Privacy Policy

Effective and last updated October 29, 2026

OneCanvas is a photo exhibition app: you capture moments, hang them in 3D exhibition rooms and piece together a painting with other people. The app is developed and operated by OneCanvas (“we”). This policy explains what data we collect, what we use it for, who we share it with and what rights you have.

1. Data we collect

1.1. Account information

You can view community rooms, Public rooms and the photos in them without an account. To hang photos, heart, report, block, create a room or open one by code, you sign in to OneCanvas with Apple or Google. The app never receives your password.

• Sign in with Apple: an identifier Apple issues for OneCanvas only, plus your name and email if you choose to share them. Apple sends the name and email only on your first sign-in. If you choose “Hide My Email”, we receive only a relay address created by Apple.
• Sign in with Google: your Google account ID, name, email address and a link to your Google profile picture.

When you sign in, the app sends the token Apple or Google issues to Supabase, our server provider, which creates and verifies your OneCanvas account. The server stores the information above, along with how you signed in, when the account was created and when you last signed in. To protect your sessions, Supabase also records the IP address and app identifier (user agent) of each sign-in. On your device, the app keeps your session and shows your name on the Profile tab.

In Profile → Edit profile, you can change your display name and profile photo. The name is stored in your profile on the server, in place of the name Apple or Google provided, and other people see it on your personal rooms (“…’s room”). A profile photo you choose is cropped square, scaled down to at most 512 pixels a side and stored on our Supabase servers; only your account can download it, and other people never see it.

1.2. Photos and content you create

• Photos you take with the in-app camera or pick from your photo library.
• The title, text and author name you enter when hanging a photo.
• Personal rooms you create: room name, room style, capacity and visibility.

The camera is used only while you are on the capture screen and after you grant access. Library photos are chosen through the iOS photo picker, so the app receives only the photos you pick and never reads your whole library. Each photo is cropped to a square and saved as a new file, without the GPS location or camera details of the original.

Every photo you take with the in-app camera goes into your Collection: the app uploads to our Supabase servers the image file (square, at most 1200 pixels a side), when you took it and your account ID, so that you can see your Collection on any device signed in to this account. Only you can see and download the photos in your Collection; others see only the ones you hang in a room. The server uses the time each photo was taken to limit how many photos you can take each day on your plan. Photos you pick from your library are not added to your Collection. Collection photos you have viewed are cached on the device so they open faster. When you update to the version with this feature, the Collection photos an earlier version kept on your device are uploaded in the same way and then deleted from the device.

When you hang a photo in a room, the app uploads to Supabase: the image (scaled down to at most 1080 pixels on each side), the title, text and author name you enter, the room and slot it hangs in, when you hung it, and your account ID. The photo is shown to everyone who can open that room: everyone in community rooms and Public rooms (including people who haven’t signed in to the app), people with the code in Anyone with the code rooms, and only you in Private rooms. They see the photo, title and text. They see the author name only if you turn on “Show my name under photos” in Profile → Settings (off by default); this setting is stored in your profile on the server and applies to every photo you have hung or will hang. The photo also becomes part of the room’s shared painting and may appear in the Museum once the room is full. Viewers’ apps also receive your account’s internal ID (not your name or email), so they can tell which photos come from the same person when they block someone. The Author field is filled in with your account name; you can change it before hanging the photo. Other people’s photos you have viewed are cached on your device so rooms open faster.

Public and Anyone with the code personal rooms take photos from guests while their owner has “Let guests hang photos” on (the default); each guest can hang one photo. When you hang a photo in someone else’s room, who can see it depends on the visibility the owner chooses, and the owner may change it later. The owner sees your photo as any other viewer does, is notified when you hang it (section 1.5), and can take it down or delete the room. Likewise, in your own rooms you can take down any photo, guests’ photos included. When you block someone, the photos they hung in your rooms are taken down and they can no longer hang photos there. People whose photos are taken down are not notified.

When you heart someone else’s photo, the server stores that photo with your account ID, to remember your heart and count hearts. Each time you open someone else’s photo, the server adds one to its views without recording who viewed it. Viewers see a photo’s total hearts and views; nobody sees who hearted it. Hearts and views go back to 0 when the photo is replaced with another in the same slot.

Personal rooms are stored on Supabase servers: the room name, style, capacity, visibility, share code, creation time, and your display name as the room’s owner. Other users see the room name and owner name depending on the visibility you choose: Public rooms are shown to everyone, including people who haven’t signed in, Anyone with the code rooms to people who have the code or link, and Private rooms only to you. When you join a room with a code, the app sends that code to the server to find the room. Other users’ rooms you have joined with a code or link are kept under “Recently visited” (up to 12 rooms): the server stores the room, the code you used and when you joined, linked to your account, so the list survives a new phone or a reinstall. A room leaves the list when you remove it (touch and hold its card), or when its owner changes the code, makes the room Private or deletes it. To enforce the monthly room limit and prevent code guessing, the server also records when you create each room (deleted rooms included) and how many wrong codes you enter.

