Privacy Policy
Last updated: October 11, 2026
Easy3D runs almost entirely in your browser. You can design and download without an account, and your designs never reach our server. This page explains what we do collect, why, for how long, who helps us process it, and how to control it.
1. Who is responsible
Easy3D (easy3d.app) is run by Noam Oringer, an individual based in Israel, who is the controller of the personal data described here. Contact for anything about privacy: support@easy3d.app. We answer within 30 days, usually much sooner.
2. What stays in your browser
Typing text, choosing fonts, colours and shapes, adding a picture or logo, and building STL and 3MF files all happen on your device. No design, picture or downloaded file is sent to our server. A picture you add is decoded and traced inside your browser and is hidden from session recordings.
3. What we collect, why, and on what legal basis
- Your account (only if you sign in): your email address, name and Google account id, from Google sign-in, kept by Supabase; your plan (Free or Pro) and, if you are an administrator, your role. Why: to give you an account and Pro. Basis: performing our contract with you.
- Pro subscriptions and payments: Lemon Squeezy, our payment provider and the seller of record, tells our server which account subscribed, the subscription's status and dates, and each charge's amount, currency, discount and refund status, with the buyer's email. We never see card numbers. Why: to turn Pro on and off and to know who paid. Basis: contract, and our legal duty to keep financial records.
- The design assistant (Pro only, only when you use it): the description you type and your language are sent to our server and from there to Anthropic's Claude API, which suggests sign settings. The answer is cached for up to 30 days under a one-way hash of the request, so the same request is not sent twice. Do not type personal or sensitive information into it. Basis: contract.
- Abuse protection: your IP address and account id are used for short-lived counters (kept for up to two hours) that limit how often the assistant and the account functions can be used. Our hosting provider keeps standard request logs for a short period. Basis: our legitimate interest in keeping the service secure and its costs bounded.
- Usage analytics, only with your consent: Google Analytics 4 (pages viewed, referral source, approximate region, device type) and Microsoft Clarity (session recordings and heatmaps). Neither loads until you accept the cookie banner. Basis: consent, which you can withdraw at any time.
- Cookie-free statistics: Vercel Web Analytics counts page views in aggregate without cookies or identifiers. Basis: legitimate interest.
- Messages you send us: kept as long as needed to answer and follow up. Basis: legitimate interest, or contract when it concerns your subscription.
- Administration records: actions taken in the admin panel (for example granting Pro) are logged with who did them and when, for security and accountability.
We do not sell your personal information, we do not share it for advertising, and we show no ads. We make no automated decisions about you that have legal or similarly significant effects; the assistant only suggests design settings.
4. Cookies and browser storage
Google Analytics and Microsoft Clarity set their own cookies only after you accept. Easy3D itself stores these values in your browser:
t3d_consent(localStorage): your cookie choice.easy3d-lang-choice(localStorage): the language you picked.sb-…-auth-token(localStorage, only when signed in): your sign-in session, so you stay signed in across the site. Signing out removes it.easy3d-buy-after-signin(sessionStorage, cleared when the tab closes): remembers that you were about to buy Pro, and a discount code if you entered one, across the sign-in step.
These are strictly necessary for features you ask for, so they do not need consent. During checkout, Lemon Squeezy may set its own cookies; see its privacy policy.
5. Who processes data for us
- Supabase (accounts and our database), Vercel (hosting and cookie-free statistics), Upstash (the assistant's cache and rate limits): service providers acting on our instructions.
- Lemon Squeezy (checkout, billing, tax, invoices): the seller of record for Pro, responsible for the payment data it collects.
- Anthropic (the Claude API, only when a Pro account uses the assistant).
- Google (sign-in; Google Analytics with consent) and Microsoft (Clarity, with consent).
Some of them process data in the United States or elsewhere outside your country. Where the law requires it, transfers rely on adequacy decisions (Israel itself has one from the EU), the EU–US Data Privacy Framework, or Standard Contractual Clauses.
6. How long we keep it
- Account data: until you delete your account.
- Subscription and payment records: up to 7 years, as tax and accounting law requires; after your account is deleted they are no longer linked to it.
- Assistant cache: up to 30 days. Rate-limit counters: up to 2 hours.
- Analytics: as set in those services, at most 14 months.
- Administration records: as long as needed for security; for a deleted account they keep only its random id.
7. Your rights
Depending on where you live (for example under the EU and UK GDPR, Israel's Privacy Protection Law, or US state laws such as California's), you may have the right to access your data, receive a copy, correct it, delete it, restrict or object to its use, and withdraw consent. You can do the most common ones yourself:
- Download your data: sign in, open Account, choose Download my data.
- Delete your account: sign in, open Account, choose Delete my account. A Pro subscription that will renew must be cancelled first, so you are not charged for an account that no longer exists.
- Withdraw analytics consent: the Cookie settings link at the bottom of every page.
For anything else, write to support@easy3d.app. We will not treat you differently for using your rights. You may also complain to your data protection authority: in Israel the Privacy Protection Authority, in the EU your local supervisory authority, in the UK the ICO.
8. Children
The editor needs no account and collects nothing about who uses it. Accounts are for people aged 13 and over (or the older age your country requires for agreeing to data use without a parent). Buying Pro requires an adult, or a parent's or guardian's permission. If you believe a child under 13 has an account, write to us and we will delete it.
9. Security
All traffic is encrypted (HTTPS with HSTS). Database tables are protected by row-level security; the keys that can change accounts or Pro exist only on our server; the admin panel is limited to accounts we authorise, and its actions are logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
10. Changes
We update the date at the top whenever this policy changes. If a change matters to account holders, we will also announce it on the site before it takes effect.