Privacy

Last updated 7 October 2026

Short version: the app keeps your work on your device, and the website counts visits without cookies.

The app

Studio Carto runs in your browser. Your projects, imported files and settings are stored in your browser on your device, or in files you save yourself. We have no server that receives them.

If you use the optional AI assistant, you paste your own DeepSeek API key. The key is stored only in your browser and is sent only to DeepSeek when you ask the assistant for something. Your request, including the data it needs, goes from your browser to DeepSeek under their terms. We never see it. You can remove the key in Settings at any time.

What we measure

The app counts successful DeepSeek key tests and completed AI requests. Only the event name is sent to our Cloudflare service, which stores daily totals, not individual event records or user identifiers. A completed AI request means an answer or proposal was returned, not necessarily applied. These are action counts, not counts of people. Cloudflare also provides separate page-view analytics. PostHog feature analytics is currently disabled.

We never collect your maps, your data, your prompts, file names or your API key. There are no cookies and no sign-in, so events are not tied to a person, a name or an email address, and they are not shared with advertisers.

You can turn it off. The app has an opt-out in Settings for product-usage events. Product analytics on both the app and website respect your browser’s Do Not Track and Global Privacy Control signals. Cloudflare’s separate page-view beacon is not controlled by the app’s Settings toggle.

Feedback

If you submit the feedback form, we receive your message, topic, optional answer about paying for the product, and optional reply email through Zoho’s transactional email service. These contents are not sent to product analytics. We keep them in our inbox to reply and improve Studio Carto. The form uses Cloudflare Turnstile to prevent spam; Cloudflare receives browser and network information for that check. A salted hash of the network address is used for a short-lived submission rate limit. We do not add you to the waitlist or a mailing list. You can also email us directly.

The launch waitlist

If you joined the waitlist, we hold your email address, the use you told us about (if any), and when you joined or unsubscribed. We use it only to email you about the launch, and we delete it afterwards. Every email has an unsubscribe link. To see, correct or delete your details, email admin@studiocarto.com.