Privacy Policy

Last Updated: 20th October 2025

This Privacy Policy explains how CAPlayground ("we", "us") collects, uses, and protects your information. It applies to your use of the CAPlayground website and application (the "Service").

1. Information We Collect

  • NO Local Projects: By default, your projects are stored locally on your device (using browser IndexedDB or OPFS). We do not receive your local projects unless you explicitly upload or share them.
  • Cloud Projects (Optional): You can optionally use Cloud Projects by signing in to Google Drive. When you do this, your project files are stored in YOUR Google Drive account, not on CAPlayground servers. We do not receive, store, or have access to your Cloud Projects. All data is transmitted directly between your browser and Google Drive.
  • Account Information: If you create an account via Supabase using email/password or Google OAuth, we process your email, necessary authentication identifiers (e.g., provider and user ID), and optional profile information required to operate the Service.
  • Device & Usage: Basic technical information such as device/browser type and interactions needed to operate the Service. We do not run third-party analytics unless stated here.
  • Cookies & Local Storage: We use necessary cookies/localStorage for session, preferences, and product features (e.g., first-time Terms acceptance: caplayground-tos-accepted). If you sign in to Google Drive, we store authentication tokens in secure, httpOnly cookies (google_drive_access_token, google_drive_refresh_token, google_drive_token_expiry) to maintain your Drive session and authenticate API requests on your behalf.

2. How We Use Information

  • Provide and improve the Service and its features.
  • Authenticate users and secure accounts.
  • Prevent abuse and ensure the reliability of the Service.
  • Communicate important updates related to your account or the Service.

3. Analytics

We use privacy conscious analytics to understand usage and improve CAPlayground. This includes:

  • Page Views: Page URL, title, referrer, timestamp, and a session ID.
  • Sessions: Session duration, start/end time, number of pages visited, and basic bounce detection.
  • Performance: Page load time, DOM content loaded, first paint/first contentful paint, and resource timing metrics.
  • Aggregate Counters: We also keep aggregate-only counts for certain product events (projects created). These counters are stored without user identifiers and used for product planning. The contents in your projects are not collected.

We do not use analytics for advertising, and we do not intentionally collect sensitive identifiers (such as precise location or device fingerprinting data) for analytics.

4. Third Parties

We use Supabase for authentication and backend infrastructure. Supabase may process data necessary to provide those services and may maintain operational logs (e.g., auth events). We also use PostHog for privacy focused analytics as described above. PostHog data is proxied through our own domain to improve reliability. Refer to those providers' documentation/policies for more details.

Google Drive (Optional): If you choose to use Cloud Projects, we integrate with Google Drive to store your project files. Your project files are stored in YOUR Google Drive account in a folder named "CAPlayground". We access only files created by CAPlayground. Your use of Google Drive is subject to Google's Privacy Policy. You can revoke CAPlayground's access to your Drive at any time through your Google account settings.

5. Data Retention

  • Local projects remain on your device until you remove them.
  • Cloud Projects remain in your Google Drive until you delete them. Deleting your CAPlayground account does NOT automatically delete your Cloud Projects from Google Drive. You must manually delete them using the "Delete All" feature in the dashboard or directly from Google Drive.
  • Account data is retained while your account is active. If you delete your account, we delete associated account data except where retention is required by law.
  • Google Drive authentication cookies are cleared when you sign out from Google Drive or when they expire.

6. Your Rights

Depending on your location, you may have rights to access, correct, or delete your data. We are planning an account deletion endpoint in the app. You can also contact us to exercise your rights.

7. Children’s Privacy

The Service is not intended for children under the age specified in our Terms of Service. If you believe a child has provided us personal data, contact us and we will take appropriate steps.

8. International Transfers

Data may be processed in regions where our providers operate. We take steps to ensure appropriate safeguards consistent with applicable laws.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last Updated" date above and, when appropriate, provide additional notice.

10. Contact

Questions? Contact us at support@enkei64.xyz.

Also see our Terms of Service.