Privacy Policy

• Pinterest authorization information: a temporary authorization code, an access token, granted permissions, and token expiry information.
• Board and Pin data: identifiers, board names, Pin titles, image links, covers, thumbnails, and counts. Pinterest may return additional owner or content metadata in its API responses.
• The audio file and filename you select, processed in your browser. If you email us, we also receive your contact details and message.

We use this information to connect Pinterest, list your accessible boards, load images, run your session, and respond to support or privacy requests. You sign in with Pinterest through OAuth; VisionFlow does not receive your Pinterest password.

The app requests boards:read, pins:read, boards:read_secret and pins:read_secret to read your public and secret boards and Pins. These are read-only permissions. Access is limited by your authorization and Pinterest’s permissions, including any shared boards Pinterest makes accessible to your account. Secret-board content is used for your own session and is not published to the feedback board or shared with other VisionFlow users. These read permissions do not let VisionFlow create, change, or delete your Pinterest content. We do not combine your Pinterest content with other users’ accounts, send it to the feedback database or product analytics, sell it, or use it for advertising or AI training.

Selecting or dropping an MP3 or WAV, up to 100 MB, does not upload it to our server or Pinterest. The browser plays it through a temporary local file URL. The app releases that URL when you replace the file or leave the app. Your original file remains on your device, and ending a slideshow may leave the file selected until then.

The app server temporarily processes authorization and API responses. It keeps your access token in an encrypted, HttpOnly session cookie on your browser, rather than a user database. The app accepts this session for up to eight hours, or until the token expires sooner. It does not retain a refresh token. The OAuth security cookie expires after ten minutes and is cleared when the connection callback is handled. A connection-result cookie lasts up to one minute and is consumed when the app checks its session.

Board and Pin details remain in temporary application memory for the current use; the app does not save Pinterest content in a database, board library, or session history. API requests and responses are marked not to be cached. Browsers may cache images, restore session cookies, or retain history under their own settings. An expired token cookie can remain until the app clears it or you clear browser data.

Hosting and email providers may retain operational logs and correspondence separately from app sessions, according to their settings and obligations. The app does not set a fixed deletion period for those provider records.

Pinterest handles sign-in and receives API requests. Your browser requests images directly from Pinterest’s image servers, which receive normal connection information such as your IP address. Opening an original Pin takes you to Pinterest. See Pinterest’s Privacy Policy.

Hosting providers can process request details such as IP addresses, browser information, requested URLs, timestamps, and errors to deliver and protect the service. Providers may process information outside Guyana. We may disclose information where legally required.

Product analytics is currently disabled in VisionFlow. We will review this policy before enabling analytics. The optional feedback cookie described below is functional, not an analytics identifier. This policy page is hosted on the VantaRock website through Netlify. That website uses Google Analytics with its existing cookie controls, and browser storage for consent choices and referral or campaign information. These website practices are separate from the VisionFlow player; see the website privacy policy.

When the feedback board is available, Supabase stores suggestion titles, optional descriptions, moderation status and votes. New suggestions are private until approved; approved suggestions become public. Please leave out personal information.

Opening feedback sets a random, first-party, HttpOnly cookie for up to 90 days. We store a keyed hash of its identifier in the database, rather than the original value. This supports one vote per browser identifier and removing a vote, without registration or fingerprinting. It does not guarantee one vote per person. We do not collect raw IP addresses for voting. Separate hashed identifiers and aggregate counters limit abuse; Pinterest request counters may use a keyed hash of a random session identifier, never a Pinterest token or account identifier.

Votes expire after 90 days; pending or rejected suggestions and submission hashes after 30 days. Expired feedback records are removed on the next feedback operation. Approved suggestion text remains until we retire or delete it. Rate-limit records expire within 24 hours and are removed on a subsequent rate check. Supabase and other providers may retain backups and operational logs under their own settings.

We protect session tokens with encryption, restrict their lifetime, validate OAuth requests, and keep client secrets and access tokens out of browser JavaScript. Hosted connections use HTTPS and secure cookies; local development uses loopback HTTP. No system or transmission can be guaranteed completely secure.

Disconnect Pinterest in VisionFlow to clear its session cookies and loaded board data. This does not revoke Pinterest’s app grant or delete any Pinterest content. To revoke authorization, remove VisionFlow from your connected apps in Pinterest’s settings. You can also clear browser data or stop using the app. Clearing the feedback cookie removes its browser identifier; anonymous votes remain until expiry, and we may then be unable to link them to you.

Contact us to request access, correction, or deletion of information we hold. Identify a suggestion by its title or public link; do not send OAuth tokens or cookie values. Depending on applicable law, you may also have rights to restrict or object to processing, obtain a copy, or complain to a relevant authority. We may need to verify your identity. Manage information held by Pinterest directly through Pinterest.

VisionFlow is not intended for children under 13. If you believe a child has provided information to us, please contact us. We may update this policy as the application changes and will publish the revised policy with a new effective date.