Privacy Policy
Last updated: 23 October 2026
This policy explains what personal data Circuit Canvas collects when you use the website and the web app at circuitcanvas.com, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
1. Who we are
Circuit Canvas is run by Ohmify AS, a company registered in Norway. Ohmify AS is the controller of the personal data described here. Because we are established in Norway, which is part of the European Economic Area, the EU General Data Protection Regulation (GDPR) applies to everything in this policy, wherever you live.
If you have a question about your data, or want to use any of your rights, write to info@circuitcanvas.com.
2. The short version
- We collect what we need to give you an account and keep your circuits: your email address, a password (stored only as a one-way hash), and what you create.
- We do not sell your data, and we do not show ads.
- Our analytics count visits without cookies and without identifying you.
- We only send you newsletters and product news if you agree to it, and you can stop them at any time.
- You can see, correct, download or delete your data by writing to us.
3. What we collect, and why
Your account
When you create an account we store your email address and your password. The password is stored as a bcrypt hash, which means we cannot read it. If you sign in with Google, we store your Google account identifier and your email address as Google gives it to us; an account made that way has no password until you set one.
If you fill in your profile, we also store your display name and website. These are public: they are shown on parts and circuits you share.
We also keep:
- whether you agreed to receive marketing email, and when;
- the IP address you signed up from (see section 6 for why and for how long);
- a record of each sign-up email we sent and whether it was confirmed, with the email address stored only as a one-way hash, so we can measure how many people complete sign-up;
- when you log in, as a count of activity per day.
Why: to provide the account you asked for (the legal basis is the contract between us, GDPR Art. 6(1)(b)), and to keep the service secure and measure whether sign-up works (our legitimate interest, Art. 6(1)(f)).
Your circuits, parts and code
We store the circuits (projects) you draw, their earlier versions (version history), the symbols and parts you create or import, any code you attach to a circuit, and the folders you organise them in. Pictures of your circuits and parts are generated and stored so they can be shown in lists and on shared pages.
What you create is private unless you choose otherwise: you can open a circuit to anyone with its link, share a part, or publish a circuit to the community page. When you publish a circuit, a copy of it is reviewed by us and, if approved, shown publicly together with your display name.
Why: this is the service itself (contract, Art. 6(1)(b)).
Trying the editor without an account
If you use the editor without an account, the circuit you draw is stored for one week after your last visit, linked only to your browser's session cookie. If you sign up, it moves into your account; if not, it is deleted.
Publishing to the community page
When you submit a circuit for publishing we store the IP address it was submitted from, together with the account's sign-up IP, so we can recognise and stop floods of spam submissions.
Why: to keep the community page free of spam and abuse (legitimate interest, Art. 6(1)(f)).
Connecting an AI assistant
If you connect an AI assistant (for example Claude or ChatGPT) to Circuit Canvas, we store a record of that connection: which app it is, and access tokens stored only as one-way hashes. Circuits the assistant makes are saved in your account like any other circuit. What you tell the assistant, and what it receives back from us, is also handled by the company that provides the assistant, under its own privacy policy.
Why: to provide the connection you set up (contract, Art. 6(1)(b)).
Emails
We send you emails you need, such as confirming your email address, resetting your password, and telling you whether a circuit you submitted was approved. These do not need your consent.
If you agree to receive marketing email, we send you news about Circuit Canvas and Ohmify. You can withdraw that consent at any time with the unsubscribe link in any such email, or by writing to us.
Why: service emails are part of the contract (Art. 6(1)(b)); marketing email is based on your consent (Art. 6(1)(a)). In the US we pre-tick the marketing box; everywhere else it is unticked until you tick it.
Analytics
We use Plausible Analytics, hosted for us at analytics.ohmify.com, to count page views and the use of features (for example how many people open the editor or publish a circuit). Plausible sets no cookies and stores no IP addresses or other identifiers: it cannot follow you between visits or across sites, and we cannot tell who you are from it.
Why: to understand which parts of the site are used and improve them (legitimate interest, Art. 6(1)(f)).
