
| Author name and categories you type | Only if you Save a composition | Stored with the saved work and shown publicly once approved |
| Your IP address | Each request | Transient per-IP rate limiting (in memory, not stored) |
| Standard server logs (requests, errors) | Ongoing | To operate, debug, and secure the site |
4. Unsplash photos
Photos are loaded from Unsplash. When you paste a photo link, my server asks Unsplash’s API for that photo and returns the image URL plus its credit (photographer name and links); the image itself is hotlinked directly from Unsplash and is not re-hosted.
When you download a composed image, the app sends a one-off “download” ping to Unsplash for that photo, as their API guidelines require. Unsplash’s own privacy policy governs what they do with API requests.
5. Saved compositions
Saving is optional. When you Save, the backend stores the rendered PNG, the JSON that produced it (the photo reference, crop, and your text layers), the author name, and the categories you chose. Saved posts start unapproved and become publicly visible at a shareable URL only after a moderator approves them.
The author field is free text — please don’t enter sensitive personal information there, since it is published with the image. You can ask me to remove a saved composition at any time by emailing ioanb7code@gmail.com.
6. Rate-limiting data
To keep the site available and cap cost, requests are rate-limited per IP. This is done with in-memory counters keyed by IP address — nothing is written to a database or disk, the counters expire on a short rolling window, and they are wiped entirely whenever the service restarts. Your IP is not retained beyond that transient counting.
7. Local storage in your browser
The editor saves your current document — the loaded photo, zoom/pan, crop ratio, and text layers — to your browser’s localStorage so your work survives a reload. This data stays on your device and is not transmitted anywhere until you Save. The Clear button in the editor wipes it.
8. Cookies and tracking
The site does not use advertising cookies, cross-site trackers, or third-party analytics. Browser storage is strictly functional (saving your in-progress composition and interface preferences).
9. Third parties
- Unsplash — resolves the photos you load and receives the download-tracking ping.
- Hosting / infrastructure providers — host the site and store server logs on my behalf.
10. Retention
Saved compositions are kept until you (or a moderator) ask for them to be removed. Rate-limiting counters are ephemeral and never persisted. Server logs are kept for a short period for security and debugging.
11. Your rights
Depending on where you live, you may have rights to access, correct, or delete your personal data. Because the site deliberately stores very little, there is usually little to retrieve — but for anything you have submitted (notably a saved composition), email ioanb7code@gmail.com and I will action your request.
12. Children
The site is not directed at children, and I do not knowingly collect data from anyone under 16.
13. Changes
I may update this policy; the “Last updated” date above reflects the current version. Material changes will be reflected here.
14. Contact
For any privacy question or request, email ioanb7code@gmail.com.