Privacy Policy
Last updated: October 31, 2026
Architecture: Local-First Studio vs. Cloud Service
PinePaper operates under a dual architecture that separates local client-side creative work from authenticated cloud services:
- PinePaper Studio (
https://pinepaper.studio) — Local-First Editor: The browser-based vector editor runs entirely in your local browser sandbox. Your canvases, vector paths, artwork, keyframe timelines, and project configurations are stored on your device via browser memory and IndexedDB. No canvas content, drawings, or local project files are uploaded to our servers or processed externally simply by drawing, editing, or playing animations in Studio. - PinePaper Cloud (
https://cloud.pinepaper.studio) — Hosted Services & MCP API: Cloud services provide authenticated accounts, prepaid billing, cloud rendering containers for high-resolution video exports, Model Context Protocol (MCP) tool execution, and multi-model AI inference routing. Data is transmitted to PinePaper Cloud only when you deliberately sign in, purchase credits, invoke Cloud rendering, or make API/AI requests.
1. Information We Collect
1.1 Account Information
When you sign in with Google, we receive:
- Email address
- Name (if provided by OAuth provider)
- Profile picture URL (if provided)
- OAuth provider user ID
1.2 Payment Information
Payments are processed by Stripe. We store:
- Stripe customer ID (linked to your account)
- Transaction history (amounts, dates, credit balance)
We never store credit card numbers. Stripe handles all payment data.
1.3 Usage Data
| Data | Purpose | Retention |
|---|---|---|
| API requests | Billing, abuse prevention | 90 days |
| Credit transactions | Billing history, tax records | Our ledger keeps every purchase, charge and refund for as long as it is a financial record we must keep; it is not deleted when you delete your account. Stripe keeps its own payment records. |
| Error reports | Debugging | The failing request's path, your browser type, and your account id and email go to our error tracker (Sentry) and are kept for its retention period; request logs are kept by our host (Cloudflare) for its log retention period |
| IP addresses | Rate limiting, security alerts, proof of privacy requests | Rate limiting and security alerts keep a keyed hash of the address, not the address: about 2 minutes and 30 days. The record of a privacy request you make (access, export, deletion) keeps the address: 7 years. Our request logs do not record it. |
| Device fingerprints (SHA-256 of IP + browser prefix) | Sign-in anomaly alerts | Capped at the 25 most recent devices per account; persist until you delete your account or remove the device |
| Audit records (API key revocation, privacy requests, security events) | Compliance, fraud, dispute resolution | Privacy requests: 7 years. Security events: 90 days. API key revocations: kept in our file storage (R2) |
| Passkey credentials (WebAuthn public key + metadata) | Sign-in and step-up authentication | Until you remove the device or delete your account |
1.4 BYOK API Keys
If you store your own API keys (BYOK):
- Keys are encrypted with AES-256-GCM before storage; per-user PBKDF2 salt
- We never log or view your decrypted keys
- Keys are deleted when you remove them or close your account
2. How We Use Your Information
- Provide the Service: Process API requests, manage credits, authenticate you
- Billing: Process payments, track credit usage
- Security: Prevent abuse, detect fraud, rate limiting
- Improvements: Aggregate analytics to improve the service
- Communication: Send service updates, security alerts (you can opt out of marketing)
3. Information Sharing & Subprocessors Data Map
We share information with third-party service providers and subprocessors strictly to deliver the Service. How your AI requests are handled depends on whether you use Platform Credits or Bring Your Own Key (BYOK):
| Provider / Subprocessor | Location | What it does, and what it receives | Terms that govern it |
|---|---|---|---|
| Cloudflare, Inc. | United States & global edge | Hosting, edge compute, data storage (KV and Durable Objects), file storage (R2), the render containers, CDN and DDoS protection, Web Analytics, and Workers AI (speech-to-text, translation, image detection, and Clef, Cloudflare's model that routes a design request to the right way of making it: it receives the request's text). | Cloudflare's Data Processing Addendum (the standard self-serve DPA). |
| Stripe, Inc. | United States | Payments: your email, billing details and purchases. Card numbers go to Stripe directly and never reach us. | Stripe's terms and privacy policy. We keep your purchase and credit records for as long as your account exists, and for as long as tax law requires after that. |
