Privacy Policy

Who is responsible.

shapes is operated by Chris Bolton, who is responsible for the processing described here when deciding why and how personal information is used. This policy explains our practices; your rights depend on the laws that apply to you and the processing involved.

Questions or requests: [email protected].

Two different groups of people.

This policy covers the shapes marketing website and app, people with accounts (“creators”), users of our AI and agent tools, and visitors to creator-published pages, including pages on custom domains.

Creators decide why they collect visitor signups and what their embeds and custom code collect. We store and make signup information available on the creator’s behalf. The creator is responsible for their own privacy notice, lawful basis and any required consent; this policy does not replace their notice. Contact the creator about their use of your information, and contact us if you need help reaching them or have a question about our own processing.

What we collect from creators.

Depending on the features you use, we process:

• Account details: your email address and, if you sign in with Google, your name, profile picture and Google account identifier. We never receive your Google password.
• Sign-in data: a one-time sign-in link, stored only as a hash, which expires in 15 minutes and works once. We also record when you last signed in and were last active.
• Your pages: your handle, text, links, layout, versions of your draft, settings, custom domain, and the images you upload.
• Assistant data: Cove messages and replies saved with your page, relevant draft and tool context, plus usage records such as account and page identifiers, selected model, token counts, request cost, timing and success status.
• Billing data: your plan, billing interval, subscription status, billing dates, Stripe customer and subscription identifiers, and records of refunds, disputes or fraud warnings. We send Stripe your account email and account identifier to manage billing. Payment details are entered with Stripe; we do not store full card numbers.
• Website analytics: if you accept, PostHog receives browser and session identifiers, sanitised route labels, selected feature events such as creating or publishing a page, and session replays of how you use shapes with on-screen text, form entries, images and page addresses hidden. Signed-in events can be linked to your shapes account identifier, but we do not send your name or email as analytics profile properties. If you reject, none of this is sent. Global Privacy Control or Do Not Track also keeps it off; see the Cookie Policy.
• Signup-flow data: the name, page address and look you pick before you finish creating an account, kept briefly so you can continue.
• Messages you send us, and technical records such as your IP address and browser details that our servers log in the course of running the service and keeping it secure.

What we collect from visitors.

Our first-party published-page statistics do not use cookies or browser storage. A page view or link click sends a request to our servers. We use the IP address, browser user-agent, referring website and, where supplied by hosting infrastructure, a country code to build daily counts of views, approximate unique visitors, clicked links, referrers, device categories and countries. We do not store raw IP addresses in the statistics records, but infrastructure and access logs may contain them.

To estimate unique visitors, we create a page-specific hash from your IP address, browser details and a daily changing salt. These short-lived hashes are pseudonymous, not a guarantee of anonymity, and expire after about two days. The underlying request data and hashes may be personal information even though no cookie is used. We filter known bots and preview requests, but counts are approximate.

We do not load browser PostHog analytics on creator-published pages (including custom domains), draft previews, share links or agent routes. This does not prevent a creator’s own embeds or code from collecting information.

If you submit your email address on a signup form, we store it with the name you give, the page, and the time, and make it available to the creator.

Our servers also keep ordinary access logs, which contain IP addresses, for security and troubleshooting.

Outside AI assistants.

If an outside AI assistant builds a draft through our public API, we store the draft, preview and claim identifiers, hashes of edit and claim tokens, a hash derived from the requester’s IP address, and the client name it supplies. Anyone with a preview link can view that draft. Unclaimed drafts expire after seven days. API activity records include the method or tool, client, draft identifier, status and IP-derived hash, and expire after 90 days. Hashing does not necessarily make these records anonymous.

We fetch remote images for these previews and can import them into your media library when you claim a draft. The outside assistant or service you use may keep its own copy of your requests and content under its own policy.

How we use information.

We use your information for these purposes:

• To provide the service: sign you in, host and display your pages, deliver signups, process payments, and run Cove.
• To keep it safe: prevent fraud and abuse, enforce our policies, limit usage, and investigate problems.
• To support you: answer your email and fix what is broken.
• To improve shapes: understand feature usage and watch how the product is used through optional browser analytics and session replay when you accept them, and operational records about reliability, AI usage and cost. AI features and moderation process content as described below; we do not claim that all processing is aggregate or anonymous.
• To meet legal duties and protect rights, including accounting and tax obligations.

Reasons for processing and consent.

Where a law requires us to identify a legal basis, we use information as necessary to provide the service you request, meet legal obligations, or pursue interests such as securing the service, preventing abuse and understanding its operation, subject to any required balancing of your rights. We rely on your choice for optional browser analytics and ask for other consent where required by law. Different rules can apply in different places; a description here does not mean every activity is exempt from consent.

Creators must determine the lawful basis for their own visitor-data processing, including signup forms, statistics, embeds and custom code. Cookieless does not necessarily mean anonymous or exempt from privacy or consent requirements.

Email we send you.

We email you only about the service: sign-in links, receipts, important account and policy notices, and replies to what you send. We do not send marketing newsletters unless you ask for them.

Who we share it with.

We do not sell personal information or share it for targeted advertising. Information is disclosed to providers and other recipients for the purposes below. A provider’s role depends on the service: some process information for us, while services such as payment and sign-in providers also have their own legal obligations and privacy policies.

