Your canon stays yours.

• You own everything you build in CanonBoard. We claim nothing.
• We collect what we need to run the product, and nothing more.
• AI only touches your content when you trigger an AI feature — Conflict Detection, Refine, or Smart Import. All three send the relevant content to our AI provider per-request. Relationship Mapping and Timeline run on our own database logic and never transmit your content.
• We don't sell your data. There are no ads. There are no data brokers.
• Delete your account, and your data goes with it.

• Account information. Email address and a password hash, or an OAuth identifier if you sign in with Google or Apple. A display name if you set one.
• Your content. Everything you create or upload: cards, connections, timelines, world rules, Vault entries, project details, images, documents, and embedded video links. This is your intellectual property — see Section 4 for how we treat it.
• Welcome answers (optional). If you answer the welcome questions at signup — format, project type, role — we use them to tailor your canvas and to understand who uses CanonBoard. Skipping them is always an option and carries no penalty.
• Usage data. Which features you use, session activity, device and browser type, and approximate location derived from IP address. Used in aggregate to improve the product.
• Payment information. Handled entirely by Stripe, our payment processor. We never see or store your full card number.
• Communications. Support emails and any reminder opt-ins you set at session end.

• To run the product: hosting, syncing, collaboration, exports.
• To process payments, manage subscriptions, and handle affiliate payouts.
• To power AI features you invoke — and only those (Section 4).
• To improve CanonBoard, using aggregated and anonymized usage data.
• To communicate with you. Transactional emails always; reminders and product updates only if you opted in. Every non-essential email has an unsubscribe link.
• To keep the platform secure and prevent fraud and abuse.

Here is exactly when AI touches your content, and what happens when it does:

• Only when you trigger it. Our AI features — Refine sessions and Smart Import — send the relevant content to our AI provider to generate questions and categorize entries. Nothing else does.
• Per-request processing. Content sent to power an AI feature is processed to return your result and is retained by the provider only as long as their standard operational policies require.
• Non-AI features are database logic. Relationship Mapping, Timeline, and Version History run entirely on our own infrastructure — no AI involved, no content transmitted.
• Help Hub content is generated from our own documentation — never from your projects.

• Team members you add to a project can see that project's content according to the role you assign them: view, comment, or edit.
• On plans with change history and comments, your edits and annotations are attributed to your name for your teammates.
• We never make your content public. Anything that leaves CanonBoard — a bible export, a shared file — leaves because you exported it.
• The Locked Vault follows your access settings and is excluded from exports unless you explicitly include it.

We share data only with service providers who help us run CanonBoard, under contracts that limit what they can do with it:

• Cloud hosting and database infrastructure (storing and serving your content).
• Stripe (payment processing and affiliate payouts via Stripe Connect).
• Our AI provider (AI features only, as described in Section 4).
• Google and Apple (only if you sign in with OAuth — they confirm your identity to us).
• Privacy-respecting analytics, in aggregate.

We may disclose information if legally required — a valid subpoena or court order. We will never sell your personal data or your content, to anyone, for any purpose.

• Your content stays as long as your account does. Version History is part of your content — past states of your world are retained so you can rewind.
• Delete your account, and your content and personal data are deleted from active systems within 30 days, and from backups within 90 days.
• We retain billing and affiliate payout records as long as tax and financial regulations require — that's the law, not a choice.

Your data is encrypted in transit and at rest. Access to production systems is restricted and logged. No system on the internet is invulnerable, and we won't pretend otherwise — if you believe you've found a security issue, contact contact@canonboard.com and we'll take it seriously.

Wherever you are, you can access, export, correct, and delete your data — most of it directly from your account, the rest by emailing contact@canonboard.com. If you're in the EEA, the UK, or California, you have additional statutory rights (access, portability, erasure, objection, non-discrimination). We honor them regardless of where you live, because building them once is easier than gatekeeping by geography.

We use essential cookies to keep you signed in and the product working, and a minimal analytics cookie to understand aggregate usage. No advertising cookies, no cross-site tracking, no third-party ad pixels.

CanonBoard is a professional tool for people 16 and older. It is not directed at children, and we do not knowingly collect data from anyone under 16. If we learn we have, we delete it.

If we make material changes, we'll notify you by email and in the product before they take effect.

contact@canonboard.com for privacy questions, data requests, and security reports.