Privacy policy

Scope

This policy covers the crocha.app website and editor (the “service”), including use without signing in. It also applies to people viewing a chart through a share link you created.

What we collect

• Account data — When you sign in with Google or GitHub we receive that account's email, display name and avatar URL; with an email link, only the email. We request no other permissions and read nothing else in those accounts.
• Your charts — Charts you draw while signed in (content, title, thumbnail, version history) are stored in our database and visible only to you; anyone with a share link you create can view that chart read-only. While signed out, charts stay in your own browser (localStorage) and are never uploaded.
• Custom symbols and images — Symbols you draw and images you place on the canvas are part of the chart and stored with it.
• Feedback — What you submit through the in-site feedback form (purpose, device, comments, optional email), with the interface language and browser information at the time.
• Cookies — One session cookie keeps you signed in and one remembers your interface language; the sign-in flow sets short-lived cookies of its own. There are no advertising cookies.
• Usage statistics — During the beta we use Google Analytics to see which pages are used and where visitors come from, aggregated anonymously by Google and never linked to your account.
• Server logs — The host (Vercel) keeps request logs (URL, time, IP, browser) briefly for debugging; on the beta plan about one hour.

How we use it

• To create and maintain your account and show your name and avatar.
• To store and sync your charts and provide version history, the trash and share links.
• To send sign-in links you ask for.
• To read feedback and fix problems; for follow-up we only use the email you left in the feedback.
• To see overall usage and decide what to build next.

We do not use this data for personalised advertising, do not build user profiles and do not use it to train any model.

Who we share it with

We do not sell, trade or rent your data. These providers host or process data on our behalf and may not use it for their own purposes:

• Vercel — Website hosting and server logs.
• Supabase — Database (accounts, charts, versions, feedback) and thumbnail storage.
• Resend — Delivery of sign-in link emails.
• Google Analytics — Anonymous usage statistics.
• Google Forms — A copy of each feedback submission is mirrored to our Google Form for easier review; the database copy is the record.

Beyond that we disclose data only when the law requires it. Charts you share by link go to whoever you choose to give the link to.

How long we keep it

• Account and charts — For as long as your account exists. Charts in the trash are purged after 30 days, or at once if you delete permanently; versions, thumbnails and share links go with the chart.
• Feedback — Until the beta has ended and the feedback has been worked through; the email in it is used only to reply.
• Sign-in links — Valid for 15 minutes, then void, also once used.
• Server logs — About one hour.

Your rights and controls

• View and export — Your charts are always available in the editor and can be exported as SVG or PNG.
• Delete charts — Delete from My files at any time; the trash lets you restore or delete permanently.
• Delete your account — During the beta, ask through the in-site feedback form from the email you sign in with, and we will delete the account and all its data within 7 days; a Settings option will follow.
• Share links — A share link stops working the moment the chart goes to the trash.
• Cookies — You can block or clear cookies in your browser; clearing the session cookie signs you out, clearing the language cookie returns to your browser language.
• No account — The editor works fully without signing in; data then stays in your browser only.

Children

The service is not directed at children under 16. If we learn that we hold account data of a child collected without parental consent, we delete it promptly.

Security

The whole site uses HTTPS; there are no passwords to store; sign-in tokens are used only to sign in and are never shown or passed on; the database and storage are reachable only from the server. No system is perfectly secure; if a breach occurs we will notify affected users as soon as we know.

Other sites and services

The site links to other sites (for example the Google and GitHub sign-in pages and the feedback form). They have their own privacy policies, which this one does not cover.

Where data is stored

The providers above run data centres that may be outside your country (mainly the United States and Asia-Pacific). By using the service you agree to your data being stored and processed there.

Changes to this policy

For material changes we update the date at the top of this page and note it on the home page or at sign-in. Continuing to use the service means you accept the updated policy.

Contact

For any privacy question or request, use the feedback form at the bottom of the home page or in the editor's help menu, and leave an email so we can reply. Social accounts will be listed in the home page footer once they exist.