Privacy Policy

Who We Are

Capa is run by Capa CMS, operated by Kirby Campbell, Lincoln, Rhode Island, USA. This policy covers the Capa app, the Capa API and capacms.com. “We” and “us” mean Capa CMS.

1. Information We Collect

• Account Information: Name, email address, and data provided during Google sign-in or other integrations.
• Your Content: The entries, models and files you add to a project. We store them and serve them through the Capa API for you. When you upload a JPEG, PNG or WebP image, we remove its location and camera details (its EXIF and similar metadata) before we store it. Other formats, such as GIF and AVIF, and images uploaded before October 4, 2026, are stored as they were uploaded.
• Usage Data: Interactions with the platform, including visited pages and technical data like IP addresses.
• Cookies: Used for user preferences and session tracking.
• Log Data: Server logs including browser types and actions taken within Capa. Our CDN also logs each request it serves for the Capa API and your files, with the IP address it came from.
• Analytics: We use Little Friend for privacy-friendly analytics. It sets no cookies and does not store IP addresses. To connect the pages you view in one visit, it keeps a random id in your browser tab's session storage. The visit ends after 30 minutes of inactivity, and the id is gone when you close the tab. If your browser sends Global Privacy Control, your visit is only counted, never connected. In the Capa app, some visits are recorded as a copy of the pages you view. We chose to show the text on our pages in these recordings. What you type or choose in forms is never recorded, email addresses and phone and card numbers stay masked, and recordings are deleted within 7 days.
• Error Reports: When something in Capa fails, a report goes to Sentry. Section 4 says what it holds.

2. How We Use Your Information

• Provide and enhance the Capa platform.
• Analyze usage for platform improvement.
• Find and fix errors.
• Communicate updates and respond to queries.
• Ensure security and legal compliance.

3. How We Share Your Information

• With service providers for operational purposes.
• To integrate with third-party services like Google APIs.
• In compliance with legal obligations.
• During business transfers (e.g., mergers or acquisitions).

These are the service providers that run Capa for us, and what each one does:

• Fly.io runs Capa's servers.
• BataDB hosts Capa's database.
• Backblaze stores your media files and our CDN logs.
• Fastly delivers the Capa API and your files from locations around the world.
• Vercel hosts the Capa app and capacms.com.
• Stripe handles payments. Your card details go to Stripe, not to us.
• Resend sends our emails, such as password reset codes and invitations, and the messages you send through our contact form.
• Sentry receives error reports.
• Little Friend provides our analytics.
• Google signs you in, if you choose to sign in with Google.

Capa's servers, database and file storage are in the United States.

When you connect a service such as Shopify, we use the access you give us to copy its data into your project.

4. Error Monitoring

We use Sentry to find and fix errors. When something fails on Capa's servers, Sentry receives an error report. It holds the stack trace, the request's web address, method and headers, the IP address the request came from, and which project it was for. It can also hold up to 10 KB of the request's body. Sentry also receives timing data for about 1 in 10 requests, so we can find slow ones.

Before a report leaves our servers, we remove passwords, API keys, session tokens, cookies and other credentials, including any in a web address. We never send the body of a sign-in, password, account, invitation, integration, webhook or Assistant request, or the text of a GraphQL query and its variables.

The Capa app can also report errors from your browser. Those reports carry no IP address, cookies or user details, and never record your screen.

Sentry stores error reports in the United States.

5. Data Retention

We retain data as long as your account is active or as required for legal purposes.

Logs are deleted on a schedule, every night:

• Logs of requests that reach our servers: after 30 days.
• Our CDN's logs: kept in our database for 30 days, then as a compressed archive, which we delete after 180 days.
• The audit trail of actions taken in your projects: after 400 days.

6. Your Rights

• Access and correct your data.
• Request account deletion.
• Opt-out of marketing communications.

7. Security

We use safeguards to protect your data but cannot guarantee complete security.

8. Changes to This Policy

We may update this Privacy Policy. Significant changes will be communicated via email or a notice on our site.

Contact Us

Email: support@capacms.com

Capa CMS, operated by Kirby Campbell, Lincoln, Rhode Island, USA