Last updated 15 August 2026
This explains what Kromia does with your data. It is operated by Mardania LLC, 3380 La Sierra Ave, Ste 104, Riverside, CA 92503, United States. Reach us at hello@kromia.app.
The short version: your designs are yours, most of the work happens inside your own browser, we do not sell or share your personal information, and we run no advertising or behavioural tracking.
Account details. Your email address, and a password hash or the identifier from the sign-in provider you chose. We need this to give you an account and to tell you about your subscription. Kept while your account exists.
Your projects and uploads. Slide layouts, text, and any screenshots or images you upload. Stored so you can come back to your work on another device. Kept until you delete the project or your account.
Payment records. Which plan you bought, when it renews, and the last four digits and brand of the card, as reported back to us by Stripe. We never see or store your full card number — it goes straight from your browser to Stripe. Kept for as long as tax law requires, normally six years.
Technical logs. Server request logs and error reports: IP address, browser and operating system, the page or endpoint involved, and a timestamp. Used to keep the service running, debug faults, and block abuse. Kept 30 days, then deleted.
We do not collect sensitive personal information as California law defines it, we build no advertising profiles, and we do not knowingly collect data from children under 13.
The editor is a local application. Rendering, warping and image export all happen in your browser — exported screenshots are produced on your own machine and downloaded there; they are not uploaded to us. The app also keeps a working copy of your project in your browser’s own storage (localStorage and IndexedDB) so a refresh does not lose work. Clearing site data in your browser removes that copy.
Vercel and Supabase are service providers acting on our instructions under a written agreement; they may not use your data for their own purposes. Data is stored in the United States.
Typefaces come from the Google Fonts library, but your browser never talks to Google to get them: we fetch them server-side and serve them from our own domain, so Google does not see your IP address or which fonts you use.
We will also disclose data if a court or the law requires it — and if we may lawfully tell you, we will.
We use a session cookie to keep you signed in, and Stripe sets cookies during checkout for fraud prevention. Both are strictly necessary, so we do not ask for consent for them. We use no analytics or advertising cookies, which is why you see no cookie banner. We do not track you across other websites, so there is nothing for a Global Privacy Control signal to opt out of.
Whoever and wherever you are, you can ask us to give you a copy of your data, correct it, or delete it. Most of it you can do yourself: your projects export to a file at any time, and deleting your account removes your projects and uploads from our systems. For anything else, email hello@kromia.app. We answer within 45 days, and we will never treat you worse for asking.
If you live in California, the CCPA as amended by the CPRA gives you the right to know what we collect and why, to access it, to correct it, to delete it, to opt out of sale or sharing, and to limit the use of sensitive personal information. Two of those have nothing to act on here: we have never sold or shared personal information, and we do not collect sensitive personal information. You may use an authorised agent; we will ask them to prove you sent them.
If you are in the EU or UK, the GDPR applies to you and our legal bases are: performance of a contract for your account, projects and payments; legal obligation for tax records; and legitimate interests for security logs and fraud prevention. You may also object to processing, restrict it, or ask for your data in a portable form. Your data is stored in the United States; we rely on the Standard Contractual Clauses for that transfer. You can complain to your national data protection authority — in the UK, the Information Commissioner’s Office.
Traffic is encrypted in transit, files and database rows are encrypted at rest by our providers, and access to your rows is enforced at the database level so one account cannot read another’s. Access to production data is limited to what is needed to run the service. If a breach puts you at risk, we will notify you and the relevant regulator as the law requires.
No system is perfectly secure. Keep your own copies of work you cannot afford to lose — the app saves a project to a file on your computer at any time.
If we change this policy in a way that affects you, we will email you before it takes effect. The date at the top always shows the current version.
See also our Terms of Service.