Canva App Privacy Policy.

The EveryPage app for Canva publishes the design you are working on as a secure, trackable PDF link - with or without an EveryPage account. This policy explains what the app sends us, what we keep, and why. It covers the Canva app specifically; the main service is covered by our Terms & Privacy.

What the app sends us

• The PDF export of the design you publish. When you publish, Canva exports the open design and we download that PDF over HTTPS so it can be stored (encrypted at rest) and served at your link. We receive nothing else from your Canva account - the app cannot browse your other designs.
• Proof of a real Canva session. Each publish carries a short-lived token that we verify against Canva's published signing keys, purely to confirm the request comes from a genuine Canva session. This is our anti-abuse check - without it, anyone could push files into EveryPage anonymously.
• A design identifier. Canva also provides a signed token naming the design being published, which we verify the same way.

What we keep, and why

• Your Canva user id. An opaque identifier taken from the verified token - not your name, email, or anything else from your Canva profile. It enforces the per-user cap and rate limit on anonymous uploads, so a single Canva account cannot mass-produce files, and together with the design id it is how a republish finds the link it should update.
• The id of the design you published. Stored with the file so that publishing the same design again updates your existing link in place - same URL, same QR code - instead of minting a new link every time.

Neither identifier is used for marketing or shared with third parties. They exist only for the two mechanics above.

Publishing without an account

You can publish without an EveryPage account. The file is stored anonymously - it belongs to nobody until you claim it into an account via the claim link the app shows you. Claiming keeps the same share link and the same expiry, and unlocks the owner features (readership, settings, your library). Designs published into a connected EveryPage account are ordinary uploads, handled under your account and plan settings.

Reader privacy on your links

People who open your link are measured without storing their IP address - ever. The address is turned into a pseudonymous reader id with a salted one-way hash and then discarded; it is also used in-flight to resolve a country for your readership report, then dropped. Reports show pseudonymous readers, never addresses.

Retention and deletion

• Anonymous links are kept for 365 days from publishing. Republishing a live design restarts that clock (unless you set an expiry yourself), so a link in active use stays alive.
• When a link expires, the file and its record are deleted automatically. Claimed files follow your account settings instead - you choose the expiry and can delete them anytime.
• To remove an anonymous link early, claim it into a free account and delete it there, set a shorter expiry in the app when publishing, or email [email protected] and we will remove it.

Data sharing

We do not sell your data or share it with third parties. The app communicates only with Canva (to export the design you publish) and the EveryPage API (to store it and hand back your link).

Contact

Questions? Email [email protected].