Privacy

Canopy keeps what it needs to keep your worlds and your games, and nothing else. It never sells anything about you and shows no ads.

Who runs Canopy

Canopy is made and run by Mathias Kiekens, in Switzerland. He is responsible for what Canopy keeps about you. Questions about your data go to the address at the end of this page.

What Canopy keeps

• Your account: your name and email address, and your picture if you sign in with Google. If you sign in with email, your password is kept scrambled, so nobody can read it.
• Your worlds, and everything in them: articles, pictures, maps and campaigns.
• Your players: for a campaign, your players' names and characters, their notes and their answers to date polls.
• The waitlist: if you join it, your email address (and your name, if you joined with Google), only to send you an invite. If you join by email, we keep the address, scrambled, until you open the link we mail you, for at most 7 days. We remove you once you're invited, or when you ask us to.
• The news list: if you joined it, your email address, kept by Resend. Deleting your account takes it off.
• Your answer about news: with your account, whether Canopy asked you about news, and whether you said yes or no, so it doesn't ask again. If you answer while on the waitlist, your answer is kept with your place there.
• Reports and mail: what you send with Report a problem, and mail you send to Canopy's addresses.
• What admins did to your account: if one of Canopy's admins changes your Canopy Plus, signs you out on every device or mails you about deleting your account, what they did, which admin and when. Never anything from your worlds. Deleting your account deletes it.
• Limits on tries: to stop someone guessing a password or flooding a form, the internet address of a failed sign-in or sign-up, and the email address typed. They count for 15 minutes (for joining the waitlist by email, an hour) and are deleted within a day.
• Staying signed in: one cookie keeps you signed in. Canopy sets no other cookies and nothing that follows you to other sites. Your settings, such as your theme, stay in your browser.

What Canopy counts

To know whether Canopy works for game tables, and when to let more people in, Canopy counts how it's used, on its own server.

• Your account's days: which days you used Canopy, the day you made your first world, and the day a campaign of yours was first played with players (you at the table and a player opening their page on the same day). Campaigns are counted by number, never by name. We keep those days for 90 days; after that only totals are left, with no names in them. Deleting your account deletes your days at once.
• Sign-up attempts: when someone tries to make an account or join the waitlist without an invite, we count the attempt, per day and sign-in method, and how many joined the waitlist and came in from it. Canopy doesn't keep who they were, unless they join the waitlist. To count each person once a day, their Google account or the address they typed is turned into a scrambled code that is thrown away at midnight.
• Invite links opened: each time someone opens an invite link that still works, we add one to that invite's count for the day. Only the invite's number and the day are kept: not who opened it, their internet address or their device.
• Saves that failed, per day, and how many accounts, worlds and campaigns there are and how much room they take.
• Totals over time: each night Canopy writes down that day's totals (how many accounts, worlds and players there are, and how many were new or came back) and keeps them, so we can see how Canopy grows. They never name anyone.

We never count what's in your worlds, which pages you open or what you tap. Counting uses no cookies and no outside analytics service. Canopy's admins see only totals.

The start page and the privacy page are counted by Cloudflare Web Analytics: visits, the site you came from, your country and device, and how fast the page loaded. It uses no cookies, doesn't follow you to other sites, and doesn't count anything once you're signed in.

Who sees what

You decide what your players see. Canopy's admins see counts and account details (name, email address, when you joined and last came by), never what is in a world. They read the reports and mail you send.

Where it is kept

Cloudflare runs Canopy and keeps accounts and worlds. Cloudflare also keeps a short record of visits to Canopy for up to 7 days, only to find faults. Resend sends and receives Canopy's mail and keeps the news list. If you sign in with Google, Google tells Canopy your name, email address and picture, and nothing else.

New worlds are always kept in your account. Older worlds made in your browser or in a folder on your computer stay there and never reach Canopy, unless you copy them to your account.

How long

Your account and your worlds are kept for as long as you have an account. Deleting your account deletes them.

To put a world back if something goes badly wrong, Canopy can return it to how it was at any moment in the last 30 days. For the same reason, pictures you delete or replace are kept out of sight for 30 days. Deleting a world or your account deletes its kept pictures at once. The copies Canopy keeps to put a world back go within 30 days after that.

Reports, mail to Canopy's feedback address and replies to our news mail or account mail are deleted 90 days after we've dealt with them, and at the latest a year after they arrive. Such mail from someone without an account is deleted after 30 days. Privacy requests are kept until we've answered them, and deleted 90 days after. Deleting your account deletes your reports too. Mail to any other address at Canopy is not kept. If we block an address that sends unwanted mail, we keep that address until we unblock it; mail to the privacy address always arrives.

Your world is yours

Download as zip, in the World menu, takes your whole world with you at any time, as plain files you can open in other apps.

Questions, or delete your account

To see what Canopy keeps about you, to have it corrected, or to have your account deleted, write to this address from your account's email address:

The address shows here when the page opens in a browser with JavaScript.

We delete your account and everything in it, and tell you when it's done. In campaigns you played in, your name and the link to your account go; your character stays in the game master's world, as a former player's. If you own worlds, we first mail you how to keep a copy with Download as zip, and delete your account 7 days later, or sooner if you tell us you have one. We answer within 30 days.