Privacy Policy

Context Canvas is operated by Unicorn Graveyard TM LLC ("we", "us"). It stores the account and project data needed to design, check, version and export agent configuration.

Information We Collect

• Account information from your selected sign-in provider. If you connect GitHub, its access token is stored encrypted (AES-256-GCM) and used only to open the pull requests you request.
• Workspace content you create, including blueprints, their nodes and relationships, and exports.
• Operational metadata used for security, reliability, and troubleshooting.
• Product usage events and page analytics, described below.
• An audit log of changes and exports in your organization: who acted, the action, the affected item, the time, and the request's IP address and browser user agent. The organization's owners and admins can view and export it.
• Organization membership: which organizations you belong to and your role. An invitation stores the invitee's email address only when the person inviting adds one.

Checking a Project

The check at /check reads the folder you choose inside your browser tab. The files are not uploaded or stored. We record that a check ran, where the folder came from (dropped, chosen, a .zip, or the sample), and how many files and findings of each kind it had. A fix prompt is built in the tab from the findings; when you copy one, we record only that it was copied and how many errors and warnings it covered. We never record file names, paths or contents. Google Analytics does not load on that page.

How We Use Information

• Authenticate users and protect account access.
• Persist and render your workspace data.
• Generate downloadable export artifacts requested by you.
• Maintain service integrity, abuse prevention, and incident response.

Analytics

• Product usage events. We record which features are used, such as creating a team, running the build gate, or exporting, as event names, ids, and counts. Events are linked to your account when you are signed in and anonymous in the demo and on the landing page. They never include the content of your blueprints or of files you check. They set no cookies. If you delete your account, its events are kept without the link to you.
• Vercel Web Analytics and Speed Insights. Every page reports page views and load performance to Vercel. Both are cookie-less and do not track you across sites. Record ids and query parameters, except campaign tags (utm_*), are removed from URLs first.
• Google Analytics. Loads only if you allow it, and only on public pages (home, demo, docs, APIs, about, privacy, terms). It sets cookies (_ga) to count visits. Advertising features and Google signals are off. Product pages never send analytics data to Google.

Data Sharing

We do not sell your personal information. We share data only with infrastructure, authentication, and analytics providers required to operate the service: Vercel for hosting and analytics, Neon for the database, GitHub and Google for sign-in, and Google Analytics only if you allow it. How the data is protected is on the security page.

Data Retention

We retain data for as long as your account remains active or as needed to satisfy security and legal obligations. Audit events are deleted with their organization. When a member of a shared organization deletes their account, the events they created remain with their email address as the actor.

Your Choices

You can request account and workspace deletion. You can also stop using OAuth providers at any time by revoking app access in the provider account settings.

Contact

Privacy requests, including account deletion: Unicorn Graveyard TM LLC, through the contact form. Choose Privacy Request and include the email you sign in with.

Also see Terms of Service.