| Google LLC (Gemini API, Lyria, Google Sign-In, Google Analytics) | United States & global | With platform credits: Gemini models for designs and films, Gemini image models and Gemini Omni Flash when you ask for a generated picture or clip (and the check that a generated picture carries no lettering), Gemini text-to-speech for voice-overs, Lyria music. Google Sign-In if you choose it. Google Analytics only if you allow analytics cookies. | Google's API terms and privacy policy. |
| Anthropic, PBC | United States | Claude models for designs and films — with platform credits (PinePaper's access) or with your own key (BYOK). Receives the request and the design context it needs. | Anthropic's commercial terms; for BYOK, your own agreement with Anthropic. |
| OpenAI, L.L.C. | United States | GPT models, with platform credits where offered or with your own key (BYOK). | OpenAI's API terms; for BYOK, your own agreement with OpenAI. |
| xAI Corp. | United States | Grok models, with platform credits where offered or with your own key (BYOK). | xAI's API terms; for BYOK, your own agreement with xAI. |
| Cerebras Systems Inc. and Groq, Inc. | United States | Open models (for example gpt-oss) served on platform credits. | Cerebras's and Groq's API terms. |
| OpenRouter, Inc. | United States | A gateway to further models, with platform credits where offered or with your own key (BYOK); it forwards your request to the model you chose. | OpenRouter's terms and those of the model provider it forwards to. |
| ElevenLabs, Inc., Cartesia AI, Stability AI | United States / United Kingdom | Voices and sound effects with your own key (BYOK). Receives the text or prompt to voice. | Your own agreement with that provider. |
| Pexels | Germany (Canva) | Stock photo and video search: receives your search words. | Pexels's API terms. |
| Pixabay | As stated in its privacy policy | Stock photo and video search, only where it is configured: receives your search words. The previews you see load from Pixabay's servers (video previews from the host it uses for them). | Pixabay's API terms. |
| Iconify | As stated in its privacy policy | Icon and illustration search: receives your search words, and words from a design request when we look for artwork to place in that design. The icon previews you see load from Iconify's servers. | Iconify's API terms. |
| Openverse (WordPress Foundation) | United States | Openly licensed image and sound search: receives your search words. | Openverse's API terms. |
| Spider (spider.cloud) | As stated in its privacy policy | Reads public web pages when a request asks for research: receives the pages' addresses and the search words. | Spider's terms. |
| Functional Software, Inc. (Sentry) | United States | Error reports: the failing request's path, browser type, and your account id and email. | Sentry's terms and DPA. |
| GitHub, Inc. | United States | GitHub sign-in, if you choose it. | GitHub's privacy statement. |
| Resend, Inc. / Twilio SendGrid | United States | Transactional email: sign-in links, receipts, security notices and design-ready notices you ask for. | Their terms and privacy policies. |
We never sell your personal data and do not share it for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA).
4. Data Security
- All data transmitted over HTTPS (TLS 1.3)
- API keys encrypted with AES-256-GCM
- Session tokens use HMAC-SHA256
- Cloudflare DDoS protection
- Regular security audits
5. Your Rights
You have the right to:
- Access: Request a copy of your data
- Correction: Update inaccurate information
- Deletion: Close your account and delete your data
- Portability: Export your data in a standard format
- Opt-out: Unsubscribe from marketing emails
Contact support@pinepaper.studio to exercise these rights.
6. Cookies and Analytics
We use:
- Session cookies: To keep you logged in (HttpOnly, Secure)
- Google Analytics 4: Aggregate usage statistics (anonymized)
- Campaign cookies (
pp_ft,pp_lt): Only if you allow analytics cookies. They remember which link or campaign first and last brought you here (campaign name, source, the referring site's name and the page you landed on; the ad click identifier only if you also allow marketing cookies), for 90 days. When you create an account they are saved with it so we can tell which campaigns bring customers. They are included in your data export and deleted with your account.
You can disable cookies in your browser settings, but this may affect functionality.
7. Children's Privacy
The Service is not intended for children. We do not knowingly collect data from anyone under 16 years of age. (This threshold is set above the COPPA floor of 13 to align with the higher of US and EU member-state requirements.) If you believe a minor has provided us with personal data, contact us immediately and we will delete it.
