Privacy Policy

Last updated: April 22, 2026

Overview

CraftCut is built with privacy as a core principle. By default the tool runs entirely in your browser — no account, no upload, no tracking. If you choose to sign in, sync, or publish a project, we store only what is necessary to deliver those features.

This policy explains what data we collect, where it lives, who can see it, and your rights. If anything is unclear, email [email protected].

1. How CraftCut Stores Your Data

CraftCut has two storage modes. You choose which one applies based on whether you sign in.

A. Local-only (default, no account)

Everything stays in your browser's local storage and never leaves your device:

• Furniture designs and project files
• Panel dimensions, materials, and configurations
• Cut lists and optimization results
• 3D previews and assembly instructions
• Exported booklets and production documents
• Application settings and preferences

We have no ability to access, view, or recover this data.

B. Cloud-synced (signed-in account)

If you sign in (currently via Google), the following is stored on our servers (Cloudflare D1 database and Cloudflare R2 object storage, both hosted on Cloudflare's global infrastructure):

• Account profile from your sign-in provider: your name, email address, profile photo URL, and a stable user ID. Used to authenticate you and display your name on content you publish.
• Projects you choose to sync: project name, design data (panels, dimensions, settings), timestamps, and a randomly-generated share token if you enable sharing.
• Build Journal entries: the type, title, body text, and ordering of each entry, plus references to any photos you attach.
• Build Journal photos: the image files themselves (JPEG/PNG/WebP, up to 5MB each), stored in Cloudflare R2. Public photo URLs are served by our worker so we can revoke access if needed.
• Aggregate stats: per-project view and remix counters for public Build Journals.
• Session cookies issued by our authentication library so you stay signed in.

You can export, edit, or delete any of this content at any time from inside the app.

2. Public Content (Build Journals & Shared Designs)

Build Journals are public-by-design. The moment you save your first journal entry, summary, or photo, the project automatically gets a public URL. There is no private-journal mode. Saving anything in a Build Journal is an explicit publish action. The first time you start a journal in any project, the app shows a clear consent screen reminding you of this before any data leaves the editor.

The following becomes publicly visible at the build URL:

• The project name, summary, and design data
• Your display name and profile photo (from your sign-in provider) as the author byline
• All Build Journal entries and uploaded photos
• Aggregate view and remix counts

Public URLs may be indexed by search engines, shared on messaging apps, archived by third parties (e.g., the Internet Archive), and accessed by AI crawlers we permit (see our robots.txt). Deleting the journal, project, or your account removes the page from CraftCut, but third-party caches may persist for some time.

Anyone can Report a public page from a button on its footer. Reports are reviewed by our team and may result in content being hidden or removed. We do not share reporter identity with the author.

3. Data We Collect Automatically

When you visit our website (craftcut.io), we may collect limited, anonymized usage data to understand how the site is used and to improve the experience:

• Analytics data: Page views, referral sources, approximate geographic region (country-level), browser type, and device type. This data is collected via privacy-respecting analytics and does not include personally identifiable information.
• Error reports: Anonymous, automated error logs that help us identify and fix bugs. These contain no personal data or project content.
• Performance metrics: Anonymized page load times and interaction timings.
• Abuse-prevention metadata: Short-lