Privacy

What we keep, and why

Draft. This page describes what the code does today and is waiting for legal review before launch.

Pimvizo is a canvas your AI assistant paints on. We keep what that needs and no more: no ads, no tracking scripts, no selling data.

What we keep

• Your account: your email address, the display name you choose, and an age band (13–15, 16–17 or 18+, never your birth year). If you add a passkey, we keep only its public key.
• Sign-in sessions: a random cookie that keeps you signed in, and which assistants you connected.
• Your canvases: every stroke, title and note, so a canvas can be watched and replayed, and any pictures and fonts placed on it, by an assistant or uploaded by someone drawing on it (kept with that canvas). A canvas, its pictures and its fonts are public to anyone with its link, unless you make it private (2 on Studio Free, any number on Studio Plus and Teams): then only you, people you invite, its reviewers, anyone you give its review link and our moderators can open it. A team canvas belongs to its team: everyone in the team with a seat, people invited to it, its reviewers and our moderators can open it. If your plan keeps fewer private canvases than you have, we keep which ones you chose to keep painting, with that canvas, until you change it, make it shared or delete it.
• Reviewers and review versions: when someone joins a canvas through its review link, we keep that they review it and when they joined, and its owner sees their display name. When the owner sends a canvas for review, we keep that version of it (exactly what was on the canvas, when it was sent and the owner's display name). When a reviewer approves it or asks for changes, the version keeps their display name, the time, an optional message and, for changes, which notes were open, as part of that canvas, for everyone who can open it to see. Each note keeps which version it was left on. The review page shows people who may open the canvas the owner's display name and, on Teams, the team's name. For your own canvases we keep when you last sent one for review, to count it against your plan; it is cleared when a reviewer answers, you turn the review link off or you delete the canvas.
• Guests on a review link: someone with a canvas's review link can look at it without an account. Before their first note or decision they type a name, and may give an email address. We keep that name, the address if they gave one (and whether and when they confirmed it), when they first came and when they were last seen, tied to that one canvas. An address gets one email asking to confirm it, and nothing else until it is confirmed. Their browser keeps a cookie for that canvas only, holding a random code; we keep only a scrambled form of the code, so our records alone open nothing. Their notes, replies and answers show the name they typed and "via review link". Whoever manages the canvas sees the guest's name; the email address is never shown to anyone, and is used only to tell them a new version is ready. The guest can change their name, take the address out or ask the page to forget them at any time.
• Review emails: when sending is set up, reviewers get an email when the owner sends a new version, and the owner gets one when a reviewer approves or asks for changes. A reviewer's email goes to the address on their account; a guest's to the address they gave, only once they have confirmed it. We log that it was sent, as for every email.
• Copies of canvases: when someone takes a canvas further ("Take it from here", or today's starting point), their copy keeps a credit to the original: its link, its title and the display name of whoever started it. If we pick one of your canvases as a daily starting point, we keep a snapshot of it then, with the day and its prompt.
• Invitations: when someone invites you to a canvas, we keep the canvas, your account or the email address they typed, the access they gave you (Can view, Can comment or Can edit), who invited you and when. An email address is kept until someone signed in with that address opens the canvas; then the invitation is tied to that account and the address is no longer kept with it. We send one email to the address when it is invited, and again only if someone who manages the canvas asks; our email log keeps a scrambled form of the address, not the address. Whether an address has an account is never shown to the person inviting. People who manage the canvas see who is invited and at what level.
• Teams: which team you are in, your role (Owner, Admin or Member) and when you joined; the team's members see your display name and role, and which team canvases you started. Colours and parts added to a team's library keep who added them, and a part is a copy of what was on the canvas it came from. If you own a team that buys seats, Stripe handles the payment as for any plan.
• What assistants do: a log of each drawing action an assistant takes, used to stop abuse.
• Reports: when someone reports a canvas, the report and what we decided.
• Payments: if you buy a plan, Stripe handles your card. We keep the subscription and invoice records, never card numbers.

To slow down abuse we use short-lived, one-way hashes of IP address ranges. We don't store your IP address.

Cookies and storage

One cookie keeps you signed in. A guest on a review link gets one cookie for that canvas instead (see above). Your browser also remembers small preferences, such as the email you last signed in with, the canvas page's light or dark theme and your recent colours. They stay on your device. There are no analytics or advertising cookies.

Who else handles it

• Cloudflare runs the site and stores its data, sends sign-in and review emails, and runs the bot check (Turnstile) on sign-in and when a guest gives their name on a review link.
• Stripe processes payments.
• Websites your assistant takes pictures from: when an assistant places a picture by its web address, our server fetches it from that site once. The site sees a request from us, not from you.
• Your AI assistant's provider (for example Anthropic or OpenAI) sees what your assistant reads and paints, under their own terms.

How long we keep it

• Your account and canvases, with the pictures and fonts placed on them: until you delete them. A deleted account is removed for good after 30 days. A picture or font you add to someone else's canvas stays with that canvas, like your strokes on it, until its owner deletes it. A copy of a canvas (a remix or fork) keeps the pictures and fonts it uses.
• Copies other people took of your canvas: they are their canvases, kept until they delete them. Deleting yours does not delete theirs, and their credit keeps your canvas's title and your display name as they were.
• A daily starting point made from your canvas: until we remove it, you turn off "Show in the gallery" in your account settings, the canvas is hidden or wiped, or you delete your account.
• Reviewers: until the owner removes them, the canvas is deleted, or the reviewer's or the owner's account is deleted.
• Guests on a review link: until the review link is turned off or replaced, someone who manages the canvas removes them, they ask the page to forget them, the canvas is deleted, or a year after they were last seen. Their notes and answers stay on the canvas with the name they typed, like everyone's. Their cookie lasts a year and opens nothing once the link changes. An email address a guest gave but did not confirm is deleted 7 days after we asked them to confirm it.
• Review versions and answers: as long as the canvas they are on. Deleting your account does not remove an answer you gave on someone else's canvas; it keeps your display name as it was.
• Team membership: until you leave, the owner removes you, the team is deleted, or you delete your account. An owner cannot delete their account while others are in the team: they make an admin the owner first, or delete the team. Deleting a team, or the account of an owner alone in it, deletes the team, its palette and its parts; its canvases become the owner's private canvases.
• Invitations: until someone who manages the canvas removes them, the canvas is deleted, or the invited account is deleted. An invitation held for an email address goes when an account with that address is deleted. If you delete your account, invitations you sent stay with the canvas without your name.
• Team canvases: they belong to the team, so they stay with it, with what you painted on them, when you leave, are removed or delete your account. If you delete your account, the team's owner becomes the creator of the team canvases you started. They are removed when the team deletes them, or with the account of whoever holds them when the team ends.
• A team's palette and parts: until a member removes them or the team is deleted. If you delete your account, parts you added stay with the team without your name.
• The assistant action log: 90 days.
• Email delivery records: 90 days.
• Closed reports: two years after they were closed.
• Payment records: as long as tax law requires, linked only to a random account ID.

Your choices

Your canvases are not in our gallery unless you turn on "Show in the gallery" in your account; it is off unless you turn it on. From your account you can download everything we hold about you, change your details, sign out other devices, disconnect assistants and delete your account. For anything else, email hello@pimvizo.example.

Children

Pimvizo is not for children under 13. If we learn an account belongs to someone under 13, we delete it.