Privacy

Last updated August 2026

Ummah Canvas is a shared drawing canvas. This page explains exactly what it stores about you, why, and how to have it removed. It is written to be read rather than skimmed past, so it is short.

Who is responsible

The operator of ummahcanvas.com operates ummahcanvas.com and decides what is stored here. Under UK data protection law that makes them the data controller. You can get in touch at hello@ummahcanvas.com.

If you only look

You can browse the canvas without an account. Doing so stores nothing about you on this site. As with any website, the company that hosts the servers keeps short-term technical logs that may include your IP address, which they use to keep the service running and secure.

If you sign in

Signing in uses your Google account. Google tells us three things and no more: a permanent identifier for your account, your email address, and your profile photo. We never see your Google password, and we have no access to your Gmail, Drive, contacts or anything else.

Once you have an account, this site stores:

• the identifier Google gave us, so we recognise you next time
• your email address, used to recognise you and to tell administrators apart from everyone else
• the display name you chose, which is shown publicly beside your work
• the web address of your Google profile photo
• how many pixels you have placed, and when you last placed one
• which pixels you placed, so that damage can be undone and disputes settled
• anything you write in the chat, kept for seven days

Why

All of it exists to run the canvas. Your account is how the site knows the waiting period between pixels applies to you rather than to whichever browser you happen to be using. The record of who placed what is what lets an administrator undo one person's vandalism without destroying everyone else's work.

In legal terms, we rely on legitimate interests: running a shared canvas that is not immediately ruined requires knowing who did what.

Who else sees it

Your display name is public, as is anything you write in the chat. Everything else is not shown to other visitors.

Two companies handle data on our behalf and are not permitted to use it for anything of their own:

• Google verifies who you are when you sign in
• Railway runs the servers and the database

Nothing is sold, and nothing is shared with advertisers. There are no advertising or analytics trackers on this site.

How long it is kept

• Your account — until you ask for it to be deleted
• The record of individual pixels you placed — seven days, then deleted automatically
• Chat messages — seven days, then deleted automatically. Kept that long so a moderator can see the context around anything reported
• Pictures of the whole canvas — kept as a history for seven days, then thinned out
• The canvas itself — indefinitely, as the artwork of everyone who has taken part

Cookies

One cookie, named uc_session. It is set when you sign in, it lasts thirty days, and all it does is remember that you are signed in. It cannot be read by scripts on the page and it is not used to follow you anywhere else.

Your rights

You can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. Email hello@ummahcanvas.com and we will respond within a month.

Deleting your account removes your name, email and profile photo. Pixels you placed stay on the canvas as part of the shared artwork, but nothing links them to you any more.

If you think your data has been handled badly, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

This site is not aimed at children under 13, and accounts are not knowingly created for them. If you believe a child has signed up, email us and the account will be removed.

Changes

If this policy changes in a way that matters, the date at the top changes and a notice appears on the canvas.