Privacy policy
What ShardPath keeps about you, why, and what you can do about it. ShardPath (“we”, “us”) is run independently from India, and is responsible for your data. Write to contact@shardpath.com about anything here; our legal name and postal address are sent to anyone who asks.
Without an account
Designs are made in an account. Without one you can open a design someone shared with you, and the gallery; the page remembers a few preferences (the theme, the layout) in your browser's storage, on your device. Your views and copies of shared designs are counted with a one-way hash of your network address, never the address itself. If the app hits an error, a description of the error is sent to our server and kept for 30 days so we can fix it.
On the waitlist
When you join the waitlist we keep your email address, when you joined, which form you used, the site that sent you or the tag on the link you followed, and a one-way hash of your network address, so one person cannot fill the list. We use your address only to tell you when your place in ShardPath opens. It is kept until you have an account, or until you ask us to remove it: write to contact@shardpath.com.
With an account
- Your name and email address, to sign you in, and to send the emails you need: confirming your address and resetting your password. No newsletters. Receipts for payments come from Dodo Payments.
- Your password, if you set one, only as a salted scrypt hash: nobody, including us, can read it back.
- If you sign in with Google or GitHub: from them we receive your name, your verified email address and their id for your account, nothing else. We keep no access to your Google or GitHub account afterwards.
- Your AI-assistant tokens, only as a hash, and the name you gave each; a token is shown once, when you make it.
- Your designs and the last 50 versions of each, so they follow you to any browser.
- Your likes and reports of gallery designs. A report made without an account is stored with a one-way hash of your network address, so one person cannot report a design many times.
- How you use ShardPath, in outline: the days you use it, and on which of them you changed a design or looked at Pro; and, when you sign up, the site that sent you, or the tag on the link you followed. We use it to learn what helps people and what does not. It is counted on our own server, never what you click or what is in your designs, and it is in what you download and goes with your account.
When you pay
Payments are made through Dodo Payments, our merchant of record. You give your card or other payment details, and your billing address, to them, not to us; their privacy policy covers what they keep. From them we receive only what we need to run your plan: which plan you have, when it renews or ends, your country, the email you paid with, and their reference numbers for you and your subscription.
Why we may use it
- To give you what you signed up for: your account, your designs, sharing, and Pro if you pay. Without this data we could not run the service for you.
- To keep it safe and working: the hashed network addresses that stop abuse, error reports, server logs, and the outline of how ShardPath is used. This is our legitimate interest in a service that is secure and gets better, kept as small as it can be.
- Because you asked: the waitlist. Ask us to remove you and we will.
- Because the law says so: records of payments, kept for tax and accounting.
Cookies and storage
- One cookie, set only when you sign in, keeps you signed in. While you sign in with Google or GitHub, a second one lasts at most 10 minutes, to check that the answer coming back is to the request you made. Both are needed for the service to work and are never used for tracking or advertising, so there is nothing to consent to and no banner.
- Your browser’s storage holds your preferences, a copy of your designs so they open quickly and keep working offline, and, until you sign up, the site that sent you on your first visit. It stays on your device; clearing your browser’s data removes it.
- No analytics, advertising or tracking cookies, ours or anyone else’s. The checkout pages of Dodo Payments are theirs, and may use their own cookies to process and protect a payment.
What we do not do
No advertising, no analytics or tracking scripts from anyone else, no selling or sharing of your data. Fonts and everything else the app needs are served from our own servers, so opening ShardPath does not tell any other company that you did.
Who else sees it
Only what you choose to share: a design you share by link can be opened by anyone with the link, and a published design, with your name as its author, by everyone; the notes on your canvas never are. A few providers process data for us, only to run the service: the company hosting our servers, our email provider, and Dodo Payments; and Google or GitHub, only if you choose to sign in with them. Some of them may process it outside your country, under safeguards the law requires.
How long
Your account and designs are kept until you delete them. Designs in the trash are deleted for good after 30 days. Sessions end after 30 days without use, and after 90 days in any case. Records of payments are kept as long as tax and accounting law requires. Server logs (which contain no passwords or designs) are kept for a limited time for security and fixing problems.
Children
ShardPath is for people 18 or older. If we learn that an account belongs to someone younger, we delete it.
Your rights
From Account and data you can download everything your account holds, and delete the account and all of it, at any time. For anything else (a correction, a question, a complaint) write to contact@shardpath.com. Where data protection law such as India’s DPDP Act or the GDPR applies, you also have the right to complain to your data protection authority.
Last updated 18 October 2026.