Security and spam protection
Our servers handle your IP address for every request, to deliver the page and to limit how often one address can make requests, which protects the service against abuse. We look up the country of your IP address on our own server (no third party is involved) to decide which version of the marketing checkbox to show.
On sign-up we use Cloudflare Turnstile to check that you are not an automated program. Cloudflare receives your IP address and some technical information about your browser for that check.
Why: security and spam prevention (legitimate interest, Art. 6(1)(f)).
4. Cookies and local storage
We use one cookie, the session cookie, which keeps you logged in. It is strictly necessary and is not used for tracking. It lasts until you close your browser, except when you try the editor without an account, when it lasts one week so your circuit is still there when you come back.
The editor also stores small preferences in your browser's local storage, such as the last text style you used, which view of a circuit you prefer, and how you sort your circuits. These never leave your browser.
We use no advertising or tracking cookies, and no third-party analytics cookies.
5. Who we share data with
We do not sell personal data. We share it only with service providers that process it on our behalf, under data processing agreements, and only as much as each needs:
| Provider | What it does for us | Data it handles |
|---|---|---|
| Render (Render Services, Inc., USA; servers in Oregon, USA) | Runs the application and its database | Everything described in this policy |
| Bunny.net (BunnyWay d.o.o., Slovenia) | Stores and delivers images and part files | Pictures of circuits and parts, your IP address when files are loaded |
| Postmark (ActiveCampaign, USA) | Sends service emails | Your email address, the email's content |
| Bento (USA) | Sends marketing emails, if you agreed to them | Your email address, your consent, sign-up and verification events |
| Cloudflare (USA) | Turnstile check on sign-up | IP address, browser information |
| Google (USA) | Sign in with Google, if you use it | What Google needs to sign you in; Google tells us your email address and account identifier |
| Google Fonts, jsDelivr, unpkg, cdnjs | Deliver fonts and code libraries the pages load | Your IP address and browser information when the page loads |
We may also disclose data where the law requires it, or to protect the rights, safety or property of our users or ourselves.
6. How long we keep it
| Data | Kept |
|---|---|
| Your account and what you created | Until you delete your account (see section 8) |
| A sign-up that was never confirmed | 24 hours |
| A circuit drawn without an account | One week after your last visit |
| Sign-up IP and community submission IPs | 90 days, then erased |
| Earlier versions of a circuit | Thinned over time: all recent versions, then fewer per day and per week as they age; named versions are kept |
| Records of sign-up emails sent (email hashed) | Kept, as statistics |
| AI assistant connections | Until you or the assistant disconnect, or the access token expires (30 days without use) |
| Marketing consent | Until you withdraw it |
7. Transfers outside Europe
Circuit Canvas runs on servers in the United States (Render, in Oregon), so your data is stored there, and some of the other providers above are in the United States too. Where personal data is transferred outside the European Economic Area, it is protected by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy of it;
- correct data that is wrong;
- delete your data;
- restrict how we use it, or object to our using it on the basis of legitimate interest;
- receive your data in a machine-readable form and have it sent to another service (portability); circuits can also be exported from the editor at any time;
- withdraw your consent to marketing email at any time, without affecting anything done before.
To use any of these rights, write to info@circuitcanvas.com from the email address of your account. We answer within one month.
To delete your account, write to us from its email address. Deleting an account deletes the account itself, your personal part library, your login sessions and your AI assistant connections. Tell us if you also want the circuits you made deleted, or delete them yourself first. Circuits you published to the community page stay listed after your account is deleted, credited to "a former member" instead of your name, unless you ask us to remove them too.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or to the data protection authority where you live. We would appreciate the chance to put it right first, so please write to us.
9. Children
Circuit Canvas is not aimed at children under 13, and we do not knowingly collect data from them. If you are under 13, please ask a parent or guardian before creating an account. If you believe a child under 13 has given us personal data, write to us and we will delete it.
10. Security
Passwords and access tokens are stored only as one-way hashes, every connection to the site is encrypted (HTTPS), and access to our systems is limited to the people who run Circuit Canvas. No system is perfectly secure, but if a breach that puts your data at risk ever happens, we will tell you and the authorities as the law requires.
11. Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change matters for how we use your data, we will tell you by email or on the site before it takes effect.