Privacy Policy
Last updated: October 15, 2026
1. Introduction
Chitmunk is operated by Bokeh Booth LLC, Washington, USA ("we," "us," or "our"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Chitmunk web application and related services (the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.
For privacy questions or to exercise your rights, contact us at [email protected].
2. The Short Version
Chitmunk is a browser-first application. Your designs, images, and project data are stored locally on your device by default. Data only leaves your browser when you explicitly choose to save to Chitmunk Cloud, sync with Google Drive or OneDrive, use AI image generation, or when you sign in (which requires sending account data to our authentication provider). We collect analytics only with your consent. We do not sell your personal information.
3. Information We Collect
3.1 Information You Provide Directly
| Category | Data | Purpose |
|---|---|---|
| Account information | Name, email address, profile picture (from Google, Microsoft, Apple, or email sign-in via Clerk) | Authentication, account management, displaying your identity in collaboration |
| Payment information | Billing name, payment method, transaction history (processed by Stripe via Clerk; we never see or store your full card number) | Processing Rare and Epic subscription payments |
| Cloud project data | Project files (designs, images, fonts, CSV data) that you choose to save to Chitmunk Cloud | Providing cloud storage, sharing, and collaboration features |
| Collaboration data | Email addresses of people you invite to collaborate; share roles and permissions | Managing project access and sending invitation emails |
| Communications | Emails you send to us (support requests, feedback) | Responding to your inquiries |
| AI prompts | Text prompts you enter for AI image generation. We keep the first 200 characters of each prompt with its credit record; we never store the generated images. | Generating images via Cloudflare Workers AI through our API, and showing you your AI history |
| Community posts | Templates you publish to the community, showcase pages, ratings, and replies on the feature board | Shown publicly to other visitors under your display name, because publishing them is the point |
3.2 Information Collected Automatically
| Category | Data | Purpose | Consent Required |
|---|---|---|---|
| Analytics data | Pages viewed, features used, session duration, browser type, OS, screen size, approximate location (country/city, which Google works out from your IP address and then discards), and a random visitor id kept in the _ga cookie |
Understanding usage patterns and improving the Service | Yes: Google Analytics loads only after you click "Accept" on the consent banner |
| Error data | JavaScript error messages, source file, line/column number (sent as GA4 events) | Identifying and fixing bugs | Yes: same consent as analytics |
| Presence data | Your user ID, cursor position, and selected elements during live collaboration sessions | Enabling real-time collaboration with other users | No: necessary for the collaboration feature you activated |
| Playtest guests | If you join a playtest without an account, an anonymous guest id (guest- plus a random code) for that session. Card art is relayed from the host's browser to the players and never stored on our servers. |
Letting people play your game without signing up | No: necessary for the playtest you joined |
| Audit logs | User ID, project ID, action type (save, share, delete), timestamp | Security monitoring and abuse prevention | No: legitimate interest |
3.3 Information Stored Locally in Your Browser
The following data is stored in your browser's localStorage and IndexedDB and never leaves your device unless you explicitly save to the cloud or a third-party service:
- Project designs, card layouts, and CSV data (autosave and manual saves)
- Uploaded images and custom fonts (stored as binary blobs in IndexedDB)
- Editor preferences (theme, grid settings, zoom level, recent projects)
- Consent choices and tour/onboarding completion status
- Third-party credentials you enter (e.g., TheGameCrafter API key)
We have no access to browser-stored data. Clearing your browser data removes it permanently.
4. How We Use Your Information
We use personal information for the following purposes:
- Providing the Service: authenticating you, storing and syncing your projects, enabling collaboration and sharing, processing payments
- Improving the Service: analyzing aggregate usage patterns (with consent), identifying bugs, developing new features
- Communication: sending account emails (share invitations, sharing notices, trial and account changes, deletion receipts) and responding to support requests. Invitations sent to people without an account carry a link to stop further invitations; the other account emails are part of running your account and continue while you hold one. We send no newsletter or marketing email.
- Security: detecting fraud, abuse, and unauthorized access; maintaining audit logs
- Legal compliance: complying with applicable laws, responding to lawful requests
We do not use your personal information for advertising, profiling, or automated decision-making. We do not use your content or prompts to train AI models.
