Burch Technology ("Burch", "we") makes free apps that run in your browser, including the Burch Technology Hub at burch.app, Mosaic and Templates. This policy explains what happens to your information when you use them. The short version: your work stays on your device unless you choose to save a cloud copy, we don't track you, and we don't sell or share your data.
Who we are
Burch Technology, California, USA. Contact: support@burch.app.
Using the apps without an account
You don't need an account. Without one, we don't collect personal information: no sign-up, no analytics, no advertising and no tracking pixels.
What you make (photos, designs, audio, templates and their data) and your settings are stored in your own browser, on your own device. They aren't uploaded to us.
Microphone and MIDI devices: Mosaic Audio asks your browser for the microphone only when you press Record, and for MIDI devices only when you choose to connect a MIDI keyboard. What you record and play is processed on your device and saved with your project there; it isn't sent to us or anyone else. You can turn these permissions off at any time in your browser's site settings. The Cookies and storage page lists everything the apps store and why.
If you create a Burch account
A Burch account is optional. It lets you sign in on any device, sync your Burch settings, and keep cloud copies of your work. If you create one, we store:
- Your email address, to sign you in and to send account email (confirmation links, password resets and security notices). We don't send marketing email.
- Your username, display name and profile picture, which you choose and can change.
- How you sign in: a one-way, salted hash of your password (never the password itself), and, if you use "Continue with Google", Google's identifier for your account. From Google we receive only your name, email address, whether Google has confirmed it, and your profile picture. We copy the picture to our own storage.
- That you confirmed you're old enough (see Children), and when.
- Synced settings: your theme, motion setting and recent items, so they follow you between devices.
- Cloud copies of projects and workspaces you choose to save, with their names and sizes. We don't look at, analyse or share what's in them.
- Signed-in devices: for each session, a short device label (like "Chrome on Windows"), when it started and when it was last used, so you can see and end them.
- Security limits: to slow down repeated sign-in or sign-up attempts, we briefly keep a count tied to a one-way hash of your IP address or email address. These counts expire within an hour.
We use this information only to provide your account and keep it secure. We keep it until you delete your account. An email sign-up that's never confirmed is deleted after 24 hours.
Who processes it for us
We don't sell or share your information. These providers process it only to run the service for us:
- Cloudflare, Inc. hosts burch.app, the account service, its database and file storage. Like any web host, it also processes your IP address, the pages you request and technical details such as your browser type, for security and to keep the site running. See Cloudflare's privacy policy.
- Resend sends account email from accounts@burch.app. It receives your email address and the message. Open and click tracking is turned off. See Resend's privacy policy.
- Google, only if you choose "Continue with Google": you sign in on Google's own page, and Google tells us who you are. See Google's privacy policy.
Your information may be processed in the United States and other countries where these providers operate.
When you first use a Mosaic smart tool, its model files download from burch.app, just like the rest of the app. Nothing you're working on is sent.
Cookies and tracking
We use one cookie, and only if you sign in: a session cookie that keeps you signed in. It's strictly necessary for the account to work, it isn't used for anything else, and it's removed when you sign out. While you're in the middle of "Continue with Google", a second short-lived cookie (10 minutes) protects that sign-in from being tampered with. We don't use advertising or tracking technologies, and we don't allow third parties to collect information about you on our site. Do Not Track: because we don't track you across sites or over time, we treat every visitor as if Do Not Track is on. Details are on the Cookies and storage page.
Children
Burch accounts are for people 13 and older (16 and older where local law requires it, for example in some EU countries). Everyone can use every app without an account. We don't knowingly collect personal information from children under 13. If you believe a child has created an account or sent us personal information, contact us and we'll delete it.
Your choices and rights
- On your device: use Settings → Delete all my Burch data on this device, or clear this site's data in your browser.
- In your account: on your account page you can change your profile, download your data, end sessions on other devices, delete individual cloud copies, or delete your account. Deleting your account removes your account, synced settings, cloud copies and picture right away; copies kept briefly in our providers' backups expire on their own schedule.
- If you email us, we use your message only to reply, and we delete it when it's no longer needed. You can ask us what we hold about you, to correct it or to delete it.
- California residents: we don't sell or share personal information, and we don't use it for targeted advertising. You have the right to know, correct and delete personal information, and the right not to be discriminated against for using these rights. Contact us to make a request.
- If you're in the EU, UK or elsewhere with similar laws: Burch Technology is the controller of your personal data. We process account data to provide the account you asked for (performance of a contract), and request and security data based on our legitimate interest in running a secure service. You can ask to access, correct, delete, restrict or port your data, or object to processing. You can also complain to your local data protection authority.
Security
Connections are encrypted (HTTPS). Passwords are stored only as salted hashes, session tokens and email links are stored only as hashes, and email links expire (24 hours to confirm an email, 1 hour to reset a password). No system is perfectly secure, so use a password you don't use anywhere else. If we learn of a breach that affects you, we'll tell you as the law requires.
If this changes
If we change how we handle personal information, we'll update this policy before the change takes effect, ask for consent where the law requires it, and show the date of the change at the top. For significant changes, we'll also email account holders.
Contact
Questions or requests: support@burch.app.