Cabinet Privacy Policy

Last updated: 1 September 2026

Terms of Service

For workplace and IT review

This section exists to answer one question precisely: "Can I use Cabinet with my work email and company-approved AI accounts?" Everything in it is expanded further down the page.

The trade-offs are listed under Known limitations.

What Cabinet is

Cabinet is a local-first visual board app for notes, shapes, tables and images. By default it needs no account and uploads nothing: boards live in your browser. An optional Cabinet account adds collaboration (shared boards), AI image tools and optional marketplace features; those features are backed by a small server side — serverless functions and a database — described on this page. For a signed-in account, Cabinet checks whether the marketplace is available even if you do not open it. Other optional actions send the data described here when you use them.

Where your boards are stored

• Private boards: in your browser. Saved to this browser's local storage (IndexedDB) on your device as you work. They are never uploaded — not to Cabinet's database, not anywhere — unless you explicitly share or publish a board, or enable Drive backup.
• Google Drive backup (optional): an encrypted vault file in your own Google Drive's private appDataFolder. Encrypted on your device before upload — see Encryption.
• Shared boards (optional): a copy of the board you chose to share, stored on Cabinet's server so other people can see it — see Sharing. Sharing one board does not upload any of your other boards.
• Marketplace snapshots (optional): publishing an adventure uploads that version's snapshot to Cabinet's private Supabase storage. It is not end-to-end encrypted. Buyers receive it only through Cabinet's entitlement-checked delivery route, but the operator can technically access the stored snapshot.

Cabinet accounts

• Accounts are optional; they exist for sharing, AI and marketplace features. You sign up with an email address and password, handled by Supabase Auth (Cabinet's database provider), which stores your email and a hash of your password. There is no Google/GitHub social login for Cabinet accounts.
• You can set an optional display name. It is shown instead of your email, and it is visible only to people who are on a shared board with you. Your email address is never shown to other users — without a display name you simply appear as "Account".
• Your sign-in session is kept in your browser by the Supabase client library and ends when you sign out.
• Forgotten passwords: Cabinet can email you a single-use link to choose a new password, sent by Supabase Auth. The same wording is shown whether or not that address has a Cabinet account — so the form cannot be used to find out who has one — and Cabinet never sees your password, then or at any other time. It cannot recover one for you; a new link is all it can ever send.

Sharing

Sharing uploads a copy of board content for collaboration. Publishing to the marketplace is the other feature that uploads board content; it is described under Solana wallet and the marketplace.

• What is uploaded: the shared board's full content — text, shapes, tables, and its images/audio/video/PDF files — plus its title. Your camera position and archived/deleted metadata are stripped. It is stored in Cabinet's database and file storage (Supabase).
• Shared boards are not end-to-end encrypted. They are stored in readable form on the server — that is what makes them viewable by invited people and link holders. Transport is HTTPS, and Supabase encrypts data at rest, but the operator of Cabinet could technically access shared board content, and must be able to for the feature to work. Treat a shared board like content uploaded to any web service — don't share what shouldn't leave your machine. Private boards are unaffected.
• Inviting people: invites are by email address, as viewer or editor. The invited address is stored until the invite is accepted, declined, or revoked, and is then deleted. Members of a board can see each other's display names.
• Invitation emails: Cabinet sends the invited address one email saying who invited them, to which board, and where to open Cabinet. It is delivered by Resend, which therefore sees that address and the message. The email never says whether the address already has a Cabinet account — one wording goes to everybody. The link in it opens a screen naming the invitation — the board's title, the inviter's name and the offered role, visible to anyone who has the link — but it grants no access to the board itself: the invitation is accepted only after signing in with the invited address. To limit how much mail one account can send, Cabinet keeps a short record of each invitation email — the recipient's address and the time — and deletes it after a day.
• People you have invited before: so the invite box can suggest them again, Cabinet remembers the addresses you have invited, with the role you last chose. This list is private to your account — nobody else can see it, and it grants no access to anything. You can remove any entry from the sharing panel, and the whole list goes when your account does.
• AI images on shared boards record who generated them: when a member generates an image on a shared board, the generation is stored with their account id and their display name as it was at that moment, and shown to the board's members ("by Gigi"). That record is part of the board's content, so it travels with exports and copies of the board. Anonymous link viewers are the exception: the server removes generator names from what a link serves, so holding a link never reveals who the collaborators are. Generation always runs on the generator's own provider key and credit — never the board owner's.
• Share links: a link makes the board viewable by anyone who has the link, with no sign-in. The link's token travels in the URL fragment and is sent to the server in a request body, not in the URL path — so it doesn't leak through referrer headers, and responses are marked non-cacheable. Media files are served through short-lived signed URLs (5 minutes).
• Links do not expire on their own. "Reset link" invalidates the old link and mints a new one; "Turn off" revokes link access entirely.
• Link passwords: a link can also require a password. Cabinet stores only a salted hash of it — it can be replaced, never recovered — and the password travels in a request body, never in a URL or a log. A successful unlock is remembered on your device for 12 hours in a cookie that names only that board; changing or removing the password takes effect on the next request.
• Deleting a shared board removes it from the server immediately and permanently — shared boards have no bin and no undo (Cabinet asks twice before deleting one). Its media files become inaccessible at the same moment and are removed from storage in periodic clean-ups.

