Privacy Policy
Buzzing Canvas
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Buzzing Canvas is an offline-capable poster editor set in the fictional BuzzCast world. Projects contain the text you enter, selected built-in illustrations, layer positions and styling, animation timings, titles, version history, delivery snapshots and creation or modification dates. These are saved on your iPhone in the app's local storage. Settings, pending backup identifiers and deletion requests are stored locally. A randomly generated installation secret is stored in this device's Keychain when private backup is first used. There are no user accounts, names required for registration, passwords, email sign-in, advertising identifiers, location collection or analytics SDKs. If you enable private backup or explicitly use a backup action, project JSON and rendered PNG previews are sent to our backend. The backend stores an irreversible hash of the installation secret, project identifiers, encrypted project contents and delivery snapshots, preview object keys and update timestamps. Opening the fictional event feed or public website also sends ordinary HTTPS requests to our hosting infrastructure, which receives network information such as IP address, request time and requested path. The app does not upload your photo library or contacts.
How we use information
Local project data lets you create, edit, autosave, reopen, version and preview posters offline. Delivery is a fictional in-app action and does not contact a real creator or publish your poster publicly. The optional private backend backs up this installation's projects, serves them back to the same installation, freezes a submitted snapshot and processes deletion requests. A rendered preview supports private backup display and storage. The public event endpoint provides fictional editorial content. The installation hash authorizes access without an account. Local preferences control the interface, hints, backup queue and reminder option. An optional local notification reminds you about unfinished work; it does not require an email or remote notification service. Hosting diagnostics and request identifiers help operate and troubleshoot the service.
Service providers and sharing
The backend, PostgreSQL database and private S3-compatible preview bucket are hosted by Railway, which processes data as infrastructure provider. Railway and its infrastructure may process connection metadata and operational logs when serving requests. The server's own error logging uses a request identifier, generic error code and error type; it does not intentionally log the installation secret or project contents. The backend uses the PostgreSQL driver and AWS S3-compatible client library to communicate with these Railway resources; the S3 library does not mean that project data is deliberately sent to a separate Amazon storage account. There are no advertising, behavioral analytics, social sign-in, support-ticket or email-delivery integrations. Personal projects and previews have no public access endpoint. We do not sell personal data. Information may be disclosed when legally required.
Data retention
Local projects remain until you delete them or remove the app's local data. Saved versions and the frozen delivery snapshot remain with their project. Local settings and pending backup operations remain on the device. The installation secret is stored with a device-only Keychain accessibility setting and may survive an app reinstall on that device according to iOS behavior; it is not an account recovery method. Server projects, submitted snapshots and previews remain until an authorized deletion request is completed. Turning off automatic backup does not itself delete existing server copies. No automatic server content expiration is configured. Infrastructure log retention and any provider-managed backup retention follow the hosting provider's configuration and policies; we do not promise a retention period that we have not verified. Provider backups, if retained, may age out after active records have been deleted rather than being erased immediately.
Deleting your information
Deleting a project removes its local originals and versions and queues deletion of its server project, delivery snapshot and private preview. When offline, server deletion is retried after backup communication resumes; the server copy is not considered deleted until that request succeeds. In Settings, Delete all server backups removes the projects and previews available to this installation and disables automatic backup while keeping local originals. Connect to the internet to complete server deletion and check the displayed result. Removing the app alone cannot send a deletion request, so delete server backups before uninstalling if desired. Without the installation secret we cannot identify or authorize access to its encrypted namespace through a sign-in flow, and cannot promise recovery or deletion of a particular backup based only on an email. You may contact sitak.viki.team08@gmail.com about privacy or deletion options. Do not send your installation secret by email. Any hosting-provider backup copies are subject to the retention treatment described above.
Permissions and your choices
No permission is needed for the built-in illustration library, local editing or private HTTPS backup. The app asks for notification permission only when you explicitly enable the local unfinished-project reminder in Settings. You can turn the reminder off in the app and revoke notification permission in iPhone Settings at any time; local editing continues to work. The app does not request camera, microphone, photo-library, contacts, tracking or geographic location access. System accessibility preferences are used to respect Reduce Motion, text size and assistive interaction; an additional in-app interface motion preference is available.
Your privacy rights
Depending on applicable law, you may have rights to access, correct, delete or restrict processing of your personal data, object to certain processing, obtain a copy or complain to your local data protection authority. You can inspect and edit your local projects in the app, fetch the private backup belonging to the current installation and use the deletion controls. Contact sitak.viki.team08@gmail.com for privacy questions or to exercise rights. This address is a public privacy contact, not an account, in-app messaging feature or recovery channel. We may need information sufficient to verify an authorized request without disclosing another installation's data. Rights and available remedies depend on your jurisdiction.
Security
The app uses HTTPS for its public backend, a cryptographically random 32-byte installation secret in iOS Keychain and installation-scoped authorization for private operations. The server stores a SHA-256 namespace derived from that secret rather than the secret itself. Project JSON, immutable submissions and PNG previews are encrypted with AES-256-GCM using a server-only key and authenticated context binding them to the installation and project. Database queries are parameterized; requests have size limits and private request rate limits. The preview bucket is private. This is server-side encryption, not end-to-end encryption: the service must decrypt data to return it to an authorized installation. Anyone with the installation secret can access that installation's backups, so protect the device. No storage or transmission method can be guaranteed completely secure.
Children’s privacy
Buzzing Canvas is intended for creative users aged 16 and older and is not directed to children under 16. The characters, briefs and events are fictional. We do not ask users for a date of birth or operate a child profile system. If you believe a child has provided personal information through poster text or backup, contact sitak.viki.team08@gmail.com so we can discuss the available steps, subject to installation authorization and applicable law.
Changes to this policy
We may update this policy when the app's processing, features or hosting practices change. The current policy is available through the app's Settings and at the public privacy page. Its effective date identifies the version in force. Material changes will be reflected in an updated policy and, where appropriate, an in-app or release notice. We will not silently describe new collection as if it had always occurred.