Privacy Policy

Layerpaint is designed to respect your data. This page explains what we collect, why, and who gets to see it.

The short version

• Your 3D models never leave your browser. All painting, welding, and export happens client-side. We can't see your STL, OBJ, 3MF, or .layerpaint files.
• We don't sell your data. Ever. Not to advertisers, not to AI training sets, not to anyone.
• We store only what we need to run your account and process your payment.

What we collect

• Account info — your email address (used for the receipt and to recover your activation link if you contact support). No passwords.
• Purchase info — which product you bought and when. Payment details (card number, etc.) are handled entirely by Stripe; we never see or store them.
• Anonymous usage analytics — via Microsoft Clarity, we collect page views, click/scroll heatmaps, and anonymized session recordings of how the UI is used so we can tell which parts of the app work and which confuse people. Recordings mask form inputs by default and never include your 3D models, paint state, or exported files.
• Advertising conversion tag — if you arrive via a Google ad, a conversion tag fires so we can tell the ad worked. To match the purchase to the ad click, your email is hashed (SHA-256) in your browser and only the hash — never your plaintext email — is sent to Google. Google can't read the email from the hash.
• Facebook and Instagram ad measurement — the Meta pixel records page views, when you open the export pricing panel, when you start a checkout and when you buy. Because browsers and ad blockers often stop that tag from loading, we also send the same events from our server, which is how a purchase gets counted at all if the tag was blocked. Each event is sent once with a shared id so the two copies don't count as two sales. What goes with them: the click id from the ad you arrived on, a browser id, your IP address, your browser's user agent, and your email address hashed with SHA-256 — Meta receives the hash, never the plaintext. We don't send your name, address or phone number.

What we don't collect

• Your 3D models. They never touch our servers.
• Your paint state, palette choices, or exported files.
• Anything from your filesystem beyond the specific files you drag into the painter — and those stay in the browser.

Who we share with

• Stripe — processes your payment. See stripe.com/privacy.
• Supabase — stores your account and purchase record. See supabase.com/privacy.
• Microsoft Clarity — anonymous product analytics, heatmaps, and session replay. See Microsoft's privacy statement.
• Vercel — hosts the site and provides anonymous traffic analytics. See vercel.com/legal/privacy-policy.
• Google — if you click through from a Google ad, a conversion tag fires to record the purchase, including a hashed (not plaintext) version of your email to match it to the ad click. See Google's privacy policy.
• Meta (Facebook, Instagram) — measures whether a Facebook or Instagram ad led to a purchase. Sent from your browser and from our server, and includes a hashed (not plaintext) version of your email. See Meta's privacy policy.
• Ahrefs — anonymous, cookieless web analytics. See ahrefs.com/privacy.
• AI generation provider — when you use the AI tools (AI Paint, AI Create, the Workshop), the inputs for that generation — a text prompt, a reference image, a photo, or your model's geometry — are sent to a third-party AI service to produce the result. We don't keep your photos or reference images; generated models are stored so we can deliver them to you, including across devices.

We do not share your email with third parties for marketing. You will only hear from us about your purchase or a major product update.

Cookies

We use a small number of essential cookies: one for your logged-in session, one to remember your preferences in the painter. Microsoft Clarity and Google may set their own cookies as described above. If you arrive from a Facebook or Instagram ad we store the ad's click id for 90 days, which is how a later purchase gets credited to that ad.

Your rights

You can request a copy of what we hold on you, or ask us to delete your account and associated data, by emailing ashley@layerpaint.app. We will respond within 30 days.

If you're in the EU or UK, this falls under GDPR. If you're in California, CCPA applies. Both allow you to request access, correction, and deletion.

Changes

If this policy changes materially, we'll notify registered users by email before the change takes effect.

Contact

ashley@layerpaint.app

This template is a plain-language starting point. If you're taking money across borders or serving users in heavily-regulated jurisdictions, have a lawyer review it.