Google Drive access (narrow scope)

• Cabinet requests only this Google Drive scope:
  https://www.googleapis.com/auth/drive.appdata
• This scope grants access only to the app's own private application-data folder (Google Drive appDataFolder). Cabinet cannot browse, read, edit, or delete the files in your normal Google Drive.
• The Google sign-in token is used only to read/write Cabinet's own backup file. It is held in memory for the session, is never used as the encryption key, and is not stored after you close the tab.
• Connecting Drive loads Google's sign-in script from accounts.google.com — the one third-party script Cabinet ever loads, and only when Drive sync is used.

How Cabinet uses Google user data (Limited Use)

Cabinet's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• The only Google user data Cabinet accesses is the single encrypted Cabinet vault file it stores in your Drive appDataFolder.
• Cabinet does not sell your Google user data and does not use it for advertising.
• Cabinet does not share your Google user data with third parties, except as necessary to provide the app's user-facing functionality — namely transmitting your own encrypted vault to and from your Google Drive at your request.
• Cabinet does not allow humans to read your Google Drive app data. The vault is encrypted on your device before upload, and no Cabinet server or operator can decrypt it.

Disconnecting Google Drive

You can revoke Cabinet's access to your Google Drive at any time from your Google Account → Data & privacy → Third-party apps & services, and remove Cabinet. You can also disconnect from within Cabinet (the Drive Sync panel) and delete the Cabinet vault file from your Drive. Revoking access does not affect boards saved locally in your browser.

Encryption

• Full backups and the Google Drive vault are encrypted on your device (AES-GCM 256, key derived from your passphrase with PBKDF2-SHA-256 at 600,000 iterations). Google — and Cabinet's own hosting — only ever see encrypted data. Nobody can reset a forgotten passphrase, including us.
• Single-board exports come in two forms. "Export current board" produces a plain, unencrypted .cabinet-board.json file that anyone with the file can read — only share these with people you intend to. "Export password-protected board" produces an encrypted board file protected by a password you choose (separate from your vault passphrase); the password is never stored and cannot be recovered.
• Shared boards are the exception: they are stored unencrypted on the server so that other people can view them — see Sharing.

AI features (bring your own key)

• AI image tools are optional and off until you add a key. Cabinet connects to two providers: Scenario and PixelLab.
• What is sent: your prompts, and — for tools that work on an image — the image you're editing or uploading. Requests go from your browser through Cabinet's gateway to the provider. The gateway exists because provider API keys must not be exposed to browser calls; it forwards each request and stores nothing and logs nothing — no prompts, no images, no keys, no AI history is kept on any Cabinet server.
• Your own account, your own key: every AI request is authenticated with the API key you provide and spends your own provider credit. Cabinet holds no shared or "guest" provider keys in production. What a provider does with your prompts is governed by your agreement with them — check their policies, especially for work accounts.
• How your key is stored: sealed (encrypted and signed) into an HttpOnly cookie in your own browser, scoped so it is only ever sent to Cabinet's AI endpoints. Page JavaScript cannot read it, it never enters Cabinet's database, and the gateway unseals it in memory per request to authenticate you with the provider, then discards it. The key is bound to the account that saved it — someone else signing in on the same browser cannot use it.
• Signing out does not remove saved keys (so you don't have to re-enter them every session). Remove them in the AI keys panel, or by clearing this site's cookies.
• Generated images are downloaded to your board from the provider's own file servers.

GitHub (optional)

Connecting GitHub uses a GitHub App sign-in and only touches the repositories you give the app access to. Reads and commits happen only when you ask for them. Tokens are handled server-side in a sealed session and are never exposed to page JavaScript or stored in Cabinet's database. See GitHub's privacy statement.

Solana wallet and the marketplace (optional)

Solana transactions and wallet addresses are public. Linking tells Cabinet which public address belongs to your Cabinet account. Payments involving that address can be inspected on the public chain and linked to one another. Cabinet cannot make those records private or remove them from Solana.

To link a wallet, Cabinet sends a short-lived challenge and receives the signed message and signature needed to verify it. The stored wallet row contains your account id, public address, chain, network and timestamps; it does not contain the signed message or signature. Cabinet never asks for, receives or transmits your private key or recovery phrase.

For a payment, Cabinet creates an unsigned transaction and gives those bytes to your wallet. The wallet signs and submits it. Cabinet receives the resulting signature and later downloads the already-submitted, signed transaction from a Solana RPC provider to verify it. Cabinet has no buyer-wallet key and does not sign or submit the transaction itself.

Linking a wallet does not make it a Cabinet sign-in method. Linking by itself does not publish the connection between your wallet and Cabinet account to other users. If you publish a marketplace listing, however, its seller wallet and creator account id are readable by signed-in users while the listing is active; the payout address is also public on Solana.

