Privacy Policy
Last updated: August 30, 2026
CrowScribe (“CrowScribe”, “we”, “us”) is a free, single-operator workspace for notes, canvases, and an encrypted credentials vault. It is operated by Daryl John Tadeo, an individual based in the Philippines, who is the data controller for the purposes of this policy. Contact: support@crowscribe.space.
This policy explains what personal data we process and why. It is written to align with the Philippine Data Privacy Act of 2012 (RA 10173), and includes sections for users covered by the EU/UK GDPR and the California CCPA/CPRA.
Data we process
| Account | Your email address (entered directly, or provided by Google if you sign in with Google). We do not store passwords in readable form — authentication is handled by our provider, Supabase. |
|---|---|
| Profile | Information you choose to enter during onboarding or in account settings: display name, occupation, company, short bio, how you intend to use the product, an optional avatar image, and an optional username. |
| Content | Everything you create in the app: pages and their text/images, canvases, workspace names, descriptions and logos, and your folder structure. |
| Credentials vault | Secrets you store in the vault (usernames, passwords, notes) are encrypted in your browser with a key derived from your vault passphrase before they are sent to us. We cannot read them and cannot recover them. The title and URL of each vault entry are stored unencrypted so the list is searchable. |
| Workspace sharing | If you invite someone to a workspace, we process the email address or username you enter in order to deliver the invitation and, once accepted, to record their membership and role. |
| Technical | Server and infrastructure logs (including IP address and browser user-agent) kept by our hosting providers for security and debugging; anonymous web-performance measurements (Core Web Vitals) via Vercel Speed Insights; and error reports via Sentry, which may include a stack trace and the URL where an error occurred. |
How and why we use it
- To provide the service — store and display your content, run your workspaces, authenticate you.
- To send transactional email — sign-in links and workspace invitations. We do not send marketing email.
- To keep the service secure and prevent abuse — rate limiting, investigating suspicious activity.
- To understand and improve performance and reliability in aggregate.
Legal bases (GDPR). Processing of your account and content is necessary to perform our agreement with you (Art. 6(1)(b)). Security, abuse prevention, and aggregate performance monitoring rely on our legitimate interests (Art. 6(1)(f)). Where we ask for consent, you may withdraw it at any time.
Service providers (sub-processors)
We do not sell your personal data and we do not share it for advertising. We rely on the following processors to run the service:
- Supabase — database, authentication, file storage, and transactional-email delivery.
- Vercel — application hosting and anonymous performance measurement.
- Resend — transactional email sending.
- Google — only if you choose “Continue with Google” to sign in.
- Sentry — application error monitoring.
Sharing and publishing
Content in a shared workspace is visible to the other members you or the workspace owner have invited, according to their role (owner, editor, or viewer). If you publish a page or canvas, it becomes accessible to anyone who has the link, and may be retrieved by others you share it with; unpublish it to revoke access.
International transfers
Our providers operate infrastructure that may be located outside the Philippines, including in the United States and the European Union. Where required, we rely on the providers’ own transfer safeguards (such as Standard Contractual Clauses).
Retention and deletion
We keep your data for as long as your account is active. You can delete your account at any time from Account settings; this permanently removes your account, profile, and the content of workspaces you solely own, normally within 30 days. Residual copies in encrypted backups are purged on the backup rotation, within 35 days. Infrastructure logs held by our providers expire on their own schedules (typically days to a few weeks).
Because the vault is encrypted with a key we never receive, if you lose both your vault passphrase and your recovery key, the vault contents cannot be recovered by us or anyone else.
Cookies and local storage
We use only what is strictly necessary to run the service: a session token to keep you signed in (set by Supabase), and a small preference for your light/dark theme. We do not use advertising or cross-site tracking cookies, so there is no consent banner.
Your rights
Under the Data Privacy Act, the GDPR, and the CCPA/CPRA as applicable to you, you may request access to your data, correction of inaccurate data, deletion, a portable copy, and restriction of or objection to certain processing, and you may withdraw consent. Exercise most of these directly in the app (edit your profile, delete your account) or by emailing support@crowscribe.space. We will respond within the timeframe the applicable law requires.
If you are in the Philippines and believe your rights have been violated, you may lodge a complaint with the National Privacy Commission (privacy.gov.ph). Users in the EU/UK may complain to their local supervisory authority.
Children
CrowScribe is not directed to children under 18, and we do not knowingly collect their personal data.
Changes
We may update this policy as the service evolves. Material changes will be reflected in the “Last updated” date above, and where practical we will notify active users by email.
Contact
Questions or requests: support@crowscribe.space.