CanvasPlanet
Privacy Policy
Privacy Policy
Last updated 18 August 2026
The short version
- You can paint without an account. Doing so still stores a cookie, your IP address, and your network provider.
- An account adds your email address (or Discord ID), a display name, and an optional profile picture.
- We log IP addresses, both on your session and on every pixel painted. This is how bans, rate limits, and bot attacks are handled.
- We do not sell your data, run advertising, or use third-party analytics or tracking pixels.
- Deleted chat messages are hidden, not erased — moderators keep them as evidence.
- You can erase your account yourself from the Account panel.
This box is a summary for convenience. The numbered sections below are the actual policy.
1. Who this is about
This policy covers CanvasPlanet — the canvas at this domain, the embeddable widget, and the status page. It applies whether or not you have an account.
CanvasPlanet is run by a small independent operator, not a company with a data-protection department. That is worth knowing when you decide what to put here.
2. What we store
The table below is the complete list. It is written from the database schema rather than from a template, so it names what is actually there.
Everyone, including anonymous visitors
| Data | Why | How long |
|---|---|---|
| A session token | Identifies your browser so your charge bank persists. Stored hashed, never in the clear. | Until the session expires |
| Your IP address | Rate limiting, ban enforcement, and stopping one person from farming charges across many sessions. | Life of the session record |
| Your network operator (ASN) | Derived from the IP. Lets us throttle a hosting provider or proxy network during an attack without blocking a whole country of ordinary users. | Life of the session record |
| A hash of your browser's user-agent | Detecting one script pretending to be many browsers. We store the hash, not the user-agent itself. | Life of the session record |
| Charge balance, total paints, last-seen time, and the last country you painted in | Running the game. | Life of the session record |
| Ban expiry, if you are banned | Enforcing the ban. | Life of the session record |
| An IP address on every pixel you paint | Investigating vandalism and bot attacks after the fact, and reverting them accurately. | Kept with the canvas history |
If you create an account
| Data | Why | How long |
|---|---|---|
| Email address | Verifying the account, password resets, and contacting you about your account. We do not send marketing email. | Until you delete the account |
| Password | Signing in. Stored only as an argon2id hash — we cannot read your password, and neither can anyone who obtains the database. | Until you delete the account |
| Display name | Public identity on the leaderboard, in chat, and on your pixels. | Until you delete the account |
| Discord account ID, if you sign in with Discord | Linking that Discord account to this one at each sign-in. | Until you delete the account |
| Profile picture, if you upload one | Shown next to your name. Converted to a small square image and stored in our own database, not a third-party host. | Until you replace or remove it |
| Paint totals, streaks, and last paint date | The leaderboard and the streak counter. | Until you delete the account |
| Chat messages you send | Showing them to other players, and moderation. See section 6. | Indefinitely |
| Sign-in sessions and one-time email tokens | Keeping you signed in; verification and password-reset links. All stored hashed. | Until they expire or are used |
What we do not collect: we do not run advertising, third-party analytics, or tracking pixels. There is no payment mechanism, so we never hold card or billing details. We do not ask for your real name, date of birth, or location beyond the country an IP address resolves to.
3. Why we store it
Everything above exists for one of four reasons: to make the game work at all (charges, attribution, leaderboards), to keep you signed in, to stop abuse (IP addresses, ASNs, user-agent hashes, ban records, the anti-bot check), or to moderate content people report.
The abuse-prevention data is the part people are most likely to object to, so to be plain about it: a shared canvas that anyone can paint on without an account cannot be defended from scripted attacks without knowing where paints come from. That is the whole reason the IP address is on the session and on the pixel. It is not used for anything else — not profiling, not analytics, not advertising.
Where a legal basis is required of us, we rely on the necessity of performing the service you asked for, and on our legitimate interest in keeping that service usable and safe.
4. Who else sees it
We do not sell your data, and we do not share it for anyone else's marketing. These are the only third parties involved, and what each one receives:
| Who | What they get | When |
|---|---|---|
| Cloudflare | Your IP address and connection metadata, as the CDN and proxy in front of the site. Their Turnstile anti-bot check also loads in your browser and performs its own device checks. | Every request; Turnstile on your first paint of a session |
| OpenStreetMap | Your IP address, because map tiles are fetched by your browser directly from their servers. | Only while the street map overlay is switched on in Settings |
| Discord | The OAuth exchange when you choose "Continue with Discord" — they tell us your account ID and email; we tell them nothing about your canvas activity. The Discord panel in the app also asks their servers for public server information, which reveals your IP to them. | At Discord sign-in; when you open the Discord panel |
| Our email provider | Your email address and the contents of the message, in order to deliver verification and password-reset links. | Only when such an email is sent |
| Our hosting provider | Holds the server and database on our behalf, so technically holds everything in section 2. | Continuously |
We may also disclose data where we are legally required to, or where it is necessary to investigate a serious threat to the service or to someone's safety.
6. What is public
Some of what you do here is visible to everyone, permanently. Specifically: your display name and profile picture, your position and totals on the player leaderboard, your streak, any alliance you join, and the fact that a given pixel was painted by your account.
Chat is kept even after it disappears. When a message is deleted — by you or by a moderator — it stops being shown, but the original text is retained along with who deleted it and why. This is deliberate: it is the evidence behind moderation decisions and behind reports that may still be open. Please treat chat as a permanent record.
Reports you file about an area or a message are visible to moderators, including the fact that you filed them.
Your email address, IP address, and network provider are never shown publicly. They are visible only to the operator and to moderators using the admin tools.
7. Deleting your account
Open the Account panel, choose Delete account, and type your display name to confirm. It takes effect immediately, and it cannot be undone.
When you do this we:
- erase your email address, password, and Discord ID;
- replace your display name with an anonymous placeholder;
- delete your profile picture, all sign-in sessions, and any outstanding verification or reset links;
- detach every pixel you have ever painted from your account, which also removes you from the player leaderboard;
- unlink the account from the browser session, so you can carry on painting anonymously.
Two things deletion does not do, and cannot.
Your pixels stay on the canvas. They become unattributed, but they are not erased — by the time you delete your account they may be part of artwork many other people have built around, and removing them would vandalise that work rather than protect your privacy.
Your chat messages stay in the log, shown under the anonymous placeholder rather than your name. They are part of other people's conversations and part of the moderation record, for the reasons in section 6.
Backups taken before deletion are overwritten on their normal rotation rather than edited individually.
If you have never created an account, there is nothing to delete: clearing your cookies for this site is what ends the anonymous session, and the record behind it expires on its own.
8. Your rights
Depending on where you live, you may have the right to ask for a copy of your data, to have it corrected, to have it erased, to object to how it is used, or to complain to a data protection authority.
Erasure is built into the product — see section 7 — so you never have to ask us for it. For anything else, write to the address below and we will do our best to answer within 30 days. We will ask you to prove control of the account before acting on a request about it, since otherwise the request itself becomes a way to attack someone.
We may keep a limited amount of data despite an erasure request where we have to: an active ban record, or material relating to an unresolved abuse report, so that deleting an account cannot be used to escape moderation.
9. Contact and changes
Privacy questions, data requests, and anything else about this policy: [email protected].
If we change this policy we will update the "last updated" date above, and for a change that materially affects what we collect or who we share it with, we will say so in the app rather than relying on you noticing the date.