Privacy Policy

This Privacy Policy describes how Cairn Script ("Cairn"), operated by GoodCraft, LLC ("we"), collects, uses, and shares information about you when you use our service.

1. What we collect

Account data

Email address, name, and password hash. If you sign in with Google, we receive your email, name, and profile image URL through OAuth, nothing else.

Cairn's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to authenticate you and populate your profile, never to train models, serve advertising, or sell to third parties.

Webflow OAuth tokens

When you connect a Webflow workspace, we store an OAuth access token issued by Webflow. The token is encrypted at rest using AES-256-GCM with keys managed by GoodCraft. We use it only to read your sites and write to project-level custom code on your behalf.

Git access tokens

When you connect a Git repository, we store an access token you provide. It is encrypted at rest using the same AES-256-GCM cipher. We use it only to read from and write to the branches you've configured.

Your code

The JavaScript and CSS you author in Cairn is stored in our database and served via our loader to your sites. We do not analyze, profile, or sell your code. We may compute hashes for caching but the source remains private.

Usage data

Standard server logs (IP, user agent, request path, timestamp) and basic product analytics (which features you use, error rates). We do not use third-party trackers for behavioral advertising.

Payment data

Billing is handled by Stripe. We never see your full card number. Stripe's privacy policy applies to the payment data they process on our behalf.

2. How we use it

• To operate the Service: authenticating you, delivering your scripts, syncing with Webflow and Git.
• To support you: responding to email, debugging issues you report.
• To bill you: through Stripe, for paid plans.
• To improve the Service: aggregate analytics inform what we build.

3. Sharing

We share data only with sub-processors necessary to run the Service. Current sub-processors:

• Stripe (payments)
• Amazon Web Services (hosting, storage)
• Postmark (transactional email)

We will never sell your data. We may disclose data in response to valid legal process; we'll attempt to notify you first unless prohibited.

4. Your rights

You can request a copy of, correction of, or deletion of your data by emailing privacy@cairnscript.com. We respond within 30 days.

5. Retention

Account and code data are retained while your account is active. After cancellation, code and version history are retained for 90 days, then deleted. Encrypted OAuth and Git tokens are deleted immediately on disconnection.

6. Security

We use HTTPS for all traffic, encrypt sensitive credentials at rest with AES-256-GCM, guard against SSRF on outbound requests from your scripts' dependencies, and run a least-privilege model on production systems. See our Security overview.

7. Contact

Questions? privacy@cairnscript.com.