Draft. This page may change before it is final. Version 2026-10-draft1.
Privacy Policy
This policy explains what Carnival collects, why, how long we keep it, and what you can do about it. It covers carnival-staging.dev, the agents that connect to Carnival, and visits to the sites people publish on carnival-staging.page.
Who we are
Carnival is run by [LEGAL ENTITY NAME] ("we"), which decides how your personal data is used: in legal terms, the controller. Questions about this policy or your data: privacy@carnival.dev.
What we collect and why
A "shortened IP address" below means the first three parts of an IPv4 address (a.b.c.0/24) or the first 48 bits of
an IPv6 one (/48): enough to spot abuse from one network, not enough to single out one device.
Your account
- Your email address, and when you confirmed it.
- That you are 18 or older and accept the Terms and Content Policy, which version of the Terms, and when. You confirm this each time you sign in.
- When you sign up: your country, your network (its ASN) and a shortened IP address, so we can spot one person opening many accounts. Accounts are open to people signing up from the US, Canada and Mexico.
- Your time zone, from your connection, so emails and your dashboard show times you recognize.
- Where you signed up from (an agent or the web), your plan, your last sign-in and when you first published a site.
Signing in
- We email you a 6-digit code. We keep a keyed hash of each code (never the code), your address, the attempts and a shortened IP address, to limit guessing.
- With each sign-in session we keep a shortened IP address and your browser's user agent, for security.
- Cloudflare Turnstile checks that a person, not a bot, is signing in or sending one of our forms.
Your sites
- The files your agent publishes: their paths, sizes, types and contents, and the site's title.
- For each deploy: when it happened, which agent and connection sent it, its request ID, and the IP address and user agent of the computer that sent it.
- The results of our checks on it, and its events: went live, redeployed, expired, ended, taken down.
We use these to host your sites, to show you and your agent their status and logs, and to trace abuse back to the account and agent that published it.
Content checks
We check every deploy before it goes live and re-check live sites (Content Policy). Our own rules check the files. Text and images go to AI models on Cloudflare Workers AI, and Cloudflare does not train on what we send it. Up to 20 links from your site, and later your site's own address, go to Google Web Risk, which checks them against Google's lists of unsafe sites. We never use your content for ads or to train AI models.
Reports and notices
When you report a site, send a Take It Down request or a copyright notice, or email abuse@carnival.dev, security@carnival.dev or copyright@carnival.dev, we keep what you send and your name and email address. From our forms we also keep a shortened IP address, a keyed hash of your IP address and your network (its ASN).
Only Carnival's team sees it. The site's owner and their agent never do, with one exception: for a copyright notice we tell the owner your name, the work you named and the address of their removed site, never your email address, other contact details, signature or IP address. If you send a counter-notice, the law requires us to send a copy to the person who sent the notice.
- We email you about your account and sites, such as sign-in codes, a newly connected agent, a site closing tomorrow, a site taken down and why, and your account's deletion. Our emails have no images, remote fonts or tracking pixels. We send no marketing email.
- Email you send to support@carnival.dev gets a ticket number and goes to our team's mailbox. We record that a ticket was opened, not what it says: for 30 days we keep the ticket number, the email's message ID and a keyed hash of your address, so the same email delivered twice keeps one ticket and you get only a few automatic replies a day. Email to privacy@carnival.dev and legal@carnival.dev goes to the same mailbox.
Usage
- Product events: what happened (an account created, a sign-in code sent or used, a connection request shown or declined, an agent connected, a site went live or ended), with IDs, counts and the kind of agent; never email addresses or site content. We use them to improve Carnival.
- Traffic counts for each site (requests, bytes, page views, missing pages), and metrics about our own servers.
- Our servers' logs, which may hold IP addresses, to fix problems and stop attacks.
- Rate limits, which count requests from each IP address over short windows.
Permanent sites waitlist
If you tell us on /keep that you want permanent sites, we keep your answers and note, with your email address or your account. We use the email only to tell you when permanent sites are ready, and the answers to decide what to build.
Why we're allowed to use it
- To provide Carnival (our contract with you): your account, sign-in, hosting and serving your sites, agent connections, and email about your account and sites.
- To keep Carnival safe (our legitimate interests): content checks, abuse reports, rate limits, the security audit log, evidence of takedowns, and tracing a site to the account and agent that published it.
- To meet legal duties: answering valid legal process, preserving data when the law requires it, removing material under copyright and Take It Down notices, and reporting child sexual abuse material to NCMEC.
- To improve Carnival (our legitimate interests): product events and traffic counts, which hold IDs and counts, not content.
- With your consent: the permanent sites waitlist. Ask us to remove you at any time.
