Privacy Policy

CAD Studio is self-hostable, so the service you are using is run by whoever deployed it. “We” below means the operator of that deployment. If you need to reach a person about your data, that operator is the person to reach.

You sign in with Google, or — on deployments configured for it — with an OpenID Connect provider. From your provider we receive and store your name, email address, profile image URL, and the account identifier your provider uses for you.

Your email address is what identifies your account. It is also matched against pending organization invitations when you first sign in, and, on deployments that configure an administrator allowlist, checked to decide whether your account is an administrator.

Google sign-in requests one Drive permission: drive.file. That grants access only to files this application itself creates. It cannot list, open, or change anything else in your Drive, including files you created before using CAD Studio.

Your project files live in your own Drive, not in our database. What we store is the folder and file identifiers needed to find them again. You can revoke the permission at any time from your Google account's third-party access settings; doing so leaves the files themselves with you.

The access and refresh tokens your sign-in provider issues are stored so the app can keep reaching the files it created on your behalf after the first token expires. They are never displayed in the interface and are not shared with anyone.

Signing in sets a session cookie. The session itself is stored in our database rather than inside the cookie, which means signing out genuinely ends it rather than relying on the cookie being discarded.

Three other things are kept in your browser's local storage and never sent anywhere: your light/dark theme choice, your answer to the cookie banner, and a one-time mark recording that you have already created your first model body. That last one exists only so the milestone is not counted twice if you come back; clearing it makes the product count the milestone again, and nothing else changes.

No third-party analytics, advertising, or tracking service is installed. There is no tracking pixel and no vendor script.

A small number of product events — for example, that a sign-in succeeded or that a project was created — are recorded server-side against your account identifier, so the operator can tell whether the product works. Events raised in the browser are held in the page and discarded when the tab closes; there is no endpoint receiving them. The only browser-side trace any of them leaves behind is the first-body mark described above.

Account, administrative and security-relevant actions are recorded in an audit log: who acted, what they did, which object it affected, and when. Administrators of this deployment can read it. If an account is removed, its entries remain but stop identifying the person.

Members of an organization can see each other's names, email addresses, and roles within that organization. Owners can additionally see the organization's projects and API tokens.

Inviting an email address never reveals whether that address already has an account here. That is deliberate: an invitation form that answered the question would let anyone use this service to check whether a given person has signed up.

An organization owner can create API tokens. Only a SHA-256 hash of a token is stored — the raw value is shown once, at creation, and is never recorded in our database or logs. If you lose it, it cannot be recovered and you create a new one instead.

Revoking a token marks it revoked rather than erasing it, so the record that it existed and when it was withdrawn is preserved.

We do not sell your data, and this codebase contains no advertising and no third-party tracking. Project content is not read for any purpose beyond serving it back to you and to the people you share it with.