Privacy Policy

Last updated: April 10, 2026

CodeDrop ("we", "our", "the App") is a Canva app operated by CanvasKit Co. This policy explains what data we collect, why, and how we protect it.

1. Data We Collect

We collect the minimum data needed to operate the App:

• Canva User ID — a unique identifier provided by Canva when you open the App. We use this to track your usage quota and subscription status. We do not receive your name, email, or Canva account details.
• Usage Counts — the number of HTML-to-Canva conversions you have performed in the current billing period.
• Subscription Data — if you upgrade to a paid plan, we store your Stripe customer ID, subscription ID, plan status, and billing period dates. Payment card details are handled entirely by Stripe and are never stored on our servers.

2. Data We Do Not Collect

• We do not store, log, or transmit the HTML or CSS you paste into the App. All conversion processing happens in your browser.
• We do not collect your name, email address, IP address, or any other personal information beyond your Canva User ID.
• We use privacy-focused, cookie-less analytics (Umami) to understand website traffic. We do not use cookies or collect any personal information.

3. How We Use Your Data

• To enforce free-tier and paid-tier conversion limits.
• To manage your subscription status (active, cancelled, expired).
• To prevent abuse of the service through rate limiting.

4. Where Your Data Is Stored

User and subscription data is stored in a Supabase-hosted PostgreSQL database. Row-level security (RLS) is enabled so each user can only access their own records. Data is encrypted in transit (TLS) and at rest.

5. Third-Party Services

We use the following third-party services:

• Canva Apps SDK — provides the Canva User ID and enables the App to place elements on your canvas. Governed by Canva's Privacy Policy.
• Stripe — processes payments for paid plans. Governed by Stripe's Privacy Policy. We never see or store your payment card details.
• Supabase — hosts our database. Governed by Supabase's Privacy Policy.
• Umami — provides privacy-focused, cookie-less website analytics. Governed by Umami's Privacy Policy.

6. Data Retention

We retain your usage data for as long as your account exists. If you uninstall the App from Canva and wish to have your data deleted, contact us at support@canvaskit.co and we will remove your records within 30 days.

7. Data Sharing

We do not sell, rent, or share your data with third parties for marketing purposes. Data is only shared with the third-party services listed above to the extent necessary to operate the App.

8. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us and we will delete it.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the App after changes constitutes acceptance of the revised policy.

10. Contact

For privacy questions or data deletion requests, email us at support@canvaskit.co.