Connectors and APIs
When an agent such as Muse connects to Carnival and publishes for you, we receive:
- the tool arguments it sends: files, paths and titles;
- its OAuth client metadata: its
client_id, the name it gives (client_name) and its redirect host; - the MCP client information it sends, such as its name and version;
- the IP address and user agent of the platform making the request (for Muse, Meta's servers; for an agent running on your own computer, yours);
- when you allow the connection, your browser's shortened IP address, network, country and user agent.
We never receive your chats or prompts. Results go only to the client that called. That client's operator (Meta, for Muse) is an independent controller: its own privacy policy covers what you tell your agent. You can see and disconnect your agents on your account page, or with the link in the "New agent connected" email. Scanning includes Workers AI (Cloudflare does not train on inputs). No data is used for ads or model training.
Visitors to hosted sites
Sites on carnival-staging.page are made by Carnival's users, not by Carnival. When you visit one:
- Carnival sets no cookies.
- Our metrics hold no IP addresses. For each request they record the site, the kind of response, its status and your country; for a page view, the page's path and the host of the page that linked to it (the referrer host); for a missing page, its path.
- Our operator logs may hold your IP address. They last 7 days.
- The site's owner answers for their own scripts, forms and the services their site loads, which may collect data under their own terms.
To report a site, use /report.
Cookies
Carnival uses only cookies that are strictly necessary, so there is no cookie banner. They are set on carnival-staging.dev alone, never on the sites on carnival-staging.page.
| Cookie | What it does | How long |
|---|---|---|
__Host-cnv_session |
Keeps you signed in. We store only a hash of it. | 30 days from your last visit, 90 days at most |
__Host-cnv_login |
Holds a sign-in in progress. | 10 minutes |
__Host-oauth-consent-… |
Ties an agent's connection request to the browser that allows it. | 10 minutes |
__Host-cnv_lights |
Remembers that you turned the animation on or off. Set only when you use the Animation button. | 1 year |
Cloudflare Turnstile sets no cookies, and we don't use Cloudflare's bot-detection cookie (__cf_bm).
Who we share data with
We do not sell or share. We don't sell personal information to anyone, share it for advertising, or use it to train AI models.
- Service providers process data for us: Cloudflare (hosting, storage, email, Turnstile and Workers AI) and Google (Web Risk link checks). The full list is on Subprocessors.
- Your agent's platform gets the results of the tools it calls. Its operator (Meta, for Muse) is an independent controller, not our subprocessor.
- A site's owner gets the facts of a copyright notice about their site, as described above.
- Law enforcement gets data only with valid legal process, or in an emergency. We tell the user unless the law bars us. See Law enforcement requests.
- NCMEC gets our reports of child sexual abuse material, as US law requires.
How long we keep data
| Data | How long we keep it |
|---|---|
| Your site's files | Until the site expires, you end it or it is taken down; then deleted within 1 hour. A site under legal hold keeps them until the hold is lifted. |
| Files of a deploy that never went live (rejected, abandoned or expired) | Its upload window (60 minutes on the free plan) plus up to 5 minutes, then deleted. A daily check deletes any left over. |
| Pieces of files uploaded in parts | 60 minutes at most. A storage rule deletes any left after 1 day. |
| Evidence copied when a site is taken down | 180 days. Child sexual abuse material: 1 year, and for now none is deleted (see below). Longer under legal hold. |
| A record that a site address was used: the address, the site's ID, your account ID and its status | Forever, so an address is never given out twice. |
| A site's history: its deploys (with the IP address and user agent that sent each), file lists, events and title | 90 days after the site expires or is ended, unless it is under legal hold or a report about it is still open. A taken-down site's, a new site's that never went live, and a site's with a child sexual abuse report we acted on, are kept for now (see below). |
| Security audit log: sign-ins, deploys, connections and admin actions, with a shortened IP address, a keyed hash of it, network and country | 13 months, and only once a locked copy holds the rows. The locked copy can't be changed or deleted for 400 days. |
| Your account and sign-in methods | As long as you have the account. When you delete it, we erase your email address, sign-in methods, sessions and connections within 24 hours, unless a hold defers it, and keep the rest of the record without them (see below). |
| Sign-in sessions | Until they expire, 90 days at most. Deleted daily. |
| Sign-in codes | 48 hours, because sign-in counts a day of them. Deleted daily. |
| Agent connections and access tokens | As long as you have the account. Revoked or expired ones are deleted after 90 days. |
| Agent sign-in tokens (OAuth) | An access token lasts 1 hour. A connection's refresh token ends after 30 days unused, and 180 days at most. An agent app's registration lasts 90 days, renewed each time it is used. |
| Reports about sites and our takedown decisions, with the reporter's details | 3 years. That period is not final yet, and until it is we delete none. |
| Fingerprints (SHA-256 hashes) of files we took down, so they can't be published again | Indefinitely. Only the hashes, never the files. |
| Product events and daily traffic totals | 13 months; longer under legal hold. |
| Permanent sites waitlist answers | 24 months, or until you ask us to delete them; longer under legal hold. |
| Support tickets: the ticket number, the email's message ID and a keyed hash of the sender's address | 30 days. The email itself stays in our team's mailbox (see below). |
| Traffic and server metrics | 3 months, a period Cloudflare sets. |
| Operator logs | 7 days. |
| Working data of your live sites and uploads in progress | While the site is live or the upload is in progress; retry keys 24 hours; counters 48 hours. Cloudflare's point-in-time recovery keeps 30 days of earlier states. |
| Database backups (Cloudflare D1 Time Travel) | 30 days. Deleted data stays in them until then. |
Records we keep longer, for now
Some records have no end date yet. Where a period is still undecided, we keep the record rather than delete it, and list it here. Until we set these periods with our lawyers, we keep:
- A taken-down site's history: its deploys (with the IP address and user agent that sent each), file lists, events and title, and the file lists of its earlier deploys.
