Privacy Policy
Effective Date: April 1, 2025
Last Updated: October 19, 2026
This Privacy Policy explains how TapCanvas, operated by TapCanvas Labs, Inc. (“we,” “us,” or “our”), collects, uses, and protects information when you use our application and related services (the “Service”).
1. Information We Collect
1.1 Account and Profile Information
We collect limited personal information necessary to create and maintain your account, including:
•
Display name or username
•
Profile image (if provided)
•
Contact information used for authentication (such as an email address or phone number)
This information is considered public profile information within the Service and may be visible to other users in groups you join.
1.2 User-Generated Content
We collect and process content that you and other group members create through the Service, including:
•
Chat messages
•
Messages sent to or generated by AI models
•
Content associated with AI-generated interactive user interfaces (such as shared views, inputs, or outputs)
User-generated content is linked to your account. Most of it is visible only to you and the people you share it with, but some of it is public: Projects you publish, comments you post, and the username and profile picture shown with them can be seen by anyone, including on web pages that search engines index. Section 13 explains what is public, what stays private, and how we use it.
2. How We Store and Protect Data
2.1 Encryption at Rest
User-generated content is stored on managed cloud infrastructure that provides encryption at rest, access controls, and other provider security measures.
•
Our infrastructure providers may apply encryption at rest to stored data
•
TapCanvas does not currently apply application-level or end-to-end encryption to user-generated content
•
TapCanvas systems and infrastructure providers may access user-generated content as needed to operate, secure, and support the Service
2.2 Server Access and Processing
Because TapCanvas does not currently provide zero-access encryption, content may be processed in readable form by our systems when needed to operate the Service.
•
We may process content to deliver messages, enable collaborative functionality, provide AI features, maintain reliability, and investigate security or support issues
•
We use access controls and operational safeguards to limit access to user-generated content
3. How We Use Information
We use the information we collect solely to:
•
Provide and operate the Service
•
Enable group communication, AI participation, and collaborative features
•
Maintain account functionality and security
•
Improve reliability, stability, and performance of the Service
We do not use personal data or user-generated content for advertising purposes.
4. Analytics and Tracking
We may use limited analytics to understand how the Service is used and to improve functionality. However:
•
We do not use analytics that rely on personally identifiable information (PII)
•
We do not track users across apps or websites owned by other companies
•
We do not use advertising identifiers
•
We do not create user profiles for advertising or marketing purposes
TapCanvas does not engage in tracking as defined by Apple’s App Tracking Transparency framework.
5. Data Sharing
We do not sell or rent personal information or user-generated content.
•
We share limited data with service providers who help us operate, host, secure, and support the Service
•
Infrastructure providers may process or access user-generated content as needed to provide the Service
We may disclose information only if required to do so by law or in response to a valid legal request.
6. Payment and Subscription Information
If you purchase a subscription or credits, the transaction is processed by the Apple App Store or Google Play. We do not receive or store your full payment card details.
•
We use RevenueCat, Inc. as our subscription management provider to validate purchases and manage entitlements. RevenueCat processes a pseudonymous app user identifier, purchase and transaction metadata, and subscription status on our behalf
•
We store your subscription tier, entitlement and billing-period status, and aggregate storage and usage counters in order to operate paid features and enforce plan limits
•
We do not use payment or subscription information for advertising
7. Data Retention
We retain information only for as long as necessary to provide the Service or as required by law. You may request deletion of your account, which will result in the removal of associated data in accordance with our retention policies.
8. Children’s Privacy
TapCanvas is not intended for use by children under the age of 13 (or the minimum age required by law in your jurisdiction). We do not knowingly collect personal information from children.
9. Your Rights
Depending on your location, you may have the right to:
•
Access your personal information
•
Correct inaccurate information
•
Request deletion of your account and associated data
You can exercise these rights by contacting us using the information below.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other appropriate means.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us at:
TapCanvas Labs, Inc.
Email: privacy@tapcanvas.com
12. The RemixTree Library
TapCanvas’s AI agents can use the RemixTree Library, a shared library of generic software components, generated media and instructions that agents search, fetch and publish to. The library is designed to hold no personal data: what agents send to it must be generic, and everything that is specific to you, such as your settings, your files and the data in your Projects, stays in TapCanvas.
To make the library work, TapCanvas shares the following with it:
•
A pseudonymous member key. TapCanvas computes a code from your account identifier with a secret key that the library never holds. The library sees this code, never your account identifier, name or email. It uses the code to count how many different people use a component, to apply fair-use limits, and to unlink you from the library when you delete your account (Section 12.6).
•
What your agents do in the library: their searches, the components they fetch, publish or report, and the feedback they give. With these, TapCanvas sends your agents’ display names, a pseudonymous code for each agent, a trust score computed from your account’s age, verification, plan, activity and any suspension, and whether your account counts as established.
•
Usage reports: which library components your Projects use, as counts and outcomes (for example whether you saved or liked a Project), sent with your member key, your trust score, a pseudonymous code for each Project and a fingerprint of each component’s code as your Project holds it. They contain no content of your Projects.
•
Components your agents publish. When you ask, your agent can publish a component to the library on your behalf: its code, and the instructions, description and licence your agent writes for it. TapCanvas puts the component together only from its own files, never from your settings.
•
Build results. When an agent fetches a component, TapCanvas builds it separately and tells the library whether that version of the component builds, as a pass or a fail. Build results contain no personal data.
When a component is taken down from the library, your agents can no longer fetch it, and TapCanvas stops reporting its use.
The RemixTree Library is operated by us and processes this information only to provide TapCanvas’s features.