• Stripe, to take payments and manage subscriptions.
• Google, if you choose to sign in with Google.
• An email delivery provider, to send sign-in links and service messages.
• OpenRouter and the selected model provider, to power Cove and AI content moderation. Cove requests include relevant messages, draft content, tool definitions and tool results, including text fetched from links you ask it to read. Moderation requests can include page text, custom code as text, and links even if you do not use Cove. The selected model can change; contact us if you need to identify the provider for a request. Provider retention and data-use terms may differ; we do not promise zero retention or that every provider excludes model training.
• PostHog, for optional browser product analytics and session replay after you accept, and separately for server-side operational AI usage metadata such as account, session and trace identifiers, model, token counts, cost, duration and success status. Operational telemetry does not include prompt text, model output, tool arguments or tool results. The browser analytics choice does not turn off this server processing; contact us with questions or rights requests. To avoid sending content for AI processing, do not use Cove; publishing on plans with moderation may still involve an AI scan.
• Google Safe Browsing, when configured, to check page links for known threats. This sends the links being checked, not visitor browsing histories.
• Hosting, database and file-storage providers, who store and serve the service and your uploaded images.
• Professional advisers, and authorities or other parties where the law requires it or where we need to protect people’s safety, our rights, or the service.
• A buyer or successor, if shapes is sold or reorganised, with notice to you.

Third-party content on pages.

Creator pages can include remote images, music, videos, maps, booking tools, payment links and custom code. Loading or interacting with them may disclose your IP address, browser details, referring page and anything you enter to the creator or provider. Providers may use cookies or other identifiers under their own policies. A custom-code sandbox limits access to the surrounding page, but does not prevent network requests or data collection inside the frame.

Our Cookie settings control applies only to optional shapes browser analytics. It does not control creator-selected providers, and we do not automatically hold their embeds or custom code until consent. Creators must supply notices and obtain any required consent before loading such content, or choose not to include it. Visitors should check the creator’s and provider’s notices before submitting information or paying.

When a creator pastes a link or asks Cove to read one, our servers may fetch it for text or preview information. The destination receives that server request and URL, including any information in the URL. Do not use links containing secrets or private access tokens.

How long we keep it.

Retention depends on the record and the feature. Taking a page offline is not deletion, and cancelling Pro does not delete your account:

• Account records, saved pages, conversations and usage records are retained while you use the service, unless you delete them or request deletion.
• Deleting a page removes its saved versions, conversation, daily statistics and signups from the application database. It does not itself delete separately stored media, account-level AI usage records, provider telemetry or copies a creator has exported.
• Uploaded media stays in your library until explicitly deleted or removed during account deletion. Removing an image from a page does not necessarily remove it from storage.
• Sign-in links are valid for 15 minutes; unfinished signup records expire within about a day; unclaimed assistant drafts expire after seven days. Expiry and database cleanup are not always simultaneous.
• Daily visitor hashes expire after about two days; agent API activity records expire after 90 days. Daily page statistics have no automatic deletion date and remain until the page or account is deleted; the history visible in the app depends on the plan.
• Account deletion runs in stages, including billing cancellation and removal of media and application data, and may retry if a provider is unavailable. Completed deletion-job records remain for about 90 days, with the email and error details cleared on completion.
• Billing incidents and records needed for accounting, disputes, fraud prevention or legal obligations may remain after account deletion. Stripe and other providers may retain records under their own obligations and terms.
• Application deletion does not automatically erase all provider analytics, AI records, logs, backups or already downloaded copies of public content. Their retention depends on the provider and operational requirements; contact us about deletion of those records. We do not promise a fixed backup, log or provider-telemetry deletion period here.

Your choices and rights.

You can see and edit most of your information in the editor and your page settings. In Account settings you can download a copy of your account data and uploaded media, and delete your account and its data yourself. For anything else, or if you cannot sign in, email [email protected] to ask for access to your personal information, to correct it, to delete your account, to export what we hold, or to withdraw a consent you gave us. We may need to verify who you are first. We aim to respond within 30 days and will follow any deadlines and permitted extensions required by applicable law. Some records may need to be retained for legal obligations or legitimate dispute and security needs; we will explain any applicable limits. We will not penalise you for making a request.

Depending on applicable law, you may have rights to access, correction, erasure, portability, restriction or objection, and to withdraw consent without affecting earlier lawful processing. You may also complain to the privacy regulator where you live; Canadian residents may contact the Office of the Privacy Commissioner of Canada or the relevant provincial regulator.

Use Cookie settings in the shapes website or app footer, or the editor’s page menu, to accept, reject or later withdraw consent for optional analytics and session replay. Rejecting or withdrawing stops all of it. Global Privacy Control or Do Not Track signals also keep all shapes browser analytics off. These choices do not stop account and security processing, first-party published-page statistics, AI processing when you use Cove or moderated publishing, or server-side operational telemetry. They also do not erase information already collected; contact us for a rights request.

Creators can delete individual signups, export them on Pro, take pages offline and delete pages. Visitors should contact a creator about signup data the creator has exported or used outside shapes.

Where information is processed.

Information may be processed outside your country by our hosting, storage, payment, email, analytics and AI providers. Locations depend on the provider and service configuration; privacy laws and government access rules can differ from those where you live. Contact [email protected] for information about the providers, processing locations and any applicable transfer safeguards. This policy does not promise a particular data-residency region or certification.

Security.

We use measures such as HTTPS in production, hashed sign-in and agent-access tokens, account access controls and rate limiting. No system is perfectly secure. We will investigate security incidents and provide notifications to affected people and authorities when required by applicable law.

Children.

Creator accounts are not intended for people under 16. Published pages are publicly accessible, and we do not verify every visitor’s age. Creators must not use shapes to target children with data collection that they are not legally authorised to carry out. If you believe a child has supplied information that should not have been collected, contact us so we can investigate and take appropriate action.

Changes to this policy.

When we change this policy, we will update the date at the top. If a change is material, we will tell you by email or in the product before it takes effect.