Collector Canvas

Privacy policy

Last updated: October 23, 2026

This policy describes how Collector Canvas handles information when you organize collections, connect a Google account, import listings, and export files. For privacy questions, contact rossbohner@gmail.com.

Information you put in the app

Collector Canvas stores the collection records you create or import, including item details, photographs, notes, research links, custom columns, price observations, and canvas layouts. Information is saved on your device so you can work locally. Recovery copies, downloaded picture previews, and backups can also remain on the device.

Google account information

Google connection is optional. When you sign in, Google provides account identity information, including an account identifier, email address, and basic profile information available through Google Sign-In. The app uses account information to identify the connected account and keep its local workspace separate from other accounts.

Google authorization tokens allow the app to carry out the operations you authorize. The desktop app protects saved Google credentials using operating-system-backed encryption. The iOS Google Sign-In SDK manages credentials in native secure storage. Google credentials are excluded from collection exports. Ordinary collection files and exports are not encrypted by Collector Canvas itself; device security, file permissions, and any backups you make also affect their protection.

Google Sheets and Drive access

Google Sheets: the app can create collection spreadsheets and read and update existing spreadsheets that you choose to connect. This includes imported fields, mapped records, pictures represented by file links, and app-managed backup or layout information. Google Sheets permission covers your spreadsheets; the app uses the spreadsheets you connect for these features.
Files used with the app: the app uses per-file Drive access to create collection picture folders, upload pictures, discover app-authorized files, and read files you authorize.
Optional automatic pictures: if you enable this feature, the app requests read-only Drive access. That permission can see and download all Drive files available to your Google account. Collector Canvas uses it to retrieve existing picture files linked in your collection, including pictures outside the app's per-file grant. It does not use this read-only permission to modify or delete files.

The native desktop and iOS Google integration communicates directly with Google's services. It does not route Google account credentials, spreadsheet contents, or Drive picture downloads through a Collector Canvas-operated application server. Connected spreadsheets and pictures remain subject to the sharing settings you apply in Google. Connecting the app does not automatically make them public.

How Google information is used

Google information is used to provide account connection, collection import and synchronization, and picture display. Collector Canvas does not sell Google user data, use it for advertising, or use it to train generalized AI models. Collector Canvas's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Listing imports and optional AI

When you import a public listing URL, the app requests content from that website. That website receives normal connection information associated with the request. Opening external links also connects you to the destination website.

If you enable AI listing analysis and configure an OpenAI API key, listing title, description, and specification text, together with relevant collection field names and types, are sent to OpenAI to suggest structured values. This includes any text you choose to enter into the analysis fields. The feature does not automatically send your full collection, collection pictures, or Google authorization credentials. You can review the source text and suggested values, or use local parsing without AI.

AI requests disable response storage through the API's store: false setting. This setting does not override OpenAI's own data-handling policies. An optional external MCP client can submit listing text and field definitions when you enable MCP access; that client is governed by its own data practices.

Files you export or share can contain the collection information and pictures included in those exports. You decide where to save or send them. If you contact support, the recipient receives the information you choose to send, such as your email address, message, and any attachments. Avoid sending Google passwords, authorization tokens, or API keys.

Retention and deletion

Local collection data and recovery copies are retained on your device until you remove them. Signing out stops the account connection but retains local collections. To remove all local copies, remove the app's stored data and any separate backups or exports you created. Your device's backup service may keep its own copies.

Google Sheets and Drive files remain in your Google account until you remove them there or use an applicable deletion option in the app. Removing a picture from a collection does not automatically delete the original Drive file. Disconnecting or uninstalling the app does not delete cloud files.

You can revoke Collector Canvas's Google access through Google Account third-party connections. Turning automatic picture access off stops its use in the app; to remove Google's underlying permission grant, revoke the connection in your Google Account. Revocation does not erase previously downloaded local data or cloud files.

This website and policy updates

The product page includes a read-only browser preview of Collector Canvas with a bundled sample collection. Browsing, search, filters, zoom, and comparisons run in your browser. The preview does not save a collection workspace or upload collection data. Adding, editing, rearranging, deleting, account connections, importing, and exports are disabled. Reloading returns to the original sample. Opening research links takes you to the linked website.

These pages do not include advertising, analytics scripts, or a sign-in form. The hosting and DNS providers may process ordinary request and security logs when serving them. This policy may be updated when app features or data practices change; the date above identifies the latest revision.