Privacy Policy

1. The information we collect

• Your email address, when you subscribe, sign in, or ask for a replacement product key.
• Your product key, as a one-way hash only. The key itself is never stored (see section 5).
• Subscription details from Stripe: your Stripe customer and subscription ids, your plan, your billing interval and billing cycle date, and whether the subscription is active. We never receive your card or bank details.
• Sign-in records: a session record (your account id and when the session started and expires), and when you last asked for a replacement key.
• Account dates: when the account was created, when you first opened the builder, and when you first published a preview.
• Your work: your projects and the assets you add to them. Assets include imported 3D models and the thumbnails made from them, and pictures with their file names. A picture may be kept exactly as you added it, with any information the file itself carries. They also include fonts you add, with the web address you added a font from.
• Previews you publish: a copy of the published scene.
• On the Pro plan, the agent: your prompts, the scene content they work on, and the session's conversation while it runs. We also keep a record of each agent run, made of excerpts of your prompt and of the model's replies, the tool actions it took and their results, and the amount of model use. The agent's usage is totalled for each billing period.
• Technical data: request logs that record your IP address, browser type and the address requested. Our own operational logs record account, project and Stripe ids. We also count four events (signing up, first opening the builder, first publishing a preview, and changing plan), recorded with the plan involved but without your email address or account id.
• In your browser: one sign-in cookie, and local storage the studio needs to work. That storage holds a display calibration, a note that its graphics have been prepared, your workshop preferences, and copies of 3D models you have downloaded. There are no analytics or advertising cookies, and no trackers.

If you visit without subscribing, we set no cookies. An email address you type to start a subscription goes to Stripe (section 3). One you type to replace a product key is checked against existing accounts.

2. How we use it

• To create and run your account. Your email address is how you sign in and where your product key is sent, when you subscribe and when you ask for a replacement. It also stops a second subscription being opened for the same address.
• To sign you in, by checking your product key against its hash and keeping your session.
• To know whether your subscription is active and which plan's workshop to give you. On Pro, to measure the agent's use against the plan's allowance for each billing period.
• To store your projects and assets and give them back to you, and to serve each preview you publish at its address.
• On Pro, to run the agent: your prompt and scene go to the model so it can respond. The run records are used to keep your session going, meter use, and find faults.
• To operate and protect the service: logs and per-address request limits are used to fix faults and prevent abuse, and the event counts tell us how many accounts reach each first use.

We do not sell your information or use it for advertising.

3. Who we disclose it to

• Stripe, Inc., our payment processor. It receives the email address you type when you start a subscription, and your customer id when you open the subscription page. You give your payment details to Stripe directly, and Stripe's privacy policy governs what it holds.
• Zoho Corporation (Zoho Mail), our email provider. It receives your email address and the email we send you, which contains your product key.
• Google Cloud (Google LLC), which hosts the service. Everything we store is held in Google Cloud's us-west1 region in the United States. On the Pro plan, Google's Vertex AI (the Gemini model) receives your prompts, your scene content and the agent session's conversation in order to respond. Google processes this at its global location.
• Google Fonts. This site's pages and the workshop load their typefaces from Google's servers, which receive your IP address and browser information as part of each request.
• The font source you choose. When you add a font, your browser fetches it from Fontsource, jsDelivr, Google Fonts, or the web address you give. Our server asks Google Fonts for a font by its name only.
• Anyone with a preview's link. A preview you publish can be viewed by anyone who has its address.

We disclose your information to no one else, except where the law requires it.

4. How it is disclosed

• Stripe: our server calls Stripe's API over encrypted HTTPS. You are sent to Stripe's own hosted checkout and subscription pages to pay, so your payment details go straight to Stripe. Stripe reports subscription changes to our server over HTTPS, in messages signed by Stripe.
• Zoho: our server hands each email to Zoho's mail service over an encrypted (TLS) connection, and Zoho delivers it to your inbox.
• Google Cloud: the information is stored and processed inside our own Google Cloud project. Our services reach it through Google's authenticated interfaces, and our agent service sends Vertex AI its requests the same way.
• Google Fonts and font sources: your browser requests them directly over HTTPS. Our pages tell those servers only which site you came from, never the page.
• Previews: a preview is published on Google Cloud Storage at a long random address, and is visible to anyone who has that link.

5. How we keep it secure

• Encrypted connections. The service is served only over HTTPS, and browsers are told to keep using HTTPS for it (HSTS).
• Your product key is never stored. We keep only a hash of it made with argon2id, a deliberately slow one-way function, so we cannot read the key back. A lost key is replaced with a new one, never recovered. A sign-in attempt does the same work whether or not the email address has an account, so it does not reveal which addresses do.
• A protected sign-in cookie. It is HttpOnly, Secure and SameSite=Lax, and expires after an hour unless renewed while you work. Signing out ends the session on our side.
• No payment data on our servers. Card and bank details are entered on, and held by, Stripe.
• Private storage. Your projects and assets are stored privately and served only to your signed-in account. The builder is delivered through signed links that expire after 30 seconds. A preview is public only because you publish it, and its address is a 128-bit random number that cannot be guessed. Google Cloud encrypts the data it stores for us at rest.
• Protected secrets. Our signing key, payment keys and mail password are kept in Google Secret Manager, not in our code.
• Verified payment messages. A subscription change is acted on only when Stripe's signature on the message checks out.
• Limits and checks. Sign-in, checkout, key replacement, uploads, publishing and the agent are rate-limited, and a replacement key can be requested once every 15 minutes per email address. Uploads are checked for size and type.
• Page protections. Other sites cannot embed our pages in a frame, and browsers are told not to guess at file types.