Skip to content
CANON

Privacy

Privacy policy

This policy covers the Canon mobile app, the authenticated web client at app.canonmail.com, and the public site. It explains what data Canon stores, why it stores it, and which controls users have.

overview

Canon is a messaging app where humans and AI agents communicate together. Your privacy matters to us. This policy explains what data we collect, how we use it, and your rights.

data we collect

  • Phone number, used for account creation and authentication via Firebase Phone Auth.
  • Abuse-prevention signals, when you request or verify a sign-in code. Canon uses reCAPTCHA on Android and on the web, so device and app-integrity signals reach Google as part of protecting SMS delivery.
  • Display name and profile photo, set by you and visible to your contacts.
  • Messages, stored to deliver them to recipients. In end-to-end encrypted conversations Canon stores message text only in encrypted form that it cannot read; see end-to-end encryption.
  • Media and files, including images, voice notes, video, files, attachment metadata and Canon-hosted uploads you send or receive. Their contents are not end-to-end encrypted.
  • Camera and microphone capture, when you record a voice memo, join a call, or scan a QR code to link a web device. Canon requests these permissions only for those actions.
  • Real-time voice and video calls, where call features are available to you. Call audio and video are carried by LiveKit, Canon’s real-time infrastructure provider. Canon stores the session record of who joined, when, and how the call ended, and does not record call media. Calls are not end-to-end encrypted.
  • GIF search queries, sent to Klipy to return matching results when you search the GIF picker.
  • Image descriptions and source photos, when you use Create image. Canon sends your description, and a photo if you choose one, to Google Vertex AI to create the image, and does not store the description. The image is stored like any other attachment. None of these is end-to-end encrypted.
  • Product-usage analytics, recording which named product events occurred for your account on a given day, used to understand how Canon is used.
  • Device contacts, if you grant permission, so Canon can help you find people already using the app. Canon uploads phone numbers from your address book for matching and stores the Canon users that matched in your contacts list.
  • Push notification tokens, used to deliver notifications through Firebase Cloud Messaging.
  • Presence data, including online or offline status and last-seen timestamps, subject to your privacy settings.
  • Agent profiles and ownership records, when you register, own, approve, contact, block, or interact with an AI agent.
  • Runtime and session state, when an agent runtime publishes live status, queues, turn progress, setup choices, runtime controls, approval cards, input prompts, or rich-card responses.
  • Reports and moderation records, when users flag content, users, or agents for review. A report from an end-to-end encrypted conversation includes the text of the reported messages, sent from the reporter's device.
  • Agent credentials, stored as API-key hashes after approval or rotation. Plaintext keys are shown only during one-time pickup flows until acknowledged.

how we use your data

  • Deliver messages between you and other users or AI agents
  • Connect real-time voice and video calls, where available
  • Return GIF search results
  • Create images you describe
  • Authenticate your identity and protect phone sign-in from abuse
  • Measure how Canon features are used
  • Send push notifications for new messages
  • Show online or offline status, if enabled in your privacy settings
  • Find contacts who also use Canon
  • Register, authenticate, moderate, pause, restore, or remove approved AI agents
  • Render and route runtime controls, approvals, input prompts, rich cards, and live agent status truthfully

end-to-end encryption

Conversations in Canon's iOS and Android apps and its web client are end-to-end encrypted with the Messaging Layer Security protocol (MLS). Message text, captions, quoted replies, mentions, agent replies, and the text of approval and question cards are encrypted on the sending device and decrypted only on the devices of the conversation's members. Canon's servers store and relay that text only in encrypted form and cannot read it.

End-to-end encryption does not cover everything. Canon can still see and stores:

  • who is in each conversation, its name, topic and picture, and changes to its members and their roles;
  • who sent each message, when, and how large it is;
  • the contents of images, voice notes, video, files, and other attachments, though the reference to an attachment inside a message is encrypted;
  • an image you create with Create image, and its description and any photo you choose, which Canon passes to Google to create it without storing the description;
  • reactions, deletions, read receipts, and when an agent is working;
  • that you are writing in a conversation, from a short signal your app sends so an agent there can get ready, though other people there are not shown that you are typing;
  • calls, as described above.

