Privacy Policy

Privacy Policy

Effective: August 2026

The Short Version

Croma does not collect your data. Your files never leave your device. There are no accounts, no analytics on your content, and no tracking cookies. This policy exists for transparency, not because we have anything to disclose.

What Croma Is

Croma is a suite of browser-based creative tools: Pixel (image editor), Books (writing and publishing), and Story (narrative development). All apps run entirely client-side using HTML, CSS, and JavaScript. There is no backend server, no database, and no cloud infrastructure that processes user content.

Data We Do Not Collect

We want to be explicit about this:

  • No personal information (name, email, address, phone)
  • No account data (there are no accounts)
  • No usage analytics or behavioral tracking
  • No telemetry on your creative content
  • No cookies for tracking or advertising
  • No fingerprinting or cross-site tracking
  • No data shared with or sold to third parties

Data Stored Locally on Your Device

Croma apps store data on your device using standard browser APIs. None of this data is ever transmitted to any server.

  • localStorage: UI preferences only (theme choice, panel sizes, toolbar positions). This stays in your browser and is never transmitted.
  • IndexedDB: Project autosave data (Story, Books). Stored entirely in your browser's local database. Never uploaded or synced anywhere.
  • File System Access API: When you explicitly save or open files, the browser mediates direct access to your local filesystem. Croma never sees file paths beyond your active tab.
  • In-memory (RAM): Active project data while you are working. Cleared when you close the tab.

You can clear all stored data at any time through your browser's settings (Clear Site Data).

Third-Party Connections

We want to be transparent about the minimal network activity that does occur:

  • Google Fonts: The landing and marketing pages load typefaces (Fraunces, Inter, JetBrains Mono) from Google's font CDN. This means Google may receive your IP address when loading these pages. The editor apps themselves do not make this connection.
  • Hosting provider: The static HTML, CSS, and JS files are served from a web host. Standard HTTP server logs (IP address, user agent, timestamp) may exist at the hosting level. Croma does not access or process these logs.

No other third-party scripts, SDKs, analytics pixels, or advertising beacons are loaded.

Pixel's Optional AI Features

Pixel includes optional AI-powered image editing features. Here is how they work:

  • AI features are entirely opt-in. They never activate without your explicit action.
  • When used, image data is sent directly from your browser to the AI provider you choose. You supply your own API key.
  • Croma does not intermediate, proxy, store, or log any data sent to AI providers.
  • Your API key is stored in your browser's localStorage and is never transmitted to Croma.
  • The data handling for AI requests is governed by your chosen provider's privacy policy.
  • If you never use AI features, no image data ever leaves your browser.

Cookies

Croma does not set any cookies. No first-party cookies, no third-party cookies, no session cookies, no tracking cookies. The apps use localStorage for preferences (described above), which is distinct from cookies and cannot be read by any other website.

Children's Privacy

Croma does not knowingly collect any information from anyone, including children. Since no data collection occurs, regulations like COPPA are not applicable in the traditional sense. Anyone can use Croma without providing any personal information.

Your Rights

Since no personal data is collected by Croma, traditional data subject rights (access, deletion, portability) are inherently satisfied. All your data is already in your possession, stored on your device. You can delete it at any time by clearing your browser storage or deleting local files. No request to us is necessary because we never had your data in the first place.

Why Privacy Is Core to Croma

We believe creative work is personal. Your drafts, your ideas, your unfinished projects belong to you alone. That is why every Croma app is designed to run entirely on your device. There is no cloud sync, no server-side processing, no telemetry on your content, and no account that ties your identity to your work.

We chose this architecture deliberately: if your data never leaves your browser, it can never be leaked, sold, or used to train models. Privacy is not a feature we added. It is the foundation we built everything on.

Changes to This Policy

If this policy changes, it will be updated on this page with a new effective date. Since Croma has no way to contact users (no accounts, no email addresses), checking this page is the only way to see updates.

Contact

If you have questions about this privacy policy, you can reach us at creative@croma.io.