Design Canvas is a product of Speech Bubble Marketing Limited, a company registered in England and Wales, trading as Design Canvas. This policy explains what personal data we collect, why we collect it, and how you can exercise your rights. Questions or requests: charlie@ellington.design.
We are the data controller for the data described below. We aim to collect as little as we need. Design Canvas is in public beta; if what we collect changes, we’ll update this page and the “Last updated” date above.
1. Scope
This policy covers the Design Canvas website at designcanvas.app and the Design Canvas Mac app that you download from it.
2. What we collect, and why
When you submit the email form (for non-Mac visitors who want a download link): we collect your email address, your browser’s user-agent, a one-way hash of your IP address, and your approximate country and city (derived from the IP). We use this to email you a link via our email provider (Resend) and to notify Charlie. The record is stored in Vercel Blob.
When you click Download Beta: we record a one-way hash of your IP address, approximate country and city, your user-agent, a PostHog anonymous ID (if present), and a timestamp. This is stored in Vercel Blob and used for one purpose: matching your web session to your first app launch so that analytics aren’t double-counted.
Product analytics: we use PostHog (hosted on the EU cloud) to count named events like page views, downloads, and form interactions. We do not use autocapture and we do not record session replays. PostHog sets an anonymous identifier cookie in your browser that lasts about a year. We also capture client-side exception traces to help us fix bugs.
The Mac app: when the app is running, it checks for updates by fetching /appcast.xml from this site (Sparkle’s standard mechanism). This request carries your app version and a generic user-agent. The app also sends the same kinds of named events to PostHog. We may add crash diagnostics (Sentry) in future; if we do, we’ll update this page before switching it on.
Server logs: our host (Vercel) keeps short-term request logs that may include IP addresses and user-agents. We use these only for security and debugging.
3. Legal bases (UK/EU GDPR)
- Legitimate interests — running anonymous analytics, keeping the service secure, and understanding how people use Design Canvas. You can object at any time; see section 5.
- Performance of a contract — fulfilling your download request.
- Consent — if we ever add a marketing email list, we’ll ask for opt-in first. We don’t run one today.
4. Who we share data with
We use a small set of processors:
- Vercel — hosting, edge logs, and Vercel Blob (storage for email and download records).
- Resend — sending the download-link email and our own operational notifications.
- PostHog (EU) — product analytics; data stays within the EU.
We don’t sell data and we don’t share it for advertising. If a third party (for example, a solicitor or law enforcement) compels us to disclose something, we’ll do the legal minimum.
5. Your rights
Under UK and EU GDPR you can ask us to give you a copy of your data, correct it, delete it, or stop processing it. Email charlie@ellington.design with the email address you used and we’ll respond within 30 days.
If you’re unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local EU data-protection authority.
6. Retention
While Design Canvas is in public beta, we keep email and download records indefinitely so we can analyse early traction. We’ll publish specific retention windows when we exit beta. You can request deletion at any time (see section 5).
7. Cookies
We use one non-essential cookie: the PostHog anonymous identifier described in section 2. Visitors from the UK, EU, EEA, and Switzerland see a short banner that lets you reject this cookie; rejecting it stops PostHog from capturing anything about you. Your choice is remembered in a small cookie called dc_cookie_opt.
8. International transfers
Our processors are set up so your data stays inside the UK/EU wherever possible. Any transfers are covered by standard contractual clauses or equivalent safeguards.
9. Children
Design Canvas is a developer tool. It isn’t directed at anyone under 16 and we don’t knowingly collect data from children.
10. Changes to this policy
We’ll update this page and the “Last updated” date when anything material changes. For significant changes, we may also post a notice on the home page.
11. Contact
Speech Bubble Marketing Limited (trading as Design Canvas), registered in England and Wales. For any privacy question or request, email charlie@ellington.design.