Privacy policy
Last updated:
1. Data controller
LVL99 SASU, registered in France under number 107 637 951 R.C.S. Versailles, share capital 5 000,00 euros, is the data controller for LiveCanvas. Contact: livecanvas@lvl99.com.
2. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Your ATProto identifier (DID), handle and display name | Logging you in and showing your name to people you draw with | Performance of the service (contract) | While you are logged in (up to 30 days without use) |
| Access and refresh tokens for your account, stored encrypted | Acting on your behalf when you choose to post or send messages | Performance of the service (contract) | Until you log out, or 30 days without use |
| Login progress data | Completing a login securely | Performance of the service (contract) | Up to 1 hour |
A session cookie (__session) containing a random identifier |
Keeping you logged in. It is strictly necessary, so no consent is needed | Performance of the service (contract) | 30 days, or until you log out |
| Your Bluesky profile picture, downloaded by our server from Bluesky’s image servers | Offering it as your LiveCanvas avatar, after you log in or when you choose “Use Bluesky avatar” | Performance of the service (contract) | Not kept: passed straight to your browser |
| Your IP address and request details | Security, abuse prevention (login rate limits) and service logs | Legitimate interest (security) | Rate limits: 1 minute in memory. Hosting logs: as set by Google Cloud (typically 30 days) |
| Posts you choose to make (the message, and a picture of the canvas with its description) and invitation messages you choose to send, with the handles they mention or are sent to | Posting to Bluesky and sending invitations on your behalf | Performance of the service (contract) | Not kept: passed straight to your account provider. How many posts and invitations you send: 1 minute in memory (rate limit) |
| Session details: the session’s settings (including whether peers may post to Bluesky), the host’s identifier and handle, the handles of people the host invites, and the identifiers and handles of people who joined or were removed, with times | Running a drawing session: deciding who may join, and showing the host who is in it | Performance of the service (contract). For invited people who haven’t joined: our legitimate interest in letting hosts invite people | Until the host closes the session, or 5 minutes after the host’s app stops responding. Then deleted from our database, usually within 24 hours |
| Connection set-up messages, encrypted with the session’s password | Connecting the browsers of the people in a session | Performance of the service (contract) | Removed as soon as each person leaves the session or loses their connection |
| A temporary sign-in to the connection set-up service, with a random identifier that is not linked to your account | Making sure each connection can only reach its own session | Performance of the service (contract) | Deleted within 24 hours after it is created |
| Your IP address, and when and how much data our relay server passes on for you | Relaying session traffic, so the people in a session never see each other’s IP address; security | Performance of the service (contract) and legitimate interest (security) | Relay server logs: 7 days |
We do not use advertising or tracking cookies, and we do not sell personal data. Your browser never loads profile pictures from Bluesky’s servers: our server downloads them, so LiveCanvas does not share your IP address with Bluesky.
Your settings
The settings you choose in “My settings” are kept only in your own browser’s storage (local storage), not on our servers: your display name, avatar (resized to 200 × 200 pixels), colour, cursor, canvas control (including focus pen mode), notification and sound choices, and whether you dismissed the notice about how browsers delete offline sessions. The language and theme (light, dark or automatic) you choose are kept the same way, for everyone who uses LiveCanvas in that browser. They stay until you clear your browser’s data for LiveCanvas. Browser notifications are shown by your browser and device, only if you allow them; you can withdraw that permission in your browser’s settings at any time.
Brush presets
The brush presets you make or import are kept only in your own browser’s storage (IndexedDB), on your device, and are never sent to our servers: each preset’s settings, its brush shape image, its name, and its author’s name and handle (yours, for presets you make), with your account’s identifier (DID), so only you can use them in that browser. They stay until you delete them or clear your browser’s data for LiveCanvas. When you export your presets, they are saved to a file on your device, including the author names and handles; anyone you give that file to can see them.
When you draw offline without logging in, the brush presets you make or import are kept in your browser’s storage (IndexedDB) only while your canvas is open, with a random identifier for that canvas instead of an account identifier, and are never sent to our servers. Presets you make have “Guest” as their author, without a handle. They are deleted when you close the canvas or leave the page, or, if your browser closes before they can be deleted, the next time you draw offline without logging in in that browser.
Drawing sessions
When you host or join a session, the people in it see your handle, display name, avatar and colour, your drawing, your chat messages, and whether you’re away: when you choose “Away”, or after 10 minutes without using LiveCanvas, until you use it again. If you turn on “Show my cursor to others in the session”, they also see where your pointer is on the canvas, updated about once a second; cursor positions are never stored. The host also sees the handles of the people they invited, and whether each of them is connected or removed. Anyone in a session can keep what was drawn and said in it, for example with a screenshot, or by keeping the canvas after the session ends. The host, and other people in the session unless the host of a private session doesn’t allow it, can post a picture of the canvas to Bluesky.
