Privacy policy

When you use ZeoCanvas as a guest

We create an anonymous guest account identified by a random ID stored in a secure, http-only cookie. We store the designs, uploads and settings you create so you can return to them. We do not ask for your name or email.

When you create an account

We store your email address, display name and a salted, hashed password (we never store your password itself), plus sign-in and activity timestamps.

Your content

We store your designs, the images you upload and edited image results so that you can open them again. We do not use your content for advertising or to train AI models.

Usage statistics (with consent)

If you allow analytics cookies, we record product events such as “template selected” or “export completed” together with a random visitor ID, session ID, page path, device type, browser and operating system family. We do not record what you type, the text or images in your designs, form contents, keystrokes or mouse movements.

Contact messages

If you contact us, we store your name, email and message to reply to you.

Background removal, object removal and image enhancement run on your device in your browser. The AI models are downloaded from a public model host; your images are not sent to an AI service.

Fonts are loaded from Google Fonts. If the site operator enables Google Analytics, Google Tag Manager or Microsoft Clarity, they load only after you accept the relevant cookie category, and those providers process data under their own privacy policies.

• Guest accounts and their content: deleted after 30 days without activity.
• Account data and content: until you delete it or ask us to delete your account.
• Usage statistics: kept for up to 13 months, then deleted.
• Security logs: kept as long as needed to protect the service.

You can change your cookie choices at any time in cookie settings. You can delete designs and uploads in the app. To access, correct or delete your account data, contact us.

Connections are encrypted in production, sessions use http-only cookies with CSRF protection, passwords are hashed with scrypt, and access to your content is restricted to your account.