A verified purchase creates a purchase row and a separate entitlement for your account. The records include the product version, buyer wallet, amount and payment token, transaction signature, licence kind and version, purchase-terms version and timestamps. Those buyer records are removed by a successful account deletion. The public Solana transaction is not removed.

While the marketplace panel is available, its Unlink button deletes the active wallet-connection row. It does not delete the same address from existing quotes, purchases or seller listings, and it cannot remove an on-chain transaction.

Link previews

When you paste a web link onto a board, Cabinet's server fetches that URL once to build the preview card (title, description, image). Only the URL you pasted is involved — never board content. Cabinet's code does not store the URL or write it to its logs; like any web request, it appears in the hosting platform's standard access logs.

Cookies and local storage

Cabinet sets no tracking cookies — only functional cookies and browser storage:

• Boards, preferences and sync bookkeeping in this browser's local storage and IndexedDB.
• Your Supabase sign-in session, kept by the Supabase client library and cleared on sign-out.
• A short-lived, sealed session cookie while you are signed in, identifying your Cabinet account to Cabinet's own API.
• The sealed AI keys cookie described above, if you add AI keys.
• A sealed GitHub session cookie, if you connect GitHub.
• A short-lived, sealed wallet-link challenge cookie while you prove control of a wallet. It is destroyed when verification is attempted.

Service providers

Fonts are self-hosted and served from the same site as the app — nothing is loaded from Google Fonts or any other font service. The only third-party script Cabinet ever loads is Google's sign-in script, and only when you use Drive sync.

Logging

Cabinet's own code does not log board content, prompts, API keys, tokens, or pasted URLs — on failures it records only the kind of error. Rate limiting uses your IP address (share-link views) or a hash of your session token (AI requests), held in memory only. Failed link-password attempts are also counted per board — a number and a time, no addresses — to slow guessing. The hosting platform keeps standard access logs, as noted above.

Deletion and sign-out

• Deleting a board removes it from your browser; if it was a shared board, deleting it also removes it from the server, as described under Sharing.
• Turning off a share link revokes access immediately; resetting it invalidates the old link.
• Signing out ends your session. Locally stored boards stay on your device, and saved AI keys stay in their sealed cookie until you remove them (AI keys panel) or clear cookies.
• Google Drive: disconnect and delete the vault file from the Drive panel, or revoke access from your Google account.
• Deleting your Cabinet account: open the Account panel, choose Delete account and confirm with your email address. When it succeeds, this happens immediately and cannot be undone. It removes your account and password, your display name, the shared boards you own — together with their members, invitations and share links — your place on boards other people shared with you, your list of people you have invited before, any invitations addressed to your email address, and any remaining record of an invitation email sent to it, linked-wallet rows, marketplace seller and listing records when no paid reference blocks deletion, and marketplace quotes, purchase rows and entitlements in which you are the buyer. Where you were the last person to save someone else's board, that board stays and the record of who saved it becomes anonymous. Images and other media already uploaded for a shared board become permanently unreachable when the board record goes, and are cleared from storage separately. Your private boards, everything saved on your device and your Google Drive backup are not part of your account and are left untouched. A seller account with a version that somebody has bought can currently be blocked from self-service deletion; see Known limitations below. If you would rather we did it, or something goes wrong, email hello@cabinet.cool.

What Cabinet does not do

• Cabinet does not sell your data.
• Cabinet does not use your data for advertising.
• Cabinet has no analytics, no tracking pixels, no tracking cookies, and no telemetry or crash reporting.
• Cabinet does not train AI models on your data, and it stores no copy of your AI prompts or results with which anyone could.
• Cabinet's operator cannot read local private boards that you have not shared or published, your encrypted vault, or your API keys at rest.

Known limitations

• Shared boards are not end-to-end encrypted; the server (and therefore the operator) can technically access shared content.
• Share links do not expire. Anyone with an unprotected link can view the board until you reset or turn off the link; you can optionally require a password.
• AI providers see your prompts and images; Cabinet cannot control or audit what happens on their side.
• Marketplace snapshots are not end-to-end encrypted. The operator can technically access a snapshot stored for sale, and opening a purchase depends on Cabinet continuing to operate and retain that snapshot. A rights takedown can remove content already bought; a copy already downloaded to your device cannot be recalled. Deleting a marketplace product or account does not currently delete its uploaded snapshot object from Supabase storage.
• Self-service account deletion can currently fail for a seller whose product version has been bought. The purchase history prevents that sold version from cascading away. Contact hello@cabinet.cool if this happens.
• Local-only data can be lost — see below.

Local-only data can be lost

If you don't connect Google Drive, your boards exist only in this browser. Clearing browser data, using private/incognito windows, or switching browsers or devices can make local boards unavailable. If you stay local-only, export an encrypted backup regularly (Vault panel → "Export encrypted backup") so you don't lose access.

Contact

If you have questions about this privacy policy, Cabinet's Google Drive access, or data deletion, contact the Cabinet operator at: hello@cabinet.cool

Changes

This policy may be updated as Cabinet changes. The "Last updated" date above reflects the current version.