Skip to content

Legal

Privacy policy

Draft policy. This text is a starting point and hasn’t been reviewed by a lawyer. The operator of this Canopy deployment must review it and fill in the bracketed details before relying on it.

Last updated: [date]. Operator: [legal name and address]. Contact: [privacy contact email].

What we collect

Account data. Your email address (private — never shown on your profile), your sign-in method, and whether your email is verified. If you sign in with Google, we receive your name, email, and profile photo from Google.

Profile data you choose to share. Username, display name, bio, avatar, and social links. These are public.

Content. Mods, releases, screenshots, comments, votes, follows, and reports you create.

Technical data. To count downloads fairly we combine your IP address and browser user-agent with a secret salt and store only a one-way hash, kept for up to three days. Rate-limit records are kept for a short time to prevent abuse. Our hosting providers keep standard server logs.

We don’t sell personal data, run third-party advertising, or use tracking cookies. Authentication uses Firebase, which stores a session in your browser’s local storage.

Why we use it

To run your account, show your public profile and content, prevent spam and abuse, scan uploaded files for malware, and keep the platform safe.

Service providers

  • Google Firebase — authentication and database.
  • Cloudflare R2 — file storage.
  • [Configured malware scanner, e.g. VirusTotal] — uploaded mod files are sent to the scanner. Files submitted to some scanners (including VirusTotal) may be shared with security researchers under that service’s terms.
  • GitHub — public repository data is fetched when you browse linked source code.
  • [Hosting provider] — application hosting.

Your choices

You can edit your profile at any time and delete your account from Settings. Deleting your account removes your profile and mods and anonymises your comments, as described on the settings page. Moderation records keep only an internal ID.

Depending on where you live you may have rights to access, correct, export, or delete your data. Contact [privacy contact email].

Children

Canopy isn’t directed at children under 13 [or the minimum age in your jurisdiction]. If you believe a child has created an account, contact us and we’ll remove it.

Changes

We’ll post changes here and update the date above.