- A new site's history when it never went live (rejected or failed): its deploys and events.
- A site's history when we acted on a report of child sexual abuse material about it.
- Reports and takedown decisions: none are deleted until the 3-year period is confirmed. Even then, those about child sexual abuse material or reported to NCMEC, and those under legal hold or with an open appeal, will be kept longer.
- Evidence of child sexual abuse material: kept at least 1 year, and until a person releases it. Nothing deletes it automatically.
- Email you send to our addresses: kept in our team's mailbox. We have not set a period for it yet.
Legal holds. When the law requires us to keep data, for example a preservation request (held 90 days, and 90 more if renewed) or a child safety case, we put the site or account on legal hold. While the hold lasts we delete none of its records or files, whatever the table above says.
Deleting your account can wait. We defer erasing your data while the account or one of its sites is under legal hold, while one of its takedowns concerns child sexual abuse material, while an appeal is open, or while a report of child sexual abuse material names one of its sites or deploys and we have not dismissed it. Your sites still end and your agents are disconnected at once, and you can't sign in. We check again every day and erase your data as soon as we're legally allowed to.
After erasure we still keep your account's ID (on its sites' address records and in the audit log), and the rest of its account record without your email address or sign-up IP address: when it signed up, confirmed its age and email, first published and last signed in; the app and the country and network it signed up from; its plan, time zone and the terms it accepted; and its standing (reputation, any suspension). If the account was banned, we also keep a keyed hash of its email address so it can't sign up again. Its sites' histories and the audit log keep the periods in the table above.
Your rights and choices
- Download your data: on your account page, choose Download my data. You get a JSON file with your account, sign-in methods, connected agents and access tokens, your waitlist answers, and every site we haven't purged, with its deploys and each deploy's file list.
- Delete your account: on your account page, choose Delete account. It ends all your sites right away, disconnects every agent and signs you out everywhere. We erase your email address, sign-in methods, sessions and connections within 24 hours, or as soon as we're legally allowed to when a hold applies (after erasure).
- Disconnect an agent: under Connected agents on your account page, or with the link in the "New agent connected" email (it works for 7 days).
- Sign out everywhere: on your account page.
- End a site: on your dashboard. It goes offline at once and its files are deleted within 1 hour.
- Anything else: to get data the download leaves out, correct something, delete your waitlist answers, object to a use of your data, or if you can't sign in, email privacy@carnival.dev. We answer within 30 days. If you have an account, write from its email address so we know it's you.
Do Not Track and Global Privacy Control
Carnival does no cross-site tracking or advertising, and does not sell or share personal information, so it treats every visitor as if their browser sent a Do Not Track or Global Privacy Control signal. Nothing changes when it does.
Age
Carnival is for adults. You must be 18 or older to have an account, and you confirm it each time you sign in. If we learn an account belongs to someone under 18, we delete it.
Where we process data
We process data in the United States and on Cloudflare's network, which handles requests in data centers around the world.
Canada and Mexico (draft)
If you live in Canada or Mexico, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) or Mexico's federal law on the protection of personal data held by private parties gives you rights over your personal data: to access it, to correct it, to have it deleted, and to object to a use of it or withdraw your consent. Use your account page, or email privacy@carnival.dev; we answer within 30 days, or sooner where your law requires. Your data is stored and processed in the United States and on Cloudflare's network, where courts and authorities may be able to obtain it under their laws. If our answer doesn't satisfy you, you can complain to the Office of the Privacy Commissioner of Canada or to Mexico's data protection authority.
Changes to this policy
This policy has a version, shown at the top of the page. When we make a material change, we email every account that has signed in and is still active (not suspended or being deleted) 14 days before it takes effect.