Privacy Policy
Last updated: 2026-10-20 · Türkçe
HyperCanvas ("we", "us") is a web design editor at hypercanvas.space for creating social media posts, posters and short videos, and for publishing or scheduling them to the user's own social media accounts. This policy explains what data we collect, why, how long we keep it and how you can delete it.
Contact for privacy questions and deletion requests: mefezedigital@gmail.com
1. Data we collect
| Data | When | Why |
|---|---|---|
| Email address, name, a one-way hash of your password | When you create an account | To sign you in and contact you about your account |
| Designs, projects, version history, uploaded images and fonts, brand kits | Only when you save to the cloud | To store and show your work across devices |
| Browser type, device info, IP address | When you sign in | Security (session management, abuse prevention) |
| Connected social account profile: account id, display name, username, profile picture | When you connect a social account | To show which account a post goes to |
| Access and refresh tokens issued by the social network | When you connect a social account | To publish the posts you create, at the time you choose |
| Post results and basic metrics (post URL, status, reach, views, engagement) | After you publish | To show you how your post performed |
If you use HyperCanvas without an account, your designs stay on your device and are not sent to our servers.
2. How we use connected social media accounts
You can connect Facebook Pages, Instagram professional accounts, Threads, TikTok, YouTube, LinkedIn, Pinterest, X and Bluesky in Publishing Hub. Sign-in always happens on the network's own page; we never see your password.
We use the access a network grants only for the actions you ask for:
- publish a design you created to the accounts you select, immediately or at the time you schedule;
- add the first comment you wrote, where the network supports it;
- read the status and basic metrics of posts published through HyperCanvas so we can show them to you;
- show your connected account's name and picture.
We do not read your messages, follow, like or comment on your behalf beyond what you explicitly request, and we never post without your explicit action (pressing "Publish" or scheduling a post).
Tokens are stored encrypted with AES-256-GCM and are only decrypted on our server when a request you made is carried out.
3. Google user data (YouTube)
If you connect a YouTube channel, HyperCanvas requests these Google OAuth scopes:
youtube.upload: to upload the video you created in HyperCanvas to your channel, with the privacy setting you choose;youtube.force-ssl: to post the first comment you wrote under a video you published through HyperCanvas, to list your channel's videos (title, thumbnail, view count) so you can pick one for a thumbnail test, and to set the thumbnails you designed on the video you picked;yt-analytics.readonly: to show impressions and click-through rate for the thumbnail test you started.
We do not edit titles, descriptions or comments of your other videos, and we never delete videos, comments or ratings.
HyperCanvas's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
- we use Google user data only to provide the features described above, which you can see in the app;
- we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or acquisition with your notice;
- we do not use it for advertising, and we do not sell it;
- no person reads it unless you ask us to (for support), it is needed for security or to comply with law;
- we do not use it to train artificial intelligence or machine learning models.
By connecting YouTube you also agree to the YouTube Terms of Service. Google's handling of your data is described in the Google Privacy Policy. You can revoke HyperCanvas's access at any time at Google security settings.
4. TikTok
If you connect TikTok, we request user.info.basic (your display name and avatar) and video.publish (to publish the video or photos you created, with the privacy level, interaction settings and commercial content disclosure you choose in the post composer). Posting only happens after you confirm, and you can revoke access in TikTok under Settings → Security → Manage app permissions.
5. Meta (Facebook, Instagram, Threads)
If you connect Facebook or Instagram, we request permissions to list the Pages and Instagram professional accounts you manage, publish the content you create to the ones you select, add the first comment you wrote and read insights of posts published through HyperCanvas. You can remove HyperCanvas in Facebook under Settings → Apps and Websites, or in Instagram under Settings → Apps and websites. When you do, Meta notifies us and we delete the related accounts and tokens automatically.
6. LinkedIn
If you connect LinkedIn, we request openid and profile (your name and picture) and w_member_social (to publish the post you created to your profile). You can revoke access in LinkedIn under Settings → Data privacy → Permitted services.
7. Service providers
| Provider | Purpose | Location |
|---|---|---|
| Render | Application hosting | Frankfurt, Germany |
| Supabase | Encrypted database backups and file storage | Ireland (EU) |
| Anthropic | AI design assistant, only if you use it and agree | United States |
| Google (Gemini API) | AI design assistant when the platform runs it on Gemini, only if you use it and agree. On Gemini's free tier Google may use the content to improve its products; the consent screen says so. | United States |
| Google Fonts | Loading fonts | United States |
| Stripe, iyzico, PayTR | Payments for paid plans; card details never reach us | — |
We do not sell personal data and we do not share it with advertisers.
8. Retention and deletion
- Connected social accounts and their tokens are kept until you remove the account, revoke access on the network, or delete your HyperCanvas account. Removal deletes them immediately and cancels scheduled posts for that account.
- Designs and uploads are kept until you delete them or your account.
- You can delete your account and all its data in Account settings, or by emailing mefezedigital@gmail.com. We complete requests within 30 days.
- Facebook and Instagram users can follow a deletion request on the data deletion page.
- Invoice records are kept for the period required by Turkish tax law.
- Posts you published stay on the social network; delete them there.
9. Security
All traffic uses HTTPS. Social tokens are encrypted at rest with AES-256-GCM, passwords are stored as one-way hashes, and access to production systems is limited to the operator.
10. Children
HyperCanvas is not directed to children under 16 and we do not knowingly collect their data.
11. Changes
We will post changes on this page and update the date above. For significant changes we will notify account holders by email.