LEGAL · PLAIN LANGUAGE

Privacy Policy

How CanvasBooth handles local creative work, purchases, optional campaign measurement, and privacy choices across native apps, the web editor, and this website.

Effective November 2, 2026

1. Scope and developer

This policy covers the CanvasBooth iOS/Android application, Flutter web editor, and this informational website, published by Low Orbit Labs. Feature and payment availability depends on platform and configuration.

The informational website does not load campaign trackers or advertising cookies. Its optional beta/early-access form collects an email address. The web editor is a separate experience: it uses browser storage, purchase-session cookies when you choose checkout, and optional Meta campaign measurement only after opt-in.

2. Local photos and projects

Photos, captured motion frames, templates, layouts, decorations, project data and exports are processed on your device or in your browser. CanvasBooth does not upload your photos or projects to its commerce or campaign-measurement services.

  • Native editing does not require a CanvasBooth login. Web checkout creates a separate purchase identity without an email login.
  • There is no CanvasBooth cloud copy or automatic cross-device synchronization of your projects.
  • CanvasBooth does not sell your photos or project content.

3. Device permissions and access

Camera, photo-library and file access are requested for capture, selection, import, saving or sharing that you initiate. Motion capture uses photo frames; CanvasBooth does not use the microphone. Permission may be revoked in device/browser settings. Browser camera access requires a supported secure context.

Campaign measurement is optional and off by default. On iOS it additionally requires authorization through the system App Tracking Transparency prompt. Denying measurement does not prevent editing or purchasing.

4. Purchases and payment services

Native purchases are processed by Apple or Google. RevenueCat validates purchase history and access using product, transaction and app-user identifiers. Internet access is needed to load products, purchase or restore. Previously validated native access is cached for offline use and updated when the service is reachable.

Web checkout uses Midtrans or Paddle when the provider is configured. Our commerce server records purchase identity, product, amount, currency, provider references and order status to verify payment, prevent duplicate charges and restore access. A necessary HttpOnly session cookie maintains the purchase session. Session and recovery secrets are stored as hashes. The recovery code is a secret: anyone holding it may recover purchase access.

Low Orbit Labs does not receive full card numbers or store passwords from this integration. The payment provider may collect billing/contact details in its hosted checkout under its own policy. Web purchase access is separate from native store purchases and does not automatically unlock iOS/Android. Refunds or chargebacks may revoke the affected access.

5. Optional early-access and beta requests

The public website optionally collects the email address you submit to manage beta/early-access registration, invitations, program updates and any awarded access. It does not send that address to Meta for campaign matching. Hosting/database providers process the registration data and technical request information needed to operate the form.

Beta registration is capped at 50 places; when full, registrations go to the waitlist. Registration does not mean that an invitation or reward has already been delivered. You can request removal through the verified developer contact on the official store listing.

In an Android beta build that enables access requests by email, CanvasBooth prepares an email containing a random installation ID. Nothing is sent until you send it. The sender address and installation ID are used for reviewing, issuing and supporting the request, and preventing duplicate issuance. These request emails are retained up to 30 days after completion unless security, abuse prevention or law requires longer retention.

6. Sharing and optional campaign measurement

Files leave the app when you choose export, share, print or save to another destination. That destination controls its own storage. Purchase services and optional measurement transmit limited metadata separately from your creative files.

If configured and you opt in, Meta App Events on native or Meta Pixel/Conversions API on web measures visits or activations, checkout activity and verified purchases, including initial native Halide/Obscura subscriptions, to evaluate Facebook/Instagram campaigns. Data can include product IDs, purchase value/currency, event identifiers, technical device/browser metadata, transport IP information, and pseudonymous or click/cookie identifiers. The web server sends a hashed purchase-identity identifier for matching; this integration does not send photos, projects, contacts, email addresses, phone numbers, session cookies or recovery codes to Meta.

Automatic advertising-identifier collection is disabled in our native configuration. Meta still processes technical identifiers/metadata under its own policy. Web Meta scripts/cookies start only after opt-in. Necessary purchase-session cookies are separate and do not depend on advertising consent.

Turn off campaign measurement in Settings to stop new events. For web, revocation must reach the server to clear queued matching data; offline revocation cannot do that immediately. Events already sent, in flight or queued inside a native SDK cannot be recalled by the switch. It does not delete data already held by Meta or cookies controlled by other domains.