When you report a photo, the server stores the reported photo, where it hangs, the reason you chose, when you reported it and your account ID. When you block a user, the server stores your account ID and theirs so their photos are hidden from you, along with when you blocked them, the title of the photo you blocked them from and the name under it (only if that name was shown to you), so you can recognise them in your Blocked people list. The list never uses their profile name or anything else from their profile. People you report or block are not notified and are not told who did it. A photo reported by several people is hidden from everyone while we review its image, title, text and author name to decide whether to keep or remove it.

When you choose to share an artwork poster or a room link through the iOS share sheet, it goes to the app or person you pick, and their handling of it is governed by their own policies.

1.3. Usage data (Google Analytics for Firebase)

While Share Analytics & Crash Reports is on (it is on by default), the app sends Google Analytics:

• Actions in the app: signing in, signing out and deleting your account; opening, creating, editing and deleting rooms and changing a room code; joining a room with a code or link; capturing and hanging photos; getting extra shots by watching ads; viewing and liking photos; viewing and sharing artworks; changing the language; allowing and opening notifications; opening the OneCanvas Plus screen and buying a plan; the screens you view.
• Details attached to those actions: room ID, room style, capacity, how full the room is, the number of photos taken that day, the number of extra shots earned from ads that day and the plan purchased. Never your photos, titles, text, author names or room names.
• User properties: how you signed in (Apple or Google), your plan (free or Plus) and the app language.
• A hashed user ID: a string derived from your account with the one-way SHA-256 hash. Google never receives your actual Apple or Google account ID, name or email.
• Data Firebase collects automatically: an app instance ID, device model, iOS and app version, device language, country or region (derived from your IP address), and when and how long you use the app.

We do not use analytics data to target ads at you. If you allow tracking when iOS asks before your first ad (section 1.7), Google Analytics may also receive the device’s advertising identifier (IDFA).

1.4. Crash reports (Firebase Crashlytics)

Under the same setting, when the app crashes or hits certain errors, Crashlytics receives: the stack trace, device model, iOS and app version, memory and free storage, the time of the error, a Crashlytics installation ID, the hashed user ID described above, the app language, and the ID, style and capacity of the room that was open.

1.5. Push notifications (Firebase Cloud Messaging)

The app has four kinds of notifications: someone likes your photo, a guest hangs a photo in your room, your room is almost full, and the hidden painting of a room holding your photo is complete. You can turn off each kind in Profile → Settings.

To reach your iPhone, the app gets a device token from Firebase Cloud Messaging. The token is created when you open the app, but notifications only appear if you allow them in iOS. When you sign in, the app sends the token to our Supabase server, linked to your account, together with the app language and the kinds of notifications you have turned on. When there is something to tell you, the server picks the devices that want that kind of notification and sends it through Firebase Cloud Messaging and Apple’s push notification service, in each device’s language.

Each notification passing through Google’s and Apple’s servers holds the room’s name; the photo’s title (likes and guest photos) or how many photos the room holds out of its capacity (room almost full); and the IDs of the room and slot, so that tapping it opens the right place. A like notification never says who liked the photo. A guest photo notification includes the photo’s author name only if the person who hung it turned on “Show my name under photos”. So that the owner of a photo hears only once about each person’s like, the server records the account ID of the person who liked it together with the photo; this record is deleted when the photo is replaced or taken down, or when either person deletes their account.

When you sign out or delete your account, the token and its settings are deleted from the server and the token is revoked on your device. Tokens that Firebase reports as expired are also deleted from the server.

1.6. OneCanvas Plus

Purchases and renewals are handled by Apple through the App Store. We never receive your card details, payment method or Apple ID. A subscription belongs to the OneCanvas account you buy it with: when you buy, the app sends your account’s internal ID along, and Apple records it in the transaction. Our server asks the App Store about the subscription and stores its original transaction ID, the plan you bought (monthly or yearly), where it was bought (live or test), its status and expiry, and your account ID. The App Store also tells the server when the subscription renews, is refunded or expires. So you have Plus on every device where you sign in to that account, and other OneCanvas accounts don’t, even on the same Apple ID. If the account that bought it is deleted while the subscription continues, the next account to use OneCanvas on a device with that Apple ID gets it.

