Privacy

The studio’s engine runs in your browser. The picture you choose is read by the page, converted on your machine, and the layers are produced there.

The picture is not uploaded. If you publish the result, what leaves your machine is the result — the layers, the geometry, and a cover drawn from the conversion — not the source image.

This is enforced by a test rather than by policy: an end-to-end run collects every request body the page sends while converting and publishing, and fails if the source image’s bytes appear in any of them.

The image converter and the image editor work the way the studio does: the file is read by the page, changed on your machine, and saved from there. Nothing is uploaded, and closing the tab is what deletes it.

Selecting an object in the editor downloads a model — about 19 MB, once — and it comes from this site rather than from anyone else. Your picture still never leaves the tab. What this avoids is different: a third party being told that you opened the tool.

The document converter is the exception, and it is why this section exists. Turning a Word document into a PDF needs a word processor, and there is no such thing in a browser, so the file is sent to a server. There it is converted; the file and the PDF are both deleted as soon as the answer is on its way, and anything a crash left behind is swept within thirty minutes. It is never stored, never backed up and never indexed.

These are tests rather than intentions. One end-to-end run fails if any request leaves this site while a file is open, and another counts every request object selection makes — the weights, the runtime and the library — and fails if a single one goes anywhere but here.

An account holds a name, an email address, a handle, and optionally a short biography and a picture. Signing in through a provider brings the same fields from them.

They are used to sign you in, to attribute what you publish, and to reach you about an order. They are not used for anything else.

Your handle, your name, your biography and what you have published are public. Your email address is not.

Files and pictures you attach to a listing are stored so they can be downloaded and shown. They are inspected before being offered.

They are held in object storage rather than in the site's database, and the application never handles the bytes: your browser uploads straight to the store, and a download comes straight back from it. A file you paid for is served through a link that expires; the pictures on a listing are public.

What a listing shows publicly is also copied into a search index so it can be found. Nothing private is indexed.

Card details are entered on Stripe’s own pages and are never seen by this site. What comes back is whether the payment succeeded and an identifier for it.

An order keeps what was bought, from whom, for how much, and when. A receipt freezes the parties as they were at the time, because a document that changes when somebody edits their profile is not a record.

Selling requires an account with Stripe in your name. What you give them is between you and them; this site holds the identifier and the amounts.

The application can report traces and errors to a collector, and does so only when one has been configured. No analytics vendor is bundled into the pages you load.

Timings from the studio’s engine are off unless they are deliberately switched on, and even then they carry a size bracket rather than your picture’s dimensions — the promise the studio makes is worth more than the measurement.

Errors the browser reports are accepted through a strict, size-limited, rate-limited endpoint that keeps only what a message needs.

One cookie, signed, that keeps you signed in. There is no advertising cookie and no third-party tracker.

Your theme and language choices are remembered in your own browser and are not sent anywhere as a profile. The only other thing kept there is which build a tab has already reloaded itself for, so that a deployment cannot turn into a reload loop; it lasts as long as the tab and says nothing about you.

The site sends four kinds of message and no others: a password reset, a link to confirm your address, what you type into the contact form, and a reminder about notifications you have not opened. The reminder goes only to an address its owner has confirmed, so an account opened with somebody else's address cannot make this site write to them. All four need a mail provider to be configured; without one, nothing is sent and the pages say so.

The reminder is the weakest form delivery can take, deliberately. It goes out a quarter of an hour after something happens, as one message rather than one per event, and only about what is still unread — opening your notifications cancels it. It is off for every account that existed before it was built, because those were made while this page said the site sent no mail of its own. One click at Settings turns it off, and every message carries the same link.

Most of what is held about you is visible to you already: your settings, your listings, your orders, your receipts and your notifications.

You can withdraw or delete what you published, and close your account from Settings. What closing removes and what it keeps is listed there, before you confirm. Records attached to a completed order are kept, because the other party and the law both need them.

Requests about your data go to the operator named above. Where none is configured, this installation is not being run as a service and there is nobody to ask.