5. How We Share Your Information
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
We share personal information only in these circumstances:
5.1 Service Providers (Data Processors)
We use the following third-party services to operate Chitmunk. Each processes data on our behalf under contractual obligations to protect your information:
| Provider | Role | Data Shared | Privacy Policy |
|---|---|---|---|
| Clerk | Authentication, session management, billing | Name, email, profile picture, subscription status | clerk.com/legal/privacy |
| Stripe (via Clerk) | Payment processing | Billing name, payment method, transaction details, device/behavioral data for fraud prevention | stripe.com/privacy |
| Cloudflare | Hosting, API infrastructure, cloud storage (Workers, R2, D1, Durable Objects) | Cloud project data, account metadata, IP address (for request routing) | cloudflare.com/privacypolicy |
| Google Analytics 4 | Usage analytics (consent required) | Pages viewed, features used, browser/OS info, a random visitor id, and your IP address. Google Analytics 4 does not log or store IP addresses: it uses yours to work out a rough location, then discards it. | policies.google.com/privacy |
| Resend | Transactional email | Recipient email address, inviter name, project title | resend.com/legal/privacy-policy |
5.2 Third-Party Services You Connect
When you optionally connect these services, data flows directly between your browser and the third party:
| Service | Data Shared | Your Control |
|---|---|---|
| Google Drive & Sheets | Project files and spreadsheet data (OAuth scopes: drive.appdata, drive.file, spreadsheets). Details in section 5.3. |
Disconnect in Chitmunk, or revoke access at myaccount.google.com/permissions at any time |
| Microsoft OneDrive & Excel | Project files, spreadsheet data (via OAuth scope: Files.ReadWrite) |
Revoke access in Microsoft Account settings at any time |
| TheGameCrafter | Card artwork, your TGC credentials (stored locally, never on our servers) | Remove credentials from Chitmunk settings at any time |
| Cloudflare Workers AI | Text prompts, sent through our API. We keep the first 200 characters of each prompt with its credit record so you can see your AI history; we never store generated images. | Use is optional; your AI history is erased when you delete your account |
| Content delivery and libraries | jsDelivr, cdnjs and esm.sh (code libraries), Google Fonts (fonts), Cloudflare Turnstile (the bot check on sign-in, run by Clerk), and Poly Haven and ambientCG (texture downloads, only when you use them). Each receives your IP address and the file requested, as with any web request. | Standard browser request; the pages need these files to work |
| Iconify | Icon search queries | Standard browser request |
5.3 Google User Data
If you connect Google Drive or Google Sheets, Chitmunk requests these Google OAuth scopes and uses the data they expose only as described here:
| Scope | What it lets Chitmunk access | What Chitmunk does with it |
|---|---|---|
drive.appdata |
A hidden application folder in your Google Drive that only Chitmunk can see | Saves your Chitmunk project files there when you choose "Save to Google Drive", and lists and opens them when you choose "Open from Google Drive" |
drive.file |
Only the Drive files you create with Chitmunk or open through Google's file picker | Reads a spreadsheet you pick as card data, and writes exported files you ask Chitmunk to place in your Drive. Chitmunk cannot see any other file in your Drive. |
spreadsheets |
The contents of Google Sheets you link to a project | Reads rows to fill your card templates and, when you use two-way sync, writes the cells you edit in Chitmunk back to the same sheet. Chitmunk only reads or writes the spreadsheet you linked. |
Access. Google data is accessed only when you click a Google Drive or Google Sheets action in Chitmunk, never in the background. Sign-in with Google shares only your name, email address and profile picture (see section 3.1).
Storage. Your project files and spreadsheets stay in your Google Drive. Spreadsheet rows Chitmunk reads are processed in your browser and kept only in your browser's local storage (see section 3.3) unless you also save the project to Chitmunk Cloud, in which case the card data becomes part of that cloud project (section 5.1, Cloudflare). We do not keep copies of your Google files on our servers. Your Google access token is held by our authentication provider (Clerk); when the editor needs it, our server relays it to your browser in memory and does not store or log it.
Sharing. We do not share Google user data with anyone, do not use it for advertising, do not sell it, and do not let humans read it, except with your explicit permission for support or where required by law (section 5.4).
Retention and deletion. Disconnecting Google in Chitmunk, revoking access at myaccount.google.com/permissions, or deleting your account ends our access immediately. Nothing derived from Google data remains on our servers other than card data you chose to save to Chitmunk Cloud, which you can delete with the project or with your account (section 10).
Limited Use disclosure. Chitmunk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
The same practices apply to Microsoft OneDrive and Excel (scope Files.ReadWrite): access only on your action, files stay in your OneDrive, tokens are relayed but never stored, and you can revoke access at account.microsoft.com/privacy/app-access.
5.4 Other Sharing
- With collaborators: When you share a project, collaborators can see the project content and your name/email as the owner. During live collaboration, your cursor position and selections are visible to other participants.
- Legal requirements: We may disclose information if required by law, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
- Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred to the successor entity. We will notify you before your information becomes subject to a different privacy policy.
