← ThinkCanvas

Privacy Policy

Last updated: 2026-06-21

This Privacy Policy explains how ThinkCanvas (“ThinkCanvas”, “we”, “us”), operated by Mok Ching Wang, an individual based in Hong Kong, collects, uses, and shares information when you use our website and application (the “Service”). If you do not agree with this policy, please do not use the Service. You can reach us at [email protected].

1. Information we collect

  • Account information — the email address you use to sign up, and authentication data managed by our auth provider.
  • Content you create — the boards, graphs, nodes, text, and uploads you make in the Service.
  • AI prompts and outputs — the prompts you send to the AI and the responses it generates, including the board content provided as context.
  • Usage data — basic telemetry about how you use the Service (for example, feature usage and error events).
  • Technical data — IP address, device and browser information, and essential cookies needed to keep you signed in.

2. How we use your information

  • To provide, operate, and maintain the Service and your account.
  • To generate AI responses to your prompts.
  • To secure the Service, prevent abuse, and debug problems.
  • To communicate with you about your account (for example, email confirmation).
  • To improve the Service.

We do not sell your personal information.

3. AI processing and service providers

To run the Service we share the data described above with third-party service providers, each only as needed to provide their part of the Service. These fall into the following categories:

  • Hosting and database providers — to run the application and store your account and board content.
  • Email-delivery providers — to send transactional emails such as sign-up confirmation.
  • AI / machine-learning providers — to generate AI responses. Your prompts and the board content used as context are sent to third-party AI providers to produce those responses.
  • Content-delivery and DNS providers — to serve the application reliably and securely.

These providers process data on our behalf under their own terms and security practices. The specific providers we use may change as the Service evolves, and some may be located outside your country (see “International data transfers” below). We will update this policy if our categories of providers change.

4. Legal bases (EEA/UK users)

Where the GDPR or UK GDPR applies, we process your information on the basis of: performance of our contract with you (to provide the Service); our legitimate interests (to secure and improve the Service); your consent where required; and to comply with legal obligations.

5. California privacy rights

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know what personal information we collect, to request deletion, and to not be discriminated against for exercising your rights. We do not sell or “share” personal information as those terms are defined under California law.

6. Cookies

We use only essential cookies required to keep you signed in and to operate the Service. We do not use advertising or third-party tracking cookies, so no cookie-consent banner is shown.

7. Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the Service. You can request deletion of your account and associated data by emailing [email protected]; we will delete it within a reasonable period, subject to any legal retention requirements.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us at [email protected].

9. International data transfers

We are based in Hong Kong and use providers located in various countries. Your information may be processed outside your country of residence, including in jurisdictions whose data-protection laws differ from yours.

10. Children

The Service is not directed to children under 16, and you must be at least 16 years old to use it. We do not knowingly collect personal information from children under 16.

11. Security

We take reasonable measures to protect your information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you.

13. Contact

Questions about this policy? Email [email protected].