Privacy Policy
How this Cloudflare-ready Loaf build handles account information, projects, uploads and browser storage.
1. Scope
This Privacy Policy explains how information is handled by this Loaf build and what should change when the project is connected to production services.
2. Information you provide
The static account form asks for a creator name, email address and password. In this build, those values are stored only in browser local storage on the device where you create the account.
3. Projects and uploads
Design projects, canvas settings and uploaded images may be stored locally in the browser. Uploaded images can be encoded into project data so they can be restored in the editor.
4. Usage and technical data
This package does not include analytics or tracking scripts by default. A production deployment may receive standard hosting logs from the hosting provider, such as request metadata and security events.
5. How information is used
Local information is used to operate the sign-in flow, separate projects by account, restore designs and personalize the dashboard. No local account database is transmitted by the included JavaScript.
6. Data sharing
The static build does not sell or share local account data with advertisers. If third-party services such as analytics, authentication, billing or storage are added, this policy must be updated to accurately describe those providers and purposes.
7. Retention and deletion
You can remove the local demo data by clearing this site’s browser storage. A production backend should provide retention rules and account deletion controls appropriate to the deployed service.
8. Security
Browser-only storage is not equivalent to secure production authentication. For a public service, use a server-side authentication provider, secure cookies or tokens, password hashing, access controls and appropriate encryption.
9. Children and age requirements
The deployed service should follow the age and parental-consent requirements that apply in the jurisdictions where it is offered. If the service is not intended for children, this should be clearly stated during account creation.
10. Your rights
Depending on location, users may have legal rights to access, correct, delete or export personal data, or object to certain processing. A production deployment should provide a clear contact or self-service method for those requests.
11. International transfers
If production providers process data in multiple countries, the deployed service should disclose relevant transfer mechanisms and protections where required.
12. Changes and contact
This policy may be updated as the product changes. Replace placeholder contact information and update the effective date before a public production launch.