1.7. Rewarded ads (Google AdMob)

On the free plan, once you have used up the day’s shots, the capture screen may show a “Watch an ad for 1 more shot” button. An ad plays only when you tap this button, and you can get up to 2 shots a day this way. OneCanvas Plus has no ads. Ads are provided by Google AdMob. We turn this feature on or off remotely through Google’s Firebase Remote Config: each time it opens, the app asks Firebase for the latest configuration, sending a Firebase installation ID, the iOS and app version, and the device’s language, time zone and country.

Google’s ads SDK starts only when you first choose to watch an ad after opening the app. Before that ad:

• Ad consent: where the law requires it (such as the European Economic Area, the UK and Switzerland), a Google form asks whether you consent to Google and its partners using data to show and measure ads. Your choice is stored on your device, sent with every ad request, and can be changed at any time in Profile → Ad Privacy.
• Tracking permission (App Tracking Transparency): iOS asks whether you allow the app to track your activity across other companies’ apps and websites. Only if you allow it can the Google SDKs in the app read the device’s advertising identifier (IDFA). If you decline, you still watch ads and get your shots as usual; the ads are just less relevant to you.

When it loads and shows an ad, the Google AdMob SDK collects: your IP address (which Google uses to infer your approximate location), the IDFA if you allow tracking, other identifiers for the device or app, the device model, iOS and app version, language, your interactions with ads (which ads are shown, whether you watch them to the end or tap them) and diagnostic and performance information about the SDK. Google uses this data to select and measure ads, prevent fraud and improve its services, under Google’s Privacy Policy. We never send Google AdMob your name, email, account ID, photos or content.

When you watch an ad to the end, the app tells our Supabase server to add one shot to that day. The server stores a random ID for the reward, your account ID and when you earned it, to count the day’s extra shots. The server receives nothing about the ad you watched.

1.8. Data kept only on your device

The app also stores on your device your settings (notifications, showing your name under photos, haptics, language, analytics), your ad consent choice and the works you have viewed in the Museum. This data is not sent anywhere, except your notification and language settings (section 1.5), whether your name shows under photos (section 1.2) and your ad consent choice (section 1.7). Your device also keeps a copy of your “Recently visited” list for when you are offline (section 1.2).

2. How we use data

• To provide the features you use: signing in, keeping your Collection, storing and showing rooms and the photos you hang, letting others open the rooms you share, showing artworks, hiding photos from people you have blocked, and unlocking OneCanvas Plus.
• To keep the service safe: protecting your sessions, limiting how many rooms can be created each month, how many photos each room takes and how many photos can be taken each day, preventing room-code guessing, reviewing reported photos and removing content that breaks the Terms of Use.
• To find and fix bugs, and to learn which features are useful so we can improve the app.
• To send the notifications you have turned on.
• To show rewarded ads when you choose to watch one, and add the shots you earn. Ad revenue helps keep the free plan free.
• To meet legal obligations and protect the rights and lawful interests of our users and ourselves.

We do not sell or rent personal data, and we do not build advertising profiles about you ourselves. How Google AdMob uses data for advertising is described in section 1.7.

3. Legal bases

We process your account information, rooms, photos and content because they are needed to provide the service you ask for. Reports and block lists are processed to keep users safe and to remove offending content. Extra shots from ads are recorded to provide the feature you choose to use. Analytics, crash reports and notifications are processed with your consent. Personalised ads rely on the consent you give through iOS’s tracking permission and, where the law requires it, Google’s consent form (section 1.7). You can withdraw consent at any time by turning off the matching setting; this does not affect processing that took place before.

4. Sharing with third parties

We share data only with the providers below, and only as much as each feature needs:

• Apple: Sign in with Apple, the App Store (OneCanvas Plus payments, and telling our server a subscription’s status) and the Apple Push Notification service. Apple Privacy Policy
• Google: Google Sign-In, Google Analytics for Firebase, Firebase Crashlytics, Firebase Cloud Messaging, Firebase Remote Config and Google AdMob. Google Privacy Policy · Privacy and security in Firebase · How Google uses information from apps that use its services
• Supabase: the servers that store your account, your Collection, rooms and the photos you hang, located in Singapore on Amazon Web Services infrastructure. Supabase Privacy Policy

Other users see only the name and owner name of rooms you make Public or Anyone with the code, and the image, title and text of photos you hang in rooms they can open (the author name only if you turn on “Show my name under photos”), as described in section 1.2.

Beyond that, we disclose data only when the law requires it or in response to a valid request from a competent authority.

