BioCartoon

Privacy

Last updated October 26, 2026

Without an account

The web app at app.biocartoon.com keeps your projects, Your library (your own icons, saved templates and favorites), uploads and settings (including any words you add to the spelling dictionary) in your browser's own storage, and the desktop app keeps them in files on your computer. They are not sent to us. Because the browser holds the only copy, clearing your browser's site data deletes them; the app reminds you to download a backup.

Using the app still involves our servers in a few ways:

• Loading the icon library. Icons and the catalog are downloaded from assets.biocartoon.com. Like any website, our host sees your IP address when it serves them.
• Stars. Starring an icon sends the icon's id and a random id the app made for itself when first run. It is not linked to you. We keep a salted hash of your IP address to limit abuse, never the address itself.
• Contributions. If you submit an icon or template to the shared library, we keep what you submitted, the name you chose to be credited under, the contact email you gave if any (seen only by our reviewers, never published), and a salted hash of your IP address for rate limiting. Approved contributions are published openly under the license you picked.
• Suggestions and removal requests. If you suggest an icon or template, or ask for an icon to be taken out of the library, we keep what you wrote, the name and contact email you gave if any (seen only by our reviewers), and a salted hash of your IP address for rate limiting.
• Visit counts. The website and the web app count page visits with GoatCounter. It sets no cookies and doesn't follow you to other sites. It records the page, the site you came from, your browser, screen size and country, and tells repeat visits apart with a short-lived hash of your IP address and browser, never the address itself. The desktop app doesn't count visits.
• AI features. If you add an API key for an AI provider, the key stays on your device, and your prompts go to that provider under its own terms. They don't pass through us.

With an account

Accounts are optional and exist only to keep an online copy of your projects and Your library. You sign in with Google or GitHub, so we never see or store a password. When you sign in we store:

• which service you signed in with, and its id for your account;
• your name and email address, as that service shares them, shown in the app's account menu;
• your projects, including the images in them, with their names, sizes and dates;
• Your library: the icons you added to it (their images, names, descriptions and tags), the templates you saved, and the list of your favorites, with their sizes and dates;
• a salted hash of your IP address when the account is created, to limit sign-up abuse;
• a fingerprint (hash) of each sign-in token, so the app can stay signed in. The token itself lives only in your browser.

We use this only to store and return your projects and library. We don't read them, use them to train anything, show them to anyone, or email you.

Cookies

BioCartoon sets one cookie, only while you sign in: a short-lived one on api.biocartoon.com that proves the sign-in was started from BioCartoon. It expires after 10 minutes. The app stays signed in with a token in your browser's storage, not with a cookie.

Who handles your data

• Cloudflare hosts the website, the app and our server, and stores account data, online projects and online libraries (Cloudflare's privacy policy).
• GoatCounter counts visits to the website and web app (GoatCounter's privacy policy).
• Google or GitHub confirms who you are when you sign in with them (Google, GitHub). We ask only for your basic profile and email address.

How long we keep it

• Online projects, library items and account details are kept until you delete them or your account.
• A sign-in ends after 180 days without use. Your projects and library stay online, and signing in again brings them back.
• Deleting a project, or removing something from Your library, in the app while signed in also deletes its online copy.
• Deleting your account removes your projects, library, name, email and sign-ins right away. Copies may remain in our hosting provider's automatic database backups for up to 30 days before they are overwritten.

Your choices

• See or download your data: every project is in the app, and "Download a backup" saves them all as files.
• Delete your data: in the web app, open the account menu (top right of the home screen) and choose "Delete account".
• Stop using an account: choose "Sign out". Your projects stay in your browser.

You can also ask us to access, correct or delete your data, or ask any question about it, by contacting us below.

Children

BioCartoon is made for researchers, students and educators. Accounts aren't intended for children under 13, and we don't knowingly collect their data.

Changes

If this policy changes, we'll update the date at the top. If a change affects how your account data is used, we'll say so in the app before it takes effect.

Contact

Joseph Rich, who runs BioCartoon. Open an issue on GitHub, or email josephrich98@gmail.com.