Privacy Policy
Draft. Highlighted items in [brackets] still need filling in before launch.
The short version
- We collect what we need to run your account and save your visuals, and nothing for advertising.
- Your projects save in your own browser. They reach our servers only when you save them to your account or render a transparent video.
- We never sell your data, never show ads and never use your content to train AI models.
- We use three small cookies, all for sign-in. There are no tracking or analytics cookies; we count usage only as anonymous daily totals.
- You can see, export or delete your data at any time.
Who we are
Impact Charts (“we”, “us”) is run by Datamuse Market Intelligence, Inc., [Registered address]. We are responsible for the personal information described here. Questions go to support@impactcharts.com.
This policy covers the Impact Charts website, the studio at /app/, and our account and rendering services.
What we collect
When you create an account
- Email and password: your email address and your name if you give one. We never store your password itself, only a one-way Argon2id hash of it, which can’t be turned back into your password.
- Google sign-in: if you use it, Google shares your email address, name, profile picture and Google account ID with us. We don’t get your Google password or access to anything else in your Google account.
When you save your work
- Visuals you save to your account: the data you added (for example a spreadsheet or pasted rows), your column choices, style, motion and export settings, the visual’s name and a small preview image.
- Preferences: the defaults a new visual starts with, such as its shape, theme and export destination.
When you use the service
- Sessions: when you sign in we record the time, your IP address and your browser’s user-agent string, so you stay signed in and we can spot misuse.
- Security counters: to stop password guessing, we briefly count sign-in attempts per IP address and per email (the email is stored as a one-way hash). These counters expire after 15 minutes to an hour.
- Server logs: our servers record errors and basic request information, which we keep for up to 30 days.
- Usage totals: to learn which parts of the product work, we count how many times certain steps happen each day, such as the studio being opened, a chart being exported or an account being created, and whether it happened without an account, on Free or on a paid plan. We keep only those daily totals. No cookie, account, device ID or IP address is attached to them, so they can’t be linked to you.
We don’t collect or store payment card numbers. Payments are handled by Stripe: the card fields on our payment page are Stripe’s, so your card details go straight from your browser to Stripe and never reach our servers. We keep a record of your plan and whether payments succeeded, not your card details.
What stays on your device
Much of Impact Charts runs entirely in your browser:
- Autosave: the visual you’re working on saves in your browser’s local storage. It stays on that device until you save it to your account.
- Music: a music track you add is kept in your browser’s storage on that device and mixed into MP4 exports on your computer. It is never uploaded, saved to your account or published.
- Exports: MP4, WebM, GIF, PNG and PNG-sequence exports are made on your computer.
- Transparent ProRes and WebM: these are the exception. Your browser uploads the rendered frames to our server, which encodes the video, sends it back and deletes the temporary files as soon as the job finishes.
- Google Sheets: if you import from a Sheets link, your browser fetches the sheet directly from Google.
How we use it
- To run your account, sign you in, and save and load your visuals and preferences.
- To keep the service secure: detecting password guessing, abuse and fraud.
- To answer you when you contact us.
- To send essential messages about your account, such as security notices or changes to these policies. We won’t send marketing email unless you opt in.
- To fix problems and improve the product, using error logs and aggregate figures (never the contents of your data).
We do not sell or rent your personal information, show ads, build advertising profiles, or use your data or visuals to train AI models.
Where the law requires a legal basis (for example the GDPR): we rely on contract to provide the service you signed up for, on legitimate interests for security and improving the product, and on consent for anything optional, which you can withdraw.
Cookies and local storage
We use only the storage needed to make the product work. There are no analytics, advertising or third-party tracking cookies, so there’s no cookie banner.
| Name | Type | Why | How long |
|---|---|---|---|
ic_session | Cookie (HttpOnly) | Keeps you signed in. It holds a random token; we store only a hash of it. | 30 days, or until you sign out |
ic_oauth | Cookie (HttpOnly) | Protects the Google sign-in step from forgery. | 10 minutes |
ic_known | Cookie | Remembers that this browser has signed in before, so you land on Sign in rather than Register. It holds only “1”. | 400 days |
impactcharts-studio-project | Local storage | Autosaves the visual you’re working on in this browser. | Until you clear it |
Who we share it with
We share information only with service providers who help us run Impact Charts, only as much as they need, and under contracts that limit how they can use it:
| Provider | What for | What they receive |
|---|---|---|
| Supabase | Database hosting (Canada, Central region) | Account details, sessions, preferences and saved visuals |
| Railway | Running our servers, their cache (Redis) and transparent-video rendering (United States, West) | Requests, logs, sign-in sessions held briefly in the cache, and temporary render files |
| Resend | Sending account email: confirming your address, password resets and plan notices | Your email address, your name and the message |
| US Census Bureau geocoder | Placing street addresses on point maps (Pro and Team, only when you use it) | The street addresses in that map’s data |
| Stripe | Taking payments, managing subscriptions and preventing fraud | Your name, email, billing country and postal code; your card details, sent directly by your browser; and the device and usage details its card fields collect to detect fraud |
| Google sign-in (if you choose it); Google Fonts | Sign-in: the request to Google’s sign-in page. Fonts: your IP address and browser details when fonts load | |
| jsDelivr | Delivers the open-source code libraries the studio uses | Your IP address and browser details when files load |
We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a merger or sale of the business. In a sale, this policy would continue to apply to your information.
How long we keep it
- Account and saved visuals: kept while your account is open.
- Deleted visuals: they go to a trash first and are permanently erased after 30 days.
- Sessions: expire after 30 days and are erased within an hour of expiring.
- Closed accounts: when you ask us to delete your account, your account, preferences, sessions and visuals are erased within 30 days. Backups roll off within a further 30 days.
Your choices and rights
Wherever you live, you can:
- See and change your details, and open, rename or delete your visuals, in the studio.
- Get a copy of your data: any visual can be downloaded as a project file, and we can send you everything we hold about you.
- Delete your account and everything in it.
- Object or restrict: ask us to stop or limit certain uses, or withdraw consent you gave.
Email support@impactcharts.com to make any request. We’ll reply within 30 days and may ask you to confirm it’s really you. Depending on where you live (for example the EU, UK, California or Canada), you may have further rights under local law, including the right to complain to your data-protection authority.
Security
- Passwords are hashed with Argon2id; nobody at Impact Charts can see them.
- Session cookies are HttpOnly, so scripts on a page can’t read them.
- Your data is encrypted in transit (HTTPS).
- Only our servers can reach the database.
- Sign-in attempts are rate-limited to stop password guessing.
No system is perfectly secure. If a breach affects your information, we’ll tell you and the authorities as the law requires.
Where your data is stored
Our database is hosted in Canada. If you use Impact Charts from elsewhere, your information is transferred to and stored in Canada, and our providers may process it in other countries. Where the law requires it, we use appropriate safeguards for these transfers, such as standard contractual clauses.
Children
Impact Charts isn’t meant for anyone under 16, and we don’t knowingly collect information from them. If you think a child has given us information, contact us and we’ll delete it.
Changes to this policy
If we make a significant change, we’ll let you know by email or in the studio before it takes effect. The date at the top shows when this policy last changed.
Contact
Datamuse Market Intelligence, Inc., doing business as Impact Charts
[Registered address]
support@impactcharts.com