Sign in

Privacy policy

Last updated: October 29, 2026

This policy explains which personal data CanvasForge processes, why, for how long, and how you can exercise your rights. In short: we collect only what the service needs, we never sell data or show advertising, and analytics cookies are set only if you accept them.

1. Who is responsible

CanvasForge is operated by Nicolas Hauviller, a private individual, who is the data controller for the processing described here.

For any question about this policy or your data, use the contact form on hauviller.com.

2. What data we process

  • Account: your e-mail address and, if you sign in with Google, the basic profile Google shares (name, e-mail address, profile picture and account identifier). If you use a password, our authentication provider stores only a salted hash of it.
  • Public profile: your username, display name, biography and profile picture. These are visible to everyone. If you sign in with Google, your Google name becomes your initial display name and username (for example “Jane Doe” becomes jane-doe); you can change both at any time in your dashboard.
  • Artworks: the title, description, parameters, palette, canvas format and thumbnail of each artwork you save, and whether it is public or private. Public artworks and their view, like and comment counts are visible to everyone; private ones only to you.
  • Interactions: the comments you post (public, under your username) and the artworks you like.
  • Contact relay: when you write to an artist, your name, e-mail address and message are e-mailed to that artist, who can reply to you directly. CanvasForge does not store these messages in its database.
  • Technical data: your IP address and browser information, used to deliver the site, prevent abuse (rate limits, bot protection) and count artwork views.

Images and music you add in the 3D view never leave your browser: they are not uploaded to CanvasForge.

3. Why we process it, and on what legal basis

  • To run your account, save and publish your artworks, show comments and likes and relay messages: performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b)).
  • To secure the service, prevent spam and abuse and keep it running: our legitimate interest (Art. 6(1)(f)).
  • To measure audience with Vercel Web Analytics, which uses no cookies and does not identify you: our legitimate interest.
  • To measure audience with Google Analytics: your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not sell your data, do not use it for advertising and make no automated decisions about you.

4. Cookies and local storage

  • Authentication cookie (sb-…-auth-token): keeps you signed in. Strictly necessary; removed when you sign out.
  • cf-locale and cf-theme: remember your language and theme for one year. Strictly necessary for features you asked for.
  • Consent choice, kept in your browser's local storage: remembers whether you accepted analytics so the banner is not shown again.
  • Google Analytics cookies (_ga, _ga_…): set only if you accept analytics. Their lifetime is set by Google (up to two years).

You can change your analytics choice at any time with “Cookie settings” at the bottom of every page. Refusing does not affect how the site works.

5. Who receives your data

Your data is shared only with the technical providers that run CanvasForge, acting as processors on our behalf and only for the purposes above:

  • Supabase: database, authentication and file storage.
  • Vercel: website hosting and cookieless audience measurement.
  • Cloudflare: Turnstile bot protection on forms.
  • Upstash: rate limiting.
  • Resend: delivery of contact-relay e-mails.
  • Google: Google sign-in if you choose it, and Google Analytics only if you consent.

Public content (profile, public artworks, comments) is visible to all visitors by design. When you send a message through the relay, the artist receives your name, e-mail address and message.

6. Transfers outside the European Union

Several of these providers are based in the United States or may process data there. These transfers rely on the EU–U.S. Data Privacy Framework for certified providers, or on the European Commission's standard contractual clauses.

7. How long we keep it

  • Account, profile, artworks, comments and likes: as long as your account exists. A deleted artwork is removed immediately; deleting your account removes your profile, artworks, comments and likes.
  • Rate-limit counters linked to your IP address: deleted automatically after at most 24 hours.
  • Contact-relay e-mails: not stored by CanvasForge; the delivery provider keeps delivery logs for a limited period under its own policy.
  • Hosting logs: kept briefly by the hosting provider for security and troubleshooting.
  • Google Analytics data: kept for the retention period configured in Google Analytics, at most 14 months.

8. Your rights

Under the GDPR you can access your data, have it corrected or erased, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time.

You can edit your profile and delete your artworks yourself from your dashboard. For anything else, including deleting your account, use the contact form on hauviller.com. We answer within one month.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

9. Security

All traffic is encrypted (HTTPS). Database access is restricted by row-level security rules so that each user can change only their own data, and e-mail addresses are never sent to other users' browsers. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.

10. Children

CanvasForge is not intended for children under 15. If you are under 15, do not create an account.

11. Changes to this policy

We may update this policy as the service evolves. The date at the top shows the current version, and significant changes will be announced on the site.