Privacy
Last updated 12 August 2026.
The short version
- We do not record which websites you open. Not in logs, not in analytics.
- There is no account, and we never ask for your name or email.
- Each tile is a browser we run for you. It is destroyed when the tile closes.
- We count how many tiles are opened and which countries they run in, so we know how much capacity to pay for.
- We do not sell anything to anyone, because there is nothing to sell.
What we collect
Analytics is OpenPanel. It is the only analytics on this site and it is the complete list of events we send:
| Event | Sent when | What goes with it |
|---|---|---|
| screen_view | a page on this site is opened | the address of the page on this site, referrer, country, browser |
| tile_opened | a remote browser starts | the country it runs in |
| tile_failed | a remote browser could not start | the country, and a short internal reason code |
| tile_frozen | a browser is released to stay under the live-tile limit | the country |
| board_opened | a board is opened | how many tiles it has, and whether it was a shared, saved or listed board |
| board_saved | you save a board | how many tiles it has |
| board_shared | you copy a board link | nothing |
Alongside those, OpenPanel records what any web server sees: the page address on this site, the referring page, your approximate country, your browser and operating system, and the screen size.
None of these events carry a website address you opened. That is a rule enforced in the source, in the one file that is allowed to send events, not a promise made only on this page.
What we deliberately do not collect
- The addresses, page titles or contents of the sites you open in a tile.
- What you type into those sites, including anything you log into.
- Screenshots or recordings of your session.
- The contents of your boards. Boards you save stay in this browser.
- Your name, email or any account, because there is no account.
The remote browsers
Each tile runs a real browser on a server in the country you chose, provided by our infrastructure partner Surfly. Traffic between you and that browser passes through their systems, which is what makes the whole thing work. Surfly is ISO 27001 and SOC 2 certified.
A remote browser is destroyed when you close the tile, when its session is released to stay under the live-tile limit, or when it times out. Cookies and logins created inside it go with it. Nothing carries over to your next tile.
Sites you visit inside a tile see the remote browser, not your machine. They cannot read your cookies, your local storage or your device fingerprint. They can still see the remote browser's IP address, and they set their own cookies inside that browser for as long as it exists.
Your rights, and how we handle requests
Because we hold no account and no browsing history, there is normally nothing to look up, export or delete on request. The analytics events above are not tied to an identity we can search by.
If you want your boards gone, clear this browser's local storage. For anything else, write to privacy@canvas-browser.com.
Changes
If we start collecting something new, this page changes in the same release, and the date at the top moves. We will not quietly widen what is collected and describe it here later.