ForceCanvas
beta
Back to home

Privacy Policy

Last updated: June 7, 2026

1. Introduction

ForceCanvas ("Service"), operated by Galileon Arc LLC ("we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have regarding your data. This policy applies to all users of the Service wherever located and is incorporated by reference into our Terms of Service.

Geographic scope

ForceCanvas is available to users in the United States and internationally. Section 9 describes your privacy rights based on where you are located. If you are accessing ForceCanvas from outside the United States, your data may be transferred to and processed in the United States, where privacy laws may differ from those in your country.

2. Information We Collect

We collect the following categories of personal information:

Information you provide directly:

  • Name and email address (required for account creation and stored in our database to manage your account access status)
  • Professional role and organization name (optional, provided at signup)
  • Communications you send us, such as support requests

Information collected automatically:

  • Usage data, including pages viewed and product actions taken within the Service, when optional analytics are enabled
  • Device and browser information, such as browser type, operating system, and diagnostic context
  • IP addresses and user agent strings, which are temporarily recorded in server request logs by our hosting infrastructure (Vercel) and automatically deleted within 30 days
  • Cookies, local storage, session storage, and similar technologies (see Section 6)
  • Error and diagnostic logs collected by Sentry, which may include device context and application state at the time of an error. We configure Sentry to reduce personal data in error reports (see Section 6).

Payment information:

  • Payment card and billing details are collected and processed directly by Stripe. We do not store payment card information on our systems.

3. How We Use Your Information

We use the information we collect to:

  • Create and manage your account and provide access to the Service
  • Process payments and manage subscriptions through Stripe
  • Send transactional and account-related communications, including billing notices, security alerts, and support responses
  • Analyze usage patterns to improve the functionality and user experience of the Service when optional analytics are enabled
  • Diagnose and fix technical errors and bugs via Sentry error monitoring
  • Comply with applicable legal obligations

We do not use your personal data for advertising purposes or sell it to third parties for marketing.

4. Information Sharing

We do not sell or rent your personal data. We may share your information only in the following circumstances:

Service providers:

We share data with trusted third-party providers who help us operate the Service. These providers are contractually required to handle your data securely and only for the purposes we specify. Current providers include:

  • Clerk — authentication
  • Supabase — data storage
  • Stripe — payment processing
  • Vercel — hosting infrastructure; processes request logs including IP addresses and user agents, which auto-expire within 30 days
  • Upstash — caching and rate limiting; stores hashed IP data for rate limiting purposes, which auto-expires automatically
  • PostHog — optional product analytics, used only when analytics consent is enabled
  • Sentry — essential error monitoring and optional replay diagnostics

Legal requirements:

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of our users or the public.

Business transfers:

If the Service or its assets are transferred to another party, your information may be transferred as part of that transaction. We will notify you of any such change via email or prominent notice on the Service.

5. Data Retention

We retain your personal data for as long as your account is active. If you submit an explicit deletion request, we will process it within 30 days and confirm when complete, subject to the exceptions below. In cases of standard account termination without an explicit deletion request, data is retained for up to 90 days before permanent deletion.

The following exceptions apply:

  • Payment and billing records are retained for a minimum of 7 years to comply with tax and financial recordkeeping obligations.
  • Server request logs (IP addresses, user agents) are retained by our hosting provider (Vercel) for up to 30 days and expire automatically. These cannot be selectively deleted.
  • Rate limiting data stored by Upstash consists of hashed IP addresses and expires automatically. These cannot be selectively deleted.
  • Error logs and diagnostic data collected by Sentry are retained for up to 90 days.
  • PostHog analytics data is retained according to our PostHog project settings and is collected only when optional analytics consent is enabled.
  • Communications sent to us (e.g., support emails) may be retained for up to 2 years for quality and legal purposes.