6. Cookies and Tracking Technologies
6.1 Cookies We Use
Only the Google Analytics cookies need your consent. Every other cookie below is strictly necessary: it keeps you signed in, protects the sign-in page from bots, or remembers a switch you turned on yourself.
| Cookie | Provider | Purpose | Duration | Consent Required |
|---|---|---|---|---|
__session, __client, __client_uat |
Clerk | Keeps you signed in | 1 year | No (strictly necessary) |
__clerk_db_jwt |
Clerk | Keeps you signed in while Chitmunk runs on Clerk's development sign-in | 1 year | No (strictly necessary) |
__cf_bm, _cfuvid |
Cloudflare (on Clerk's sign-in domain) | Bot protection | 30 minutes / session | No (strictly necessary) |
_ga, _ga_<ID> |
Google Analytics | Tells visits apart and keeps session state | Up to 2 years (400 days in Chrome) | Yes: set only after you click Accept |
6.2 Consent and Control
Google Analytics loads only after you click Accept. When you first visit Chitmunk, a consent banner asks whether you accept analytics. If you decline or ignore the banner, Google Analytics does not load, no analytics cookies are set and no analytics data is collected.
- Accept: GA4 cookies are set; usage data is collected
- Decline: Google Analytics does not load; no GA4 cookies; no usage data
- Change your mind: Turn analytics on or off at any time in Settings › Privacy & data. Turning it off deletes the GA4 cookies and stops future collection.
Your consent choice is stored in your browser's localStorage (chitmunk_analytics_consent) and is not sent to our servers.
6.3 Global Privacy Control (GPC)
We honor the Global Privacy Control browser signal. If your browser sends a GPC signal, we treat it as a request to opt out of any sale or sharing of personal information (though we do not sell or share your data for advertising in any case).
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (Clerk) | While your account is active. Erased when you confirm deletion; database backups roll off within 30 days. |
| Payment and billing data (Stripe) | Per Stripe's retention policy and applicable tax/financial regulations (typically 7 years) |
| Cloud project data (R2/D1) | While your account is active. Erased when you confirm deletion; database backups roll off within 30 days. |
| AI prompt history (first 200 characters) | Until you delete your account |
| Soft-deleted cloud projects (trash) | 30 days, then permanently deleted by automated garbage collection |
| Share invitation data | Pending invites expire after 7 days. Consumed invite metadata retained for audit purposes while the share relationship exists. |
| Analytics data (GA4) | 14 months (Google's automatic deletion), then purged |
| Audit logs, including a record that an account was deleted | 12 months, then purged |
| Transactional email records (Resend) | Per Resend's retention policy |
| Browser-stored data (localStorage, IndexedDB) | Until you clear your browser data; we have no control over this |
When you delete your account, we erase what we hold about you, with three exceptions: a record that an account was deleted and our audit log of saves, shares and deletions (both kept 12 months), and the billing records Stripe must keep under tax law.
8. Data Security
We implement reasonable technical and organizational measures to protect your personal information, including:
- Encryption in transit: All data transmitted between your browser and our servers uses HTTPS/TLS encryption
- Content-addressed storage: Cloud-stored images use SHA-256 content-addressed hashing
- Authentication security: Clerk manages session tokens and JWTs with industry-standard security practices
- Payment security: Stripe handles all payment data and maintains PCI DSS Level 1 compliance; we never process or store card numbers
- Infrastructure security: Cloudflare provides DDoS protection, WAF, and infrastructure security for our API and storage
- Atomic quota enforcement: Server-side controls prevent unauthorized resource usage
- Browser sandboxing: Locally stored data benefits from your browser's built-in security sandbox
No system is 100% secure. If you discover a security vulnerability, please report it responsibly to [email protected].
9. International Data Transfers
Our service providers process data in the United States and other countries. When personal data is transferred outside the EU/EEA or UK, we rely on the following safeguards:
- EU-US Data Privacy Framework (DPF): Clerk, Stripe, and Resend are certified under the EU-US Data Privacy Framework.
- Standard Contractual Clauses (SCCs): Cloudflare provides Data Processing Agreements with Standard Contractual Clauses for international transfers.
- Adequacy decisions: Where applicable, transfers are made to countries recognized by the European Commission as providing adequate data protection.