Posting to Bluesky and invitations
You can choose to post to your Bluesky feed: to advertise a public session (with its link), or to share a picture of a session’s drawing. Before anything is posted, you see the message and can change it. By default, a post about a session mentions the handles of the host and everyone who connected to it, including people who have left; Bluesky notifies the people mentioned, and you can remove them from the message. When someone posts during a session, the people in it see a line in the chat linking to the post.
A host can send people they invited to a private session their invitation link as a Bluesky direct message, from the host’s account.
Our server sends the post (its message, the language LiveCanvas is shown in, the picture as a JPEG and its description) or the direct message to your account provider, which publishes or delivers it; its handling is governed by your account provider’s privacy policy. Posts on Bluesky are public. Our server does not keep posts, pictures or messages after sending them. To turn mentions into links and to find the account of the person an invitation is sent to, our server looks up the handles on Bluesky’s public API.
Drawings and chat messages travel between the browsers in the session, encrypted from end to end, through our relay server. The relay server cannot read them, and we do not store them. Until the host’s browser confirms it has received them, the drawing and messages you send are kept in your own browser’s storage, so they can be sent again after a lost connection; they are deleted when you leave the session. The host’s browser keeps the session’s drawing, messages and everyone’s latest display name, avatar, colour and away status in memory while the session runs, to catch up people who join later.
Offline sessions
Private offline sessions are kept only in your browser’s storage (IndexedDB), on your device, and are never sent to our servers: each one’s drawing (its layers, and other people’s drawing when it was a session you joined), a small picture of it, its canvas size, the dates it was created and last opened, and your account’s identifier (DID), so only you can open it in that browser. They stay until you remove them, until they are removed to make room (you can keep up to 20, and the one you opened least recently is removed first, after asking you), or until your browser deletes them: Safari deletes a site’s storage after 7 days without a visit (unless the site was added to the home screen), any browser may do so when the device runs low on space, and private windows delete it when they close. If you choose “Keep my drawings”, LiveCanvas asks your browser to keep them unless you clear its data.
When you draw offline without logging in, your drawing is only kept in your browser’s memory while the canvas is open: it is never stored in your browser’s storage or sent to our servers, and it is lost when you close the canvas or leave the page. We don’t collect any account information, and no settings are kept.
While you are in a session, the page’s address holds the session’s identifier, and its title holds the start of that identifier, the host’s handle and the date the session was created, so you can find it again. An offline session’s page address holds its identifier too, and its title holds the start of that identifier, your handle and the date it was created. Your browser keeps these in its history, on your device only, until you clear it. If you opened a private session’s invitation link, your invitation is kept in your browser tab’s storage until you close the tab, so reloading the page still lets you in.
3. Who processes your data
- Google Cloud and Firebase (Google Ireland Limited) host LiveCanvas in the europe-west1 region (Belgium) as our processor, including the session database, the connection set-up service (Firebase Realtime Database and Firebase Authentication) and our relay server. Your browser connects to Firebase directly during a session, so Google receives your IP address. Firebase Authentication may process data outside the European Union, under the European Commission’s standard contractual clauses.
- Your ATProto account provider (for example Bluesky Social PBC) handles your login, and receives posts and pictures you choose to post. Your use of that account is governed by its own privacy policy.
- Bluesky’s chat service (Bluesky Social PBC) receives the invitation messages hosts choose to send, and delivers them.
- Bluesky’s public API and image servers are used by our server to look up your public profile (handle, display name and the address of your profile picture), to download your profile picture when it is used as your avatar, and to look up the handles mentioned in posts and the accounts of people sent an invitation.
- Revolut: if you choose to donate, you pay on Revolut’s checkout page, which collects your payment details and handles the payment under Revolut’s own privacy policy. We only receive the details of your donation that Revolut gives us, which we use to keep our accounts.
- YouTube (Google Ireland Limited): some articles on our news pages embed YouTube videos using YouTube’s privacy-enhanced mode (youtube-nocookie.com). When you open such an article, your browser loads the video player from YouTube, which receives your IP address and browser details. YouTube may store information on your device, particularly once you play a video. YouTube’s use of this data is governed by Google’s privacy policy.
4. Your rights
Under the GDPR you can ask to access, correct or delete your data, object to or restrict its processing, and receive a copy of it. Email livecanvas@lvl99.com. Logging out deletes your tokens and session immediately. You can also complain to the CNIL (www.cnil.fr).
5. Changes
We will update this page when our data handling changes; the date above shows the latest version.