Third-party references: RevenueCat privacy, Meta privacy, Midtrans privacy, and Paddle privacy. Apple, Google and chosen share destinations also apply their own policies.

7. Storage, retention, security and deletion

Native projects remain in local app storage until deleted or app/device data is removed. Web projects remain in origin-specific browser storage and can be lost through clearing site data, private browsing or browser quota/eviction. Export important work. A purchase recovery code restores purchase access, not photos or projects. Native full filesystem backups and MP4 export are not offered by the current web editor.

Our purchase server keeps order and purchase-identity records needed to validate access, resolve support/refunds and meet applicable recordkeeping obligations. Clearing local browser data does not delete server purchase records or provider records. Contact support for privacy requests; identity/ownership must be verified without disclosing recovery secrets publicly.

For privacy or deletion requests about purchase validation or campaign measurement, contact private support through the verified developer email on the official store listing. We may need to verify the request and the relevant purchase or app installation. Do not send account passwords or recovery secrets. Turning off measurement stops new events; deleting local app data does not itself delete records already held by Meta, RevenueCat, Apple or Google. Their retention and deletion policies also apply. Local creative files and exported copies must be deleted where you stored them.

Web purchase sessions expire after 30 days; a new session or recovery can renew access. Unsent campaign deliveries are retried for at most seven days, with pending payloads cleared on successful delivery, discard or acknowledged opt-out. This delivery window is not a promise to erase all order/event records after seven days. Meta/provider retention follows their policies. Project data cannot be recovered remotely by Low Orbit Labs.

8. Children’s privacy

CanvasBooth is a creative utility with no public user profiles, chat or in-app social feed. Parents and guardians should supervise camera, sharing and purchase access. Do not enable campaign measurement where you are below the age required to consent.

9. Changes to this policy

This policy may be updated when CanvasBooth’s features, store requirements, or applicable laws change. Material changes will be reflected here and, where appropriate, in the app. The effective date at the top identifies the current version.

10. Privacy questions

CanvasBooth is published by Low Orbit Labs. For a private privacy inquiry, use the verified developer email displayed on the official CanvasBooth Google Play or App Store listing. For general non-sensitive support, visit the Support page.

Do not post photos, purchase receipts, device identifiers, or other sensitive data in a public GitHub issue.

Ringkasan Bahasa Indonesia

CanvasBooth mengolah foto dan project secara lokal di perangkat atau browser. Foto/project tidak diunggah ke layanan pembayaran atau pengukuran kampanye kami. Tidak ada backup cloud otomatis; ekspor karya penting karena data browser bisa hilang.

Pembayaran native memakai Apple/Google dan divalidasi RevenueCat. Pembayaran web memakai Midtrans/Paddle bila tersedia, dengan identitas pembelian, cookie sesi wajib, dan catatan pesanan di server. Rahasia sesi/pemulihan disimpan sebagai hash. Pembelian web hanya membuka web; kode pemulihan mengembalikan akses pembelian, bukan project. Jangan membagikan kode kepada orang lain.

Pengukuran Meta opsional dan nonaktif secara default; iOS juga memerlukan izin ATT. Setelah opt-in, kunjungan, checkout, produk, nilai/mata uang pembelian dan metadata teknis/pseudonim dapat dikirim ke Meta. Integrasi ini tidak mengirim foto, project, kontak, email, nomor telepon, cookie sesi, atau kode pemulihan ke Meta. Koleksi advertising ID otomatis native dinonaktifkan.

Matikan pengukuran di Pengaturan untuk menghentikan event baru. Pencabutan persetujuan web perlu sampai ke server; antrean native, event yang sudah dikirim/sedang berjalan dan data yang sudah diterima Meta tidak dapat ditarik lewat toggle. Cookie pembayaran wajib terpisah dari consent iklan. Sesi pembelian berlaku 30 hari; jendela retry event tujuh hari bukan janji penghapusan semua catatan.

Form beta/waitlist menggunakan email untuk program akses, bukan matching Meta. Permintaan akses melalui aplikasi email hanya terkirim setelah kamu menekan Kirim; email permintaan disimpan hingga 30 hari setelah selesai, kecuali diperlukan lebih lama untuk keamanan atau hukum. Untuk permintaan privasi atau bantuan pembelian, gunakan kontak developer terverifikasi di listing resmi.