Privacy policy

Who operates Canvas Perch and what this policy covers

Great Lakes Computing Office operates Canvas Perch. This policy covers the Canvas Perch website, account and workspace, browser extension, and connected developer interfaces. It describes the information these services handle when you visit, join the waitlist, create an account, capture or upload material, collaborate, or contact us. Content in our public examples is sample material, not part of your account.

Information you provide

We store the information needed to run your account and the material you choose to save. That can include your name, email address, password hash, settings, support or waitlist messages, and the notes, titles, tags, links, source excerpts, images, documents, collections, canvases, checklist items, reminders, comments, and sharing choices you create. If you upload a file, we keep its original and may create a display or search representation. If you invite someone, we use the address and role you enter to deliver and manage the invitation.

Information from use of the service

Canvas Perch records information needed to authenticate requests, protect access, operate jobs, and diagnose failures. This includes hashed session and credential records, sign-in and security activity, request and job status, processing results and provenance, and billing or email delivery status. Server and infrastructure logs may also contain technical request information such as an IP address, device or browser details, time, and requested route. We use this information to operate and secure the service, respond to support requests, and investigate problems; we do not use your private canvas content for advertising.

Browser extension and Chrome Web Store data use

The Canvas Perch Capture extension acts when you choose a capture action. It may then read the page title, source URL and domain, selected text, a link, image reference, or the visible element you picked so you can review and save that item. You may add your own note. The element picker excludes form fields and password content. The extension does not fetch remote image bytes or track pages in the background. A captured draft is stored in that browser profile and is not sent to Canvas Perch merely because you selected content. Drafts may remain there until you remove them, including after a failed save.

• The extension uses captured data to show your preview and save the item to the destination you choose. Our use and transfer of extension data follows the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell extension data, use it for targeted advertising or creditworthiness, or transfer it for unrelated purposes. Our policy permits authorized operators to read captured data only with your explicit consent to access specific content, for security or abuse investigation, for legal compliance, or after it has been aggregated and anonymized for internal operations.
• Connecting the extension opens Canvas Perch sign-in and a consent screen for the narrow capture permission. Short-lived access and rotating refresh tokens stay in trusted extension storage. Disconnect clears its tokens and cached destinations and requests server-side revocation when the server is reachable; unsent drafts remain in your browser profile for you to manage.
• The extension connects to the Canvas Perch server shown in its connection settings. If you choose a different server, sign-in requests, tokens, and saved captures go to that selected server. Its operator controls that instance’s handling of information; this policy describes the service operated by Great Lakes Computing Office.
• A saved extension capture becomes account content and follows your selected personal or shared destination’s access rules. If automatic smart tags are enabled, that new item may also enter the tagging process described below.

How we use information

We use account and content information to provide captures, storage, canvases, search, exports, sharing, reminders, support, subscription access, and requested integrations. We process images into display versions and color palettes with deterministic image analysis. We extract available document text with AnyDoc on the service machine so it can appear in your workspace and search. ‘Local’ extraction here means processing within Canvas Perch’s service environment, not necessarily on your own device. We also use operational records to prevent abuse, protect accounts, deliver service messages, and maintain reliable jobs.

Automatic smart tags and external AI

Automatic smart tags are on by default for eligible new captures. When the feature is configured and your account permits it, Canvas Perch sends one saved item’s type, title, up to 8,000 characters of its saved text, existing tags, and, for a stored image, an optional thumbnail up to 512 pixels with metadata removed. Mistral Large 4 processes the first request through OpenRouter. If that request encounters HTTP 429, HTTP 5xx, or a network timeout, one fallback request may use GPT-6 Luna on a Microsoft Azure-hosted endpoint. If both immediate providers fail transiently, Canvas Perch may schedule up to four recovery rounds, each at least six hours after the preceding transient failure. Each round sends the same limited item content to GPT-6 Luna first and, only after a transient Luna failure, to Claude Haiku 5.5 on a Google Vertex-hosted endpoint. Every request uses OpenRouter Zero Data Retention routing and denies provider data collection. Authentication, billing, invalid-output, and refusal failures do not trigger provider fallback or further recovery. Tagging does not fetch the linked source page or scan your entire library.

• You can turn automatic smart tags off in Settings → Notifications before saving a new item. Turning it off cancels scheduled recovery, stops queued tagging and discards results still in flight, but cannot recall a request already sent. Editing or deleting an item also prevents an obsolete recovery result from being applied. Turning tagging back on does not backfill older items.
• Successful tags are added to the saved item automatically and can be edited or removed immediately. A failed or unavailable tagging request leaves your item in place. You can request Tag again, which supersedes pending recovery. Per-account request limits apply. Legacy stored suggestions remain unapplied; only a new eligible job, its bounded recovery, or an explicit Tag again action may generate and apply tags.
• Zero Data Retention describes the inference route; it does not erase content, tags, suggestions, job history, or provenance that Canvas Perch stores. Provider billing and operational metadata and transient processing may still exist. A daily cleanup removes sanitized failed-provider attempt metadata after 30 days; those logs contain no item content, prompts, raw provider responses or keys. This local operational log is separate from provider Zero Data Retention. This configuration requires the operator to keep OpenRouter account prompt logging disabled. Smart-tag requests stay on eligible ZDR routes; no unrestricted provider route is used.