12.1 Screening Text for Personal Data
Before the RemixTree Library stores any text that agents send to it (the names, descriptions, instructions and code of the components they publish, and their feedback and reports), it checks the text for personal data automatically and rejects it if personal data is found. The checks are made by the library’s own rules and by Jev (TypeSafe, United States, through Cloudflare). Searches your agents make in the library are checked the same way. Screening is not perfect: if personal data is found later, it is removed, and a component that contains it is taken down.
12.2 Who Receives Your Information
In addition to the providers listed elsewhere in this policy, the following process information for the features above:
•
Cloudflare. What for: hosting, storage and AI processing for TapCanvas and the RemixTree Library. Where: global network; AI processing: not fixed, including the United States.
•
TypeSafe (Jev), through Cloudflare. What for: checking text for personal data; understanding what a search is about. Where: United States.
12.3 Transfers Outside Your Country
Some of these providers process data in the United States. Where the law requires it, these transfers are covered by the European Commission’s Standard Contractual Clauses and, for Cloudflare, the EU-US Data Privacy Framework. You can ask us for a copy at privacy@tapcanvas.com.
12.4 How Long Information Is Kept
•
Text you type for suggestions: not kept
•
Library usage counts linked to your member key: 400 days
•
Daily summaries of searches: 180 days
•
Technical caches: 30 days
•
Technical logs (which contain no text you type): 7 days
•
Backups of the library’s database: up to 30 days
12.5 Your Rights
The rights listed in this policy (access, correction, deletion) also apply to information the RemixTree Library holds about you under your member key. Send your request to privacy@tapcanvas.com; we will pass it to the library where needed.
12.6 When You Delete Your Account
If you delete your TapCanvas account and it has used the RemixTree Library, TapCanvas stops sending usage reports for you and then sends your member key to the library, so that the library can unlink it from you. The library then:
•
removes your member key from your agents, which then appear as “deleted member”
•
removes the text of your feedback, searches and reports
•
keeps usage counts without the link to your member key
Components that your agents published stay in the library without your name, because other people’s Projects may depend on them. Backups keep copies for up to 30 days.
13. Projects, Comments and the Community
TapCanvas lets you publish Projects for anyone to open, comment on them, rate them and follow their creators. This section explains what that makes public, what stays private, and how we use it.
13.1 What Is Public
•
Your username and profile picture are public wherever you publish or comment: on Project pages, with your comments and on your creator page, in our apps and on web pages that anyone can open without an account and that search engines index. Your display name is not shown there.
•
Projects you publish are public: their title, description, previews and preview videos, when they were published, and their counts (how many times they were opened, their likes and their comments). Search engines may index them. A Project you unlist still opens by its link, but it is not listed and not indexed.
•
Comments you post are public, with your username and profile picture, and may be indexed. A comment held for review is visible only to you until it is reviewed.
•
Your follower count is public.
Public pages are delivered and cached by Cloudflare, our hosting and network provider. A cached copy of a page can still be shown for a short time after something on it changes or is removed.
13.2 What Stays Private
•
Your ratings. Which Projects you like or dislike is private. Others see only a Project’s total number of likes; the number of dislikes is shown only to the Project’s creator.
•
Whom you follow. Who follows whom is never shown; only follower counts are.
•
What you open. Which Projects you open is private; only the total count of opens is shown.
•
Your feed choices. “Not interested”, “Don’t recommend” and your Hidden from Home list are private.
•
Your reports. We never tell the person you report who reported them.
•
Your blocks. We don’t tell people you blocked them, although they may notice (for example, they can no longer comment on your Projects).
13.3 How We Use This Activity
•
Ordering Home and similar Projects. We order them using ratings, opens, follows, our editors’ picks, how recent a Project is, and your feed choices. When you are signed in, your Home is ordered for you from your likes, the Projects you opened and used, the creators you follow, and Projects similar to those. Signed out, everyone sees the same Home. If you don’t open Home for 14 days, we delete the data we kept to order it for you.
•
Counting opens. To count each person’s opens of a Project at most once a day, we keep a record, linked to your account, of the Projects you opened and when. We also use it to order your Home and to limit abuse.
•
Notifications. We use comments, replies and follows to notify you about comments on your Projects, replies to your comments and new Projects from creators you follow. You can turn these off in Settings.
13.4 Reports, Moderation and Blocks
•
Reports. When you report something, we keep what you reported, the reason, your note and, for a notice of illegal content, your explanation, the law, the country, your name and, if you give it, your email address. Reports are linked to your account. Notices sent by email to support@tapcanvas.com are kept the same way.
•
Automatic checks. Comments are checked automatically, before they appear, for links and for terms on a blocked list.
•
Moderation decisions. For each Project, comment or account that is reviewed, we keep a case: the reports, the decision, the statement of reasons sent to its author, and the account history the decision relied on.
•
Blocks. We keep your list of blocked people and use it to hide their content from you and to stop them commenting on your Projects.
13.5 How Long We Keep It
•
Reports: 12 months after the report is closed
•
Moderation cases and decisions: 24 months after the case is closed, or longer while a decision that still limits a Project is in force
•
The name and email address in a notice of illegal content: 30 days after the case is closed
•
Open reports and cases: until they are closed
If you delete your account, your comments are erased: their text and your name are removed, and a comment that has replies is replaced by “[deleted]”. Reports and moderation records are kept for the periods above, but no longer linked to you.
13.6 Your Choices and Redress
You can unlist or withdraw your Projects, edit or delete your comments, remove your ratings, unfollow creators, undo your feed choices in Hidden from Home, and block or unblock people at any time.
If we restrict your content or your account, we tell you why in a notice in the app. If you disagree, reply by writing to support@tapcanvas.com. You can also go to court and, if you are in the EU, to a certified out-of-court dispute settlement body. For your rights over your personal data (Section 9), contact us as described in Section 11.