Qanvas Privacy Policy

1. Overview

This Privacy Policy explains what information Orbital Softworks Pte. Ltd. ("we", "us") handles when you use Qanvas and this website, and what stays on your own machine. Qanvas is local-first: the builder runs on your device, and we collect the minimum needed to sell and support it.

The local Qanvas builder connects to the internet only in these cases:

• AI requests you make go directly from your machine to the AI provider whose key you entered, with your message and the project content the AI needs (section 3).
• Support requests and visual feedback reports are sent to getqanvas.com when you submit them. That endpoint is not live yet, so Qanvas asks you to email your report instead (section 5).
• License checks go to our licence service, hosted on Supabase, when you activate or deactivate a paid license key, each time a licensed copy of Qanvas starts, and about every 14 days while it runs (section 8).
• The update check asks registry.npmjs.org for the latest Qanvas version when Qanvas opens (section 6).
• Images and videos hosted on other websites, such as the built-in placeholder picture from Unsplash or a YouTube, Vimeo or Loom video you add, are loaded from those websites when shown.
• Links you open from Qanvas, such as checkout or this website, load in your browser like any other link.

2. Local-First Storage

Your projects, pages, content, configuration and generated code are stored on your machine in your project directory. They are not uploaded to our servers, and we do not have access to them. You are responsible for backing up your own projects.

3. Direct BYOK Routing

AI-assisted features use an API key that you provide. The key is stored only in a .env.local file in your Qanvas data folder on your machine. Requests that use it are sent directly from your environment to the AI provider you choose; they are never routed through, copied to, or stored on our servers, and we never receive your key. Your AI conversations are saved only on your own machine, and we do not receive, store or have access to them; the AI provider you chose receives each request as described above.

What the provider does with the content of your requests is governed by that provider's own privacy policy and terms, which you should review before use.

4. Stripe Payment Processing

Paid licenses are sold through Stripe. Payment card details are entered on Stripe's pages and are processed by Stripe; we never see or store your full card number. From Stripe we receive confirmation of the purchase, together with the name and email address associated with the checkout, which we use to issue your license key, deliver it to you, and keep records of the sale. We store that license record (your email address, the license key and purchase details) in our hosted database, which runs on Supabase. We email your license key to you through our email delivery provider, Resend, which processes your email address to deliver it. Stripe's handling of your data is described in Stripe's privacy policy.

5. Support Intake

Submitting a support request or visual feedback report is optional. Before a support ticket is sent, Qanvas shows it for your confirmation. A submitted ticket contains:

• the request category (bug, feature request, complaint or question), title, description and any reproduction steps;
• your name and email address;
• the license-key field (your entered license key for a licensed copy, or an empty value for Community); and
• Qanvas version, Node.js version (or "browser" for visual feedback), operating system or browser platform, active theme and selected viewport.

If you use visual feedback, the report also contains the project identifier, page route, issue type, title and description; the selected region's x/y position, width and height, viewport width and height, and device-pixel ratio; the selected element's selector, HTML tag name and Qanvas block identifier when available; the viewport, theme when available, browser user-agent string and capture timestamp; and a WebP image of the selected region when Qanvas can create one. The image can contain project content visible in that region, so review the selection before submitting it.

These fields are sent to the Qanvas support endpoint at getqanvas.com. That endpoint is not live yet: a submission is currently refused without being stored, and Qanvas asks you to email support@getqanvas.com instead. Once it is live, tickets will be stored in our hosted support database with a generated ticket identifier, status, creation and update times, and any internal support notes. We use the contact and license details to identify and reply to you and understand your license context; the report text, visual selection, project and page context, and diagnostics to reproduce, investigate and resolve the request; and the ticket status, timestamps and notes to manage the support history and improve Qanvas. Community and licensed users provide the same fields and receive the same handling, except that the license-key field is empty for Community users.

Like any internet request, submission reveals your IP address to the server that receives it. Once the endpoint is live, we will hash it for rate limiting and keep that rate-limit entry in memory for approximately one minute; it will not be stored with the ticket. We retain the ticket and its associated fields for as long as needed to resolve the request and maintain a support history, then delete or anonymize them. Anything you include in a ticket or captured image is stored by us, so please do not include AI conversation content, API keys, passwords or other secrets in the description, reproduction steps or captured image. If you email us at support@getqanvas.com instead, we receive your email address and whatever you include, and use them only to respond and improve Qanvas; we keep them as part of our support history.

6. Analytics and Cookies

The local Qanvas builder sends no telemetry or usage analytics. Qanvas checks the public npm registry for the latest Qanvas version by sending a request from your browser to registry.npmjs.org; the request contains no project content or API key and is not sent to us.

This website (getqanvas.com) records basic, anonymous first-party visit events. Your browser sends them to a service we run on Supabase, our database provider, which stores only: the page visited, whether an action such as copying the install command or clicking upgrade was taken, your country where it is available, device type, browser and operating system, the site that referred you, and a random session identifier that is hashed together with the current hour so visits cannot be followed over time. Like any internet request, sending an event reveals your IP address to that service; we hash it for rate limiting and keep that rate-limit entry in memory for approximately one minute. When the event is received, the service looks up your country from your IP address and then discards the IP address; it is not stored. Stored events do not include your IP address or full browser details, and we use them only to understand which pages and features are used. The site itself is hosted on Vercel, which may keep standard server logs. IP geolocation by DB-IP (opens in new tab), used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).

This website does not use advertising cookies, cross-site tracking or third-party analytics, and we do not sell or share personal information for advertising.

7. Offline Licensing

A license key is validated locally on your device, and Qanvas keeps working if it cannot reach our servers.

8. Account & Licensing Verification

To enforce the 2-machine seat limit and detect refunded or chargebacked keys, Qanvas contacts our licence service, hosted by our infrastructure provider Supabase, when you activate a key, when you deactivate a machine, each time Qanvas starts, and about every 14 days while it runs. These checks send a SHA-256 hash of your license key (never the key itself), an anonymized SHA-256 hash derived from your operating system's machine identifier (or, if that cannot be read, from a random identifier stored on your device), and your operating system and processor architecture, for example Windows x64. Like any internet request, they also reveal your IP address to our servers. We process this data under contractual necessity, to perform the license you purchased, and use it only for seat validation and license status.

Apart from what you choose to include in a support report, we never collect your project code, canvas files or project assets.

9. Your Choices and Rights

Depending on where you live, you may have the right to access, correct, delete or export personal information we hold about you, and to object to or restrict certain processing. To exercise these rights, contact us at legal@getqanvas.com. We will respond within the time required by applicable law.

10. Changes and Contact

We may update this policy from time to time and will change the effective date above when we do. Questions about privacy can be sent to legal@getqanvas.com.