Scope
This policy explains how Al Joker handles data when you visit the website, create an account, use a brand workspace, or connect third-party services such as Canva and Meta.
Privacy policy
How Al Joker protects account data and project files.
Last updated: September 4, 2026Data we process
Data may include account, contact, and subscription details; brand references, project files, approved content, and uploaded or exported media; connected-account identifiers and granted permissions; and limited usage, performance, job, and error records needed to operate and secure the service.
How data is used
We use data to authenticate users, activate accounts and subscriptions, build requested marketing outputs, operate connected design and publishing workflows, provide support, prevent misuse, troubleshoot failures, and improve service reliability. We do not sell customer or project data.
Canva connection and data
Canva is an optional external editable-design layer. Each user authorizes their own Canva account through Canva's OAuth flow. Al Joker may process the Canva user and team identifiers, granted scopes, encrypted access and refresh tokens, design and asset identifiers, limited design metadata, export references, and job status required for the actions the user requests. Canva credentials are never exposed to frontend JavaScript, and unsupported Canva capabilities remain unavailable.
Generation and service providers
Necessary data may be processed by managed hosting, storage, payment, AI, design, publishing, or analytics providers only to complete a requested action or protect the service. Their handling of data is also governed by their applicable terms and privacy policies.
Security and separation
Al Joker uses authenticated server-side authorization, separate user and brand records, ownership checks before connected-service operations, HTTPS in transit, and AES-GCM encryption for stored OAuth tokens and PKCE verifiers. Client secrets and encryption keys remain in protected server-side configuration. No electronic system can be guaranteed completely risk-free.
Retention, disconnection, and deletion
Connected-service credentials are retained only while the relevant connection is active. When a user disconnects Canva for a brand, Al Joker attempts to revoke the Canva authorization and immediately deletes the locally stored access and refresh tokens, Canva user and team identifiers, granted-scope record, design and asset references, OAuth state records, and Canva integration job data for that connection—and in all cases within 30 days. Final files already exported to Al Joker and attached to content remain available as Al Joker media until the user removes them. Disconnecting does not delete the user's original designs from Canva.
Your choices and updates
You can correct account information, manage project files and exported media, disconnect connected services, and request further deletion through support inside the workspace. Limited records may be retained when required by law, security, fraud prevention, or managed-backup expiry. We may update this policy as the service or legal requirements change; the latest revision date appears on this page.