Privacy notice · 16 October 2026

How Canopy handles data

Purpose and information

Canopy supports conservation casework for approved team members. It processes Google sign-in identity (including email and profile name), member roles, project and ticket details, notes, document records, messages and activity logs. Operational metadata such as project names, ticket titles, membership, authors and timestamps is visible to the service.

Storage and access

The application runs on Cloudflare. Structured records are stored in D1 and encrypted document envelopes in a private R2 bucket. Cloudflare Access and the application’s active-member roles control access. Notes, documents, filenames and project messages are encrypted in the browser with a project vault key before storage. Vault passphrases are not sent to Canopy’s server. This does not encrypt all operational metadata or prevent an account administrator from changing the application.

Google identity and Drive

Google sign-in is used to identify approved members. Canopy does not collect Google passwords. The separate administrator backup client uses Google’s drive.file permission to create and manage its own backup folder and files; it does not request access to all existing Drive files. Backup authorization is optional for ordinary team members. It can be revoked through the administrator’s Google Account permissions, which will stop future backups.

Backups and retention

Daily encrypted Google Drive backups are planned and are not yet active. Once configured and tested, completed database restore points will be retained for 30 days. Shared encrypted evidence copies are retained conservatively and may remain longer than 30 days. Removing an evidence record from Canopy hides it and blocks normal downloads, while its encrypted recovery copy remains in storage. Account administrators manage retention and recovery requests.

Service providers

Cloudflare hosts the application and storage. Google provides sign-in and the planned backup destination. A private GitHub Actions job is planned to run backups using dedicated credentials. These providers process information under their own service terms and privacy notices.

Browser and microphone

Canopy uses a secure session cookie for authentication and keeps unlocked vault keys temporarily in browser memory. Optional dictation requires a user action. Browser-provider recognition may send audio to that provider when explicitly allowed; Canopy does not store an audio recording. The local demonstration stores data in that browser and is separate from hosted Canopy.

Requests and contact

Contact the Canopy workspace administrator through the team’s existing contact channel for access, correction, removal and retention requests. Removing account access cannot recall copies already downloaded or knowledge of a shared vault passphrase.