8. International Data Transfers
Your data may be processed in:
- Canada (operating entity)
- United States (Cloudflare, Stripe, certain LLM providers)
- European Union (Cloudflare edge servers)
- Wherever upstream LLM providers operate (when you use the LLM features)
For transfers of personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States and other jurisdictions not deemed adequate, we rely on the European Commission's Standard Contractual Clauses (SCCs) and equivalent UK and Swiss data transfer mechanisms with our processors. Copies of the SCCs as incorporated into our processor agreements are available on request to support@pinepaper.studio.
9. Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion |
| Credit balance | Until account deletion |
| Transaction history | Our ledger: kept as a financial record, including after account deletion. Stripe keeps its own payment records. No card data is ever stored by us. |
| Usage logs | 90 days |
| Error reports | Our error tracker's (Sentry) and host's (Cloudflare) retention periods |
| BYOK API keys | Until you delete them |
| Passkey credentials | Until you remove the device or delete your account |
| Device fingerprints (login alerts) | 25 most recent per account; cleared on account deletion |
| Audit records | Privacy requests 7 years; security events 90 days; API key revocations kept in R2 |
| Conversations | Until you delete the conversation or your account |
| Chat turn traces (what each turn sent the model, for problem reports) | 30 days |
10. Changes to This Policy
We may update this Privacy Policy. Material changes will be communicated via email or service notification. Continued use after changes constitutes acceptance.
11. Contact Us
Questions about this Privacy Policy?
- Email: support@pinepaper.studio
- Website: pinepaper.studio
12. GDPR Information (EU/UK/EEA Users)
For users in the EU, UK, or EEA, PinePaper Studio acts as the data controller. The legal bases for processing are:
- Contract (Art. 6(1)(b)): Processing necessary to provide the Service you sign up for
- Legitimate interest (Art. 6(1)(f)): Security, fraud prevention, abuse detection, sign-in anomaly alerts, service improvement
- Consent (Art. 6(1)(a)): Non-essential analytics cookies, marketing communications
- Legal obligation (Art. 6(1)(c)): Tax, accounting, and compliance retention
You may exercise your rights to access, rectification, erasure, restriction, portability, and objection by contacting support@pinepaper.studio. You may also lodge a complaint with your local data protection authority.
13. California Residents (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what categories of personal information we collect, the sources, purposes, and recipients
- Access the specific pieces of personal information we hold about you
- Delete your personal information (subject to legal retention exceptions)
- Correct inaccurate personal information
- Opt out of any sale or sharing of personal information for cross-context behavioral advertising
- Non-discrimination for exercising any of these rights
We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are defined under California law. To exercise any right, email support@pinepaper.studio with the subject line "California Privacy Request". We will verify your identity using information already associated with your account.
14. India Residents (DPDPA 2023)
If you are in India, your rights under the Digital Personal Data Protection Act, 2023 include access, correction, completion, updating, erasure, and grievance redressal. To exercise these rights, contact our Grievance Officer:
- Grievance Officer: To be designated prior to general availability
- Email: support@pinepaper.studio (subject line: "DPDPA Request")
We respond to verified requests within 30 days. You may also approach the Data Protection Board of India if your request is not addressed.
15. Data Breach Notification
In the event of a personal data breach likely to result in a risk to your rights, we will notify the appropriate supervisory authority within 72 hours where required (e.g. GDPR Article 33), and notify affected users without undue delay where the breach is likely to result in a high risk to rights and freedoms. Where required by law (including the California CCPA and India's DPDPA), we will provide notice via email to the address on file and a notice posted at https://cloud.pinepaper.studio.
16. Cookie Consent
The cookie banner that appears on first visit lets you choose whether to allow non-essential cookies (currently: Google Analytics 4). Essential session cookies (authentication, CSRF, step-up) are set without consent because they are strictly necessary to provide the Service you requested.
17. Operating Entity
PinePaper Cloud Studio is operated by PinePaper Studio Inc. (Studio PinePaper Inc.), a corporation registered in Ontario, Canada (Ontario Corporation Number 1001761095). For privacy or data protection inquiries, contact our team at support@pinepaper.studio.