Privacy Policy

Information you provide

• Your email address, which you give us to sign in. Sign-in uses one-time email links, so we do not store a password for your account.
• Details you add to a capture: a title, an optional description, and the type of item (object, apartment or space, vehicle, or other).
• The photos and video you upload to build a 3D model.
• An optional password you may set on a share link. We store only a cryptographic hash of it (scrypt), never the password itself.

Information collected automatically

• Cookies and similar technologies — see section 3.
• Standard server logs recorded by our hosting provider, which may include your IP address, browser type and version, the pages you request, and the date and time of each request. We use these for security, troubleshooting, and keeping the service running.

We do not ask for your name, postal address, phone number, or payment details, and the service does not take payments.

We use the information above to:

• create and maintain your account and sign you in;
• store your uploads and generate, host, and display your 3D models;
• create share links and enforce their passwords and expiry dates;
• send you service email — sign-in links, and notices when a model finishes or fails to process;
• monitor, debug, and secure the service and investigate abuse;
• display advertising on public share pages where advertising is enabled (see section 4);
• comply with legal obligations and enforce our agreements.

For users in the EEA, the UK, and Switzerland, our legal bases are: performance of a contract (running the service and your account); our legitimate interests (security, troubleshooting, preventing abuse); compliance with a legal obligation; and your consent (advertising cookies, which you can withdraw at any time).

We use a small number of cookies:

• sid — required. Keeps you signed in after you use an email link. It is removed when you sign out and otherwise expires after about 30 days.
• share_… — functional. Set only when you enter the correct password for a password-protected share page, so you are not asked again on that browser. It holds a verification token, not the password.
• Advertising cookies — set by Google on public share pages when advertising is enabled. See section 4.

Required and functional cookies are needed for the features you ask for and are not used for advertising or cross-site tracking. You can block cookies in your browser, but sign-in and password-unlock will not work without theirs.

Where advertising is enabled, we use Google AdSense to show banner ads on public share pages (the pages people open from a share link). We do not show ads anywhere inside your account.

Google and its partners use cookies and similar identifiers to serve and measure ads, and, with consent where required, to personalize them. In the EEA, the UK, and Switzerland we present a Google-certified consent message before any advertising cookie is set, and you can change your choice later using the “Privacy” or consent link on those pages. Elsewhere, ads may be shown without a prompt in accordance with local law.

You can control ad personalization in your Google Account at Google Ads Settings, and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites. Industry opt-out tools are at aboutads.info/choices and youronlinechoices.eu.

We do not sell your personal information. We share it only with providers that process it on our behalf, under contract and for the purposes above:

• Railway — application hosting and the database, operated from the United States.
• Cloudflare R2 — object storage for your uploaded media and generated models.
• Resend (or the email provider we configure) — delivery of service email.
• Google AdSense — advertising on public share pages, where enabled.

We may also disclose information if required by law, to enforce our agreements, to protect the rights, safety, or property of anyone, or in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honor this policy.

Depending on your jurisdiction, allowing Google advertising cookies may be considered “sharing” of personal information for cross-context behavioral advertising. See section 10.

Your uploaded photos and video are stored so a 3D model can be produced from them. 3D generation currently runs on an internal placeholder engine and your media is not sent to any third-party reconstruction service. If that changes — for example, if a third-party 3D reconstruction API is enabled — your uploaded media will be transmitted to that provider for processing, and this policy will be updated to name it before the change takes effect.

• Account and capture data (your email, scenes, uploads, and generated models) is kept until you ask us to delete it or delete your account.
• Sign-in links expire 15 minutes after they are issued and can be used once.
• Sessions expire after about 30 days, or immediately when you sign out.
• Signed file links handed to your browser or to share-link visitors expire within minutes.
• Server logs are retained for a limited period by our hosting provider and then rotated out.

Connections use HTTPS. Share-link passwords are stored only as scrypt hashes. Sign-in links are single-use and short-lived. Uploaded files and generated models are stored under unguessable keys and served through short-lived signed URLs. No online service can be completely secure, but we work to protect your information and review our practices as the service grows.

We and our providers process and store information in the United States and in other countries where those providers operate. If you are in the EEA, the UK, or Switzerland, transfers of your information outside your region are made under Standard Contractual Clauses or another lawful safeguard.

• You can stop using the service at any time and ask us to delete your account and its data.
• Manage cookies in your browser; manage advertising consent through the consent link on public share pages.
• EEA / UK / Switzerland: you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. You may also lodge a complaint with your local supervisory authority.
• California: you have the right to know, delete, and correct your personal information, and to opt out of “sharing” it for cross-context behavioral advertising. We do not sell personal information, and we will not discriminate against you for exercising these rights.

To make a request, email [email protected]. We may need to verify your identity before acting.

The service is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

We may update this policy from time to time. We will post the new version here and update the “Effective” date above. If the changes are significant, we will make a reasonable effort to notify you, for example by email.

Questions or requests: [email protected].