Currently, StateLayer does not collect any personal information from users. We do not require user accounts, and no data is stored or processed on our servers.

When we implement account functionality in the future, we will collect only essential information needed to provide the service, including:

• Basic profile information from third-party authentication providers (Google/GitHub)
• Email address for account management and communication
• Name and profile picture for personalization

Information We Collect Automatically: We collect standard server log information for security and debugging purposes. This includes your browser type, and operating system. This data is used solely for security and debugging purposes and is not linked to any identifiable user.

Sensitive Information: We do not collect or process any sensitive personal information, such as data related to your health, finances, or ethnic origin.

Currently, since we do not collect or store any personal information, we do not use personal data for any purposes.

When we implement account functionality in the future, we will use collected information only for essential service purposes:

• To create and manage user accounts
• To provide personalized user experiences
• To communicate important service updates and security notifications
• To ensure platform security and prevent abuse

To Communicate With You: Once accounts are implemented, we may use email addresses for critical service updates (e.g., changes to our Terms), security alerts, or major new feature announcements. Every non-essential email will contain a clear unsubscribe link.

For Improvement & Analytics: Currently, we do not collect any analytics on how you use the editor. If we introduce analytics in the future to improve the product, we will update this policy and provide a clear way for you to opt-in.

We do not sell your personal information. We only share it in the following limited circumstances:

Service Providers: We use trusted third-party providers to operate our Service. Our infrastructure and data storage are hosted on Cloudflare. Should we introduce paid plans, payment processing will be handled by Razorpay. These providers only have access to the information necessary to perform their functions and are contractually obligated to protect your data.

Legal Requirements: We may disclose your information if we are required to do so by law or in response to a valid, binding legal order, such as a court order or warrant.

Business Transfers: If StateLayer is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your information is transferred and becomes subject to a different privacy policy. The new owner will be required to honor the commitments made in this policy.

Advertisers: We do not share or sell your personal data to advertisers. Our business model is based on subscriptions, not advertising.

Currently, since we do not collect or store any personal information, there are no data security or retention concerns.

When we implement account functionality in the future, we will implement industry-standard security measures including:

• Encryption of data in transit and at rest
• Secure authentication systems
• Regular security audits
• Data backup and recovery procedures
• Retention policies that minimize data storage to only what is necessary

Once accounts are implemented, users will have control over their personal information.

Access: Once accounts are implemented, users will be able to request a copy of the personal data we hold about you. We will provide a way to do this through your account settings.

Correction: Once accounts are implemented, users will be able to correct their name and profile picture are synced from the service you use to sign in (Google/GitHub). To correct this information, you must update it at the source.

Deletion: Once accounts are implemented, users will be able to use a simple, one-click process in your account settings to permanently delete your account and all associated data.

Opt-Out: Once accounts are implemented, users will be able to unsubscribe from any non-essential emails with a single click in the email's footer.

Currently, StateLayer uses minimal cookies and tracking technologies. We use essential cookies for basic website functionality and security.

When we implement account functionality in the future, we will expand our use of cookies to include:

• Authentication cookies to keep users logged in
• Session management cookies
• Security cookies to prevent abuse
• Preference cookies to remember user settings

Our Service is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under this age, we will take steps to delete that information immediately.

Policy Changes: We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through a prominent notice within the Service.

Contact Us: If you have any questions or concerns about this Privacy Policy, please contact us at support@statelayer.com.

Once accounts are implemented, users in the European Economic Area (EEA), UK, Switzerland, or California will have specific rights regarding their personal information.

For Users in the European Economic Area (EEA), UK, and Switzerland (under GDPR)

Once accounts are implemented, users in the EEA, UK, or Switzerland will have the following rights under the General Data Protection Regulation (GDPR):

• Lawful Basis for Processing: We primarily process your personal data based on the "Performance of a Contract"—that is, to provide you with the Service you signed up for.
• The Right of Access: Once accounts are implemented, users will have the right to request a copy of the personal data we hold about you.
• The Right to Rectification: Once accounts are implemented, users will have the right to have any inaccurate or incomplete personal data corrected.
• The Right to Erasure (The 'Right to be Forgotten'): Once accounts are implemented, users will have the right to request the deletion of your personal data under certain conditions.
• The Right to Restrict Processing: Once accounts are implemented, users will have the right to request that we restrict the processing of your personal data under certain conditions.
• The Right to Data Portability: Once accounts are implemented, users will have the right to receive your data in a structured, commonly used, and machine-readable format.
• The Right to Object: Once accounts are implemented, users will have the right to object to our processing of your personal data where we do so based on our legitimate interests.

To exercise any of these rights, please use the tools provided in your account settings or contact us at support@statelayer.com. You also have the right to lodge a complaint with your local data protection authority.

For Users in California (under CCPA/CPRA)

Once accounts are implemented, users in California will have the following rights under California's privacy laws, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• We Do Not "Sell" or "Share" Your Information: As a core principle, we do not "sell" your personal information, nor do we "share" it for the purpose of cross-context behavioral advertising.
• The Right to Know: Once accounts are implemented, users will have the right to know what personal information we have collected about you, the sources from which it was collected, and the purposes for which we use it.
• The Right to Delete: Once accounts are implemented, users will have the right to request the deletion of your personal information, subject to certain exceptions.
• The Right to Correct: Once accounts are implemented, users will have the right to request the correction of inaccurate personal information.
• The Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise your rights, please contact us at support@statelayer.com.