5. Storage and retention

• On your device: your settings are kept until you change them, delete your account or remove the app. Photos downloaded from rooms and from your Collection are only cached: iOS may clear them when space runs low, and they are deleted when you delete your account. Your session is removed from the device when you sign out.
• Supabase: your account and rooms are kept until you delete them; deleting a room deletes every photo in it, guests’ photos included. A photo you hang is kept until you replace it with another in its slot, the room’s owner takes it down (including by blocking you) or deletes the room, we remove it as offending, or you delete your account. Your profile photo is kept until you replace or remove it, or delete your account. A photo in your Collection is kept until you delete it or your account; the time a deleted photo was taken is kept for up to three more days, to count the daily limit. Extra shots from ads are kept for up to three days, then deleted automatically. A photo deleted in any of these ways leaves its room or your Collection at once, and its image file is deleted from the server automatically within a day. Hearts are kept until the photo is replaced or taken down, or the person who hearted it deletes their account. When you delete your account, your account, profile, Collection, personal rooms, every photo you have hung in any room (image files within a day, as above), the hearts you have given, the reports you have sent, your block list, your recently visited rooms, device tokens and notification settings, your OneCanvas Plus records, extra shots from ads, room-creation history and wrong-code count are deleted from the server at once. A report about a photo is kept for review until the reporter or the person who hung the photo deletes their account. Security logs (including IP addresses and sign-in times) and system backups may still hold this information for some time after the account is deleted.
• Google Analytics: user-level and event-level data is deleted automatically when its retention period ends, after at most 14 months. Aggregated reports that do not identify anyone may be kept longer.
• Firebase Crashlytics: crash reports are kept for 90 days.
• Firebase Cloud Messaging: the device token is revoked and deleted from the server when you sign out or delete your account; tokens left unused for a long time expire and are deleted from the server.
• Google AdMob: advertising data is retained by Google under Google’s policies. Your ad consent choice stays on the device until you change it or remove the app.

Our Supabase servers are in Singapore. Google’s and Apple’s servers may be located in the United States or other countries outside the one you live in. When data is transferred abroad, it is protected under these providers’ data protection commitments.

6. Your rights

You have the right to be informed about how your data is processed, to access, correct and delete it, to withdraw consent, to restrict or object to processing, and to complain to the competent authority. You can exercise most of these rights yourself in the app:

• Analytics and crash reports: turn off in Profile → Settings → Diagnostics.
• Notifications: turn off each kind in Profile → Settings, or all of them in the iPhone’s Settings.
• Ads: an ad plays only when you choose to watch one, and OneCanvas Plus has no ads. Change the tracking permission in the iPhone’s Settings → Privacy & Security → Tracking. Where the law requires consent to ads, change your choice in Profile → Ad Privacy. Manage Google’s ads at myadcenter.google.com.
• Your name under photos: turn “Show my name under photos” on or off in Profile → Settings. When it is off (the default), other people don’t see the author name on any of your photos. The Author field is filled in with your account name and can be changed before you hang a photo.
• Profile: change your display name, or change or remove your profile photo, in Profile → Edit profile (tap your name).
• Photos: view and delete photos in your Collection. A photo you have hung can be replaced with another in the same slot. In your own rooms you can take down any photo: open it, tap the … button, then choose Take down from room. To take down completely a photo you hung in another room, email us.
• Reporting and blocking: open someone else’s photo, tap the … button, then choose Report photo or Block the person who posted this. See and unblock people in Profile → Settings → Blocked people.
• Rooms: rename them, change their capacity or visibility, turn Let guests hang photos on or off, change their code and delete them under Mine.
• Delete your account: go to Profile → Delete account. This deletes your account, profile, Collection, all your personal rooms and every photo you have hung from the server, removes all settings from the device, starts a new analytics ID and deletes the notification token. Deleting your account does not cancel OneCanvas Plus; cancel it under Subscriptions in your Apple ID.
• Disconnect Apple or Google: for Apple, go to the iPhone’s Settings → your Apple Account → Sign in with Apple; for Google, visit myaccount.google.com/connections.

For data already sent to Google Analytics or Crashlytics, or for any other request, email us at the address in section 10. We will respond within the time required by law.

7. Security

Data on your device lives in the app’s private storage and is encrypted by iOS. Data sent to Supabase and Google travels over an encrypted connection (HTTPS). On the server, the database lets each account read and change only its own data (except that a room’s owner can also take down photos others hung in their room), and other people’s rooms open only when they are Public or you have the code. A room’s photos can be downloaded only by people who can open the room, and a photo under review by nobody but the person who hung it. The photos in your Collection and your profile photo can be downloaded only by your account. We collect only what we need, but no system is perfectly secure. If an incident affects your data, we will notify you as the law requires.

8. Children

OneCanvas is not intended for children under 13. If you are under 16, or under a higher age set by the law where you live, you need a parent’s or guardian’s consent before using the app. If you learn that a child has given us data without permission, contact us and we will delete it.

9. Changes to this policy

When this policy changes, we update this page and the date at the top. For significant changes, we will notify you in the app before the change takes effect.

10. Contact

OneCanvas
Email: truonghoanganh.231220@gmail.com