Optional hosted document recognition

Canvas Perch first attempts document text extraction on its service machine. For a PDF that needs hosted optical character recognition, we show the selected outside provider, the data transfer, and any possible usage charge, and ask for your explicit consent for that document and operation. If you agree, the entire PDF, up to the displayed 8 MB limit, can be sent to the chosen configured provider, which may be OpenRouter or Firecrawl. Choosing to keep processing local does not send the PDF for hosted OCR. The extracted result, provider choice, and processing status may be stored with your item and job record.

Sharing and connected clients

Your personal boards begin private. People you invite can access a board or shared space according to the role you assign; editors can add or change material there. If you enable a read-only share link, anyone with the active link can see the board and linked material available through it. Disable a link or remove a member to revoke that route of access. Other members may have viewed, copied, or exported material while they had access. Shared revisions can retain a former member’s contribution with the author reference removed after account deletion.

• If you create a personal API key or authorize an OAuth or MCP client, that client can access the resources allowed by the scopes and your current permissions. Review each client before granting access and revoke unused keys or connections in Settings.
• A connected client’s own handling of information after it receives it is governed by that client’s terms and privacy practices. Canvas Perch does not give a client access beyond the permissions you approve and the access checks for the resource.

Payments, email, and service providers

When subscription checkout or billing management is available, Stripe handles the hosted payment and billing flow. Canvas Perch stores the plan, subscription, checkout, customer and provider status needed to grant access and reconcile billing; payment details entered on Stripe’s pages are handled by Stripe. We use Amazon Web Services for private object storage and, when configured, transactional email delivery and delivery events. For smart tags, OpenRouter routes the limited content to Mistral first, may use a Microsoft Azure-hosted GPT-6 Luna endpoint after a transient failure, and may later use a Google Vertex-hosted Claude Haiku 5.5 endpoint for bounded recovery. A chosen OCR provider receives a document only for a separately consented operation. Providers may process technical and billing information under their own terms.

Cookies and browser storage

The web app uses an HttpOnly session cookie with a 30-day expiry to keep you signed in and a CSRF token to protect account changes. A site appearance cookie and local browser preference remember your light, dark, or device-following choice. The canvas editor may keep an unsaved draft in browser storage for recovery. The extension keeps its connection tokens, settings, cached destinations, and unsent drafts in browser or extension storage. Clearing browser or extension data can remove those local drafts and preferences. Canvas Perch does not use advertising or cross-site tracking cookies.

How long information remains

We keep account content and settings while the account exists, subject to your edits and deletions. Deleting a canvas moves it to Trash and marks it deleted in our database; it remains restorable until account deletion. Deleting a library asset removes its database record and queues durable cleanup of stored original and derived files; cleanup can finish after the request. Deleting an account removes its account and related content records and queues stored-file cleanup. A running processing job, a Stripe subscription that has not fully ended, or pending checkout can delay account deletion until it is resolved. Audit records can remain with the account reference removed; security, billing, delivery, and provider records may also remain where needed for operations or legal obligations. Separate backups or retained migration copies may persist after active records are removed. We review privacy requests against those copies as well, but cannot give one deletion deadline for every record and provider.

Your choices and requests

You can edit or delete saved material, remove generated tags, change smart-tag and reminder preferences, manage active sessions, revoke API keys and connections, change sharing permissions, and export or request deletion of account data through the available account controls. You can unsubscribe from waitlist email through its confirmation flow; unsubscribing stops those messages but retains the email address and unsubscribe status. Contact us to request deletion of a waitlist record. If an account deletion is blocked by a running job or billing state, the interface gives the reason so you can resolve it. You may also contact Great Lakes Computing Office about access, correction, deletion, or another privacy request; we will review it in light of the applicable law and the information we hold.

Security

Canvas Perch uses access checks for private and shared material, hashes passwords with Argon2id, stores session and credential tokens as hashes on the server, requires CSRF protection for cookie-authenticated changes, and keeps private uploaded objects behind authorized file routes. API and OAuth clients use scoped bearer credentials. No online service can promise absolute security. Please use a strong password, review connected clients and sessions, and contact us if you suspect unauthorized access.

Children and locations

Canvas Perch is a general creative workspace. If you believe a child has provided personal information that should be removed, contact us. Canvas Perch and its service providers may process information in different locations. Contact us for questions about a specific transfer or privacy rights that apply where you live.

Changes to this policy

We may update this policy as the service and its providers change. We will post the revised policy here with a new effective date and provide an additional notice when a material change requires one. The version effective October 14, 2026 is the policy described on this page.

Contact

For privacy questions or requests, contact Great Lakes Computing Office through https://greatlakescomputingoffice.com/contact or call (419) 318-7120. Include enough detail for us to find the relevant account or request, but do not send passwords or sensitive canvas content through the contact form.