10. Your Privacy Rights
10.1 Rights for All Users
Regardless of where you live, you can:
- Access your data: Request a copy of the personal information we hold about you
- Export your projects: Use the built-in export feature to download your designs at any time in standard formats (ZIP, PNG, PDF, JSON)
- Delete local data: Clear your browser's localStorage and IndexedDB at any time
- Control analytics: Opt in or out of analytics via the consent banner or Settings › Privacy & data
- Revoke third-party access: Disconnect Google Drive or OneDrive through their respective account settings
- Delete your account: Delete your account yourself in Settings › Delete account. We email you a confirmation link, good for 24 hours. Once you click it, we cancel any paid plan first, then erase your cloud data and sign-in immediately. Or email [email protected] and we will do it for you.
10.2 Additional Rights for EU/EEA/UK Residents (GDPR)
Under the General Data Protection Regulation, you also have the right to:
- Rectification: Request correction of inaccurate personal data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Restriction: Request restriction of processing of your personal data
- Portability: Receive your personal data in a structured, commonly used, machine-readable format
- Object: Object to processing based on legitimate interests
- Withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing
- Lodge a complaint: File a complaint with your local data protection supervisory authority
Legal bases for processing (GDPR Article 6):
| Processing Activity | Legal Basis |
|---|---|
| Providing the Service (authentication, storage, collaboration) | Performance of contract (Art. 6(1)(b)) |
| Processing payments | Performance of contract (Art. 6(1)(b)) |
| Analytics and usage tracking | Consent (Art. 6(1)(a)) |
| Security monitoring and audit logs | Legitimate interest (Art. 6(1)(f)) |
| Sending transactional emails (share invitations) | Performance of contract (Art. 6(1)(b)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
10.3 Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act provide you with the following rights:
- Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the business purposes, and the categories of third parties with whom we share it
- Right to Delete: Request deletion of your personal information, subject to certain exceptions
- Right to Correct: Request correction of inaccurate personal information
- Right to Opt-Out of Sale/Sharing: We do not sell your personal information or share it for cross-context behavioral advertising
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
Categories of personal information collected in the preceding 12 months:
| CCPA Category | Examples | Sold or Shared for Advertising |
|---|---|---|
| Identifiers | Name, email address, account ID | No |
| Commercial information | Subscription plan, payment history | No |
| Internet or electronic network activity | Pages viewed, features used (with consent) | No |
| Geolocation data | Approximate location that Google Analytics works out from your IP address (with consent; the IP address itself is not stored) | No |
| Audio, electronic, visual information | Profile picture (from SSO provider) | No |
| Professional or employment-related information | Not collected | N/A |
| Sensitive personal information | Not collected | N/A |
10.4 Additional Rights for Other US State Residents
Residents of Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states with comprehensive privacy laws have similar rights to access, delete, correct, and opt out. We honor these rights for all US residents.
10.5 How to Exercise Your Rights
To submit a privacy request:
- Email [email protected] with your request
- We will verify your identity using the email address associated with your Chitmunk account
- We will respond within 30 days (or 45 days if an extension is needed, with notice)
- There is no fee for exercising your rights
You may also designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization.
11. Children's Privacy
Chitmunk is not directed at children under 16. We do not knowingly collect personal information from anyone under 16 years of age. If you are a parent or guardian and believe your child has provided personal information to us, please contact [email protected] immediately. We will promptly investigate and delete any such information.
Teachers should not upload student personal information beyond first names; Chitmunk is not designed to hold education records.
12. AI-Generated Content
When you use AI image generation features:
- Your text prompts are sent to Cloudflare Workers AI via our API to generate images
- A truncated copy of each prompt (first 200 characters) is stored alongside the credit transaction in our database so you can see it in your AI history and we can support billing inquiries. We do not log full prompts and we do not retain generated images on our servers: images are streamed back to you and deleted
- We do not use your prompts, generated images, or any User Content to train AI models
13. Data Breach Notification
In the event of a data breach that affects your personal information:
- We will notify affected users without undue delay via the email address associated with your account
- We will notify relevant supervisory authorities within 72 hours as required by GDPR (where applicable)
- We will comply with all applicable state and federal breach notification laws
- Our notification will describe the nature of the breach, the types of data affected, the measures we have taken, and steps you can take to protect yourself
14. Third-Party Links
The Service may contain links to third-party websites or services (such as TheGameCrafter and Google Drive). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with personal information.
15. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes:
- We will update the "Last updated" date at the top of this page
- We will notify you via email or in-app notification
- For significant changes to data collection or sharing practices, we will provide at least 30 days' notice
We encourage you to review this policy periodically. Your continued use of the Service after the updated policy takes effect constitutes your acknowledgment of the changes.
16. Contact Us
Operator: Bokeh Booth LLC, Washington, USA.
Privacy inquiries: [email protected]
General inquiries: [email protected]
Security issues: [email protected]