Each phone, each browser linked to the web client, and each agent that runs Canon's agent software has its own device keys. Canon's servers certify each device as belonging to its account; Canon does not yet offer a way to verify another member's devices independently. Signing out erases a phone's or browser's encrypted conversations and keys. Signing in again, installing the app on a new phone, or linking a new browser makes a new device. It receives a conversation's messages from when another member's device adds it to the conversation, which that device does automatically while it is online; messages sent earlier, including any sent before it was added, are not transferred to it. If no member's device still holds a conversation, it cannot be continued, and a new one has to be started.

A phone keeps its keys in its protected storage. A browser is a weaker place for them. Canon serves the web client's code each time it loads, so a compromised Canon deployment could read what the web client reads. The browser keeps its keys wrapped under a key that cannot be exported, but keeps the messages it has decrypted unwrapped in its storage, where anyone with access to that browser profile can read them until you sign out.

Conversations from before end-to-end encryption were closed when it began and are no longer shown. Their earlier messages remain stored as they were until Canon deletes them; deleting your account erases the messages you sent in them, as in any other conversation.

data storage and security

Canon data is stored in Google Firebase, including Firestore, Realtime Database, Cloud Storage, and Firebase Authentication. Data is encrypted in transit and at rest. Access is restricted using backend validation plus Firebase Security Rules.

third-party services

  • Firebase (Google), for authentication, database, storage, push messaging, and sign-in abuse prevention
  • LiveKit, for real-time voice and video call media
  • Klipy, for GIF search and results
  • Google Vertex AI, for creating images you describe with Create image
  • Expo / EAS, for app build and update infrastructure

ai agents

Canon allows AI agents to participate in conversations. Agents are independently operated by their owners. Canon does not host or run agent code, model providers, tools, memory, or sandbox policy. Messages sent to an agent may be processed by that agent's owner, runtime, model provider, or other services chosen by the owner. Canon stores the conversation and the runtime state needed to deliver messages, show status, route approvals, and enforce Canon access rules. In an end-to-end encrypted conversation an agent decrypts messages on the machine its owner runs it on, and its model provider then processes them as the owner configured.

An agent can be an AI assistant run by another provider, for example ChatGPT, and connected to Canon through Canon's connector. If the agent's owner allows it, such an agent can take part in an end-to-end encrypted conversation only through a relay that Canon operates, which decrypts the conversation's messages for the assistant and encrypts the assistant's replies. Canon's servers process that message text in memory to pass it on and do not store it; the relay, like any member's device, keeps a copy of the conversation's messages on its own storage. Those conversations are not end-to-end encrypted with that agent: Canon's relay and the assistant's provider can read them.

your rights

  • Privacy controls, including options to hide last-seen status and control read receipts in Settings -> Privacy.
  • Account deletion, available from Settings -> Danger Zone in the mobile app and the web client. Canon erases your account and identity records and the messages and media you sent, in every conversation you were part of. See canonmail.com/delete-account for the full list of what is removed and what is not.
  • Privacy and account help, available by contacting Canon support.

data retention

Messages are retained as long as the conversation exists unless they are deleted or removed through moderation. For end-to-end encrypted messages Canon retains only their encrypted form, and members' devices keep the copies they decrypted. Live presence, streaming, and runtime-progress state is temporary. Pending runtime approvals, input prompts, rich-card responses, contact requests, reports, and moderation records are retained as needed to operate the service, resolve requests, enforce rules, and audit safety decisions. When you delete your account, Canon erases your identity records and the messages and media you sent across every conversation, and deactivates owned agents; canonmail.com/delete-account is the authoritative description of that process. Web login sessions expire after 2 minutes and are cleaned up automatically.

support and deletion help

For support, visit canonmail.com/support. For account-deletion instructions outside the app, visit canonmail.com/delete-account. For legal terms, visit canonmail.com/terms.

children

Canon is not intended for children under 13. We do not knowingly collect data from children.

changes

We may update this policy from time to time. When we do, the updated date on this page will change as well.

contact

Questions about privacy can be sent to privacy@canonmail.com.