6. Cookies and Tracking Technologies

We use cookies, local storage, session storage, SDK telemetry, and similar technologies to operate and improve the Service. The types of storage and telemetry tools we use include:

  • Strictly necessary storage: Required for the Service to function, including session authentication via Clerk, security controls, billing flows, and remembering your privacy preference. These cannot be disabled.
  • Optional analytics: PostHog is used to understand how users interact with the Service so we can improve it. PostHog analytics, pageviews, product events, and user identification are disabled unless you accept optional analytics.
  • Optional replay diagnostics: Sentry Replay and canvas replay may help us diagnose issues by recording a masked replay of a browser session. These replay features are disabled unless you accept optional analytics and replay.
  • Error monitoring: Sentry is used to capture and diagnose application errors in real time as an essential service function. We configure Sentry with default personal-data collection disabled, browser logs disabled, and request/event scrubbing for cookies, tokens, secrets, user data, and canvas or sketch payloads. Error logs and diagnostic data collected by Sentry are retained for up to 90 days.

You can change your optional analytics and replay preference at any time through the Cookie Settings link in the footer. If you decline optional tracking, PostHog analytics and optional Sentry replay remain disabled. If your browser sends Global Privacy Control, we treat it as an opt-out signal and keep optional analytics and replay disabled. We do not currently respond to Do Not Track (DNT) browser signals.

7. Security

We implement commercially reasonable administrative, technical, and physical security measures to protect your personal data against unauthorized access, loss, or misuse. These include encrypted data transmission (HTTPS), access controls, and use of established third-party infrastructure providers.

However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your data. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

8. Users Under 18

The Service is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13 without verifiable parental consent, we will delete that data promptly.

Users between the ages of 13 and 17 may use the Service only with the consent and active supervision of a parent or legal guardian, as described in our Terms of Service. By permitting a minor to use the Service, the parent or guardian consents to the collection and use of that minor's data as described in this Privacy Policy.

9. Your Privacy Rights

We respect privacy rights regardless of where you are located. The following rights apply to all users:

  • Right to access: You may request a copy of the personal data we hold about you.
  • Right to correction: You may request that we correct inaccurate or incomplete data.
  • Right to deletion: You may request that we delete your personal data, subject to legal retention requirements.
  • Right to portability: You may request your data in a commonly used, machine-readable format.

To exercise any of these rights, contact us at support@forcecanvas.com. We will respond to verified requests within 30 days and may need to verify your identity before processing your request.

California residents — California Consumer Privacy Act (CCPA)

If you are a California resident, you have the following additional rights:

  • Right to know: You have the right to know what categories and specific pieces of personal information we collect, use, and disclose. We do not sell your personal data.
  • Right to opt out of sale: We do not sell your personal data to third parties. If this ever changes, we will provide a "Do Not Sell My Personal Information" option before doing so.
  • Right to non-discrimination: We will not deny you services, charge different prices, or provide a lower level of service because you exercised your privacy rights.

Other US state residents — Virginia, Colorado, Connecticut, Texas, Utah, and others

A growing number of US states have enacted comprehensive consumer privacy laws. We are committed to honoring the spirit of these laws for all US users. In addition to the universal rights above, residents of states with applicable privacy laws may also have:

  • The right to opt out of the processing of personal data for targeted advertising (we do not conduct targeted advertising)
  • The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling)
  • The right to appeal a denial of a privacy rights request — if we decline your request, you may contact us at support@forcecanvas.com to appeal, and we will respond within 60 days

International users — EU, UK, EEA, Canada, and other countries

ForceCanvas is accessible internationally. If you are located outside the United States, please be aware of the following:

  • Your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country.
  • If you are located in the European Union, United Kingdom, or European Economic Area, you may have rights under the General Data Protection Regulation (GDPR) or equivalent legislation, including the right to lodge a complaint with your local supervisory authority. We are not currently established in the EU/UK and do not have a designated EU/UK representative, but we will make reasonable efforts to respond to GDPR-based rights requests submitted to support@forcecanvas.com.
  • If you are located in Canada, you may have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) or applicable provincial privacy legislation. We will honor reasonable requests made under these frameworks.

By using the Service from outside the United States, you acknowledge that your data will be processed in the United States and consent to that transfer.

10. Third-Party Links and Services

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access through ForceCanvas.

11. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. When material changes are made, you will be notified via email or in-app notification. The updated date at the top of this policy will always reflect the date of the most recent revision. Your continued use of the Service after notice of changes constitutes your acceptance of the updated policy.

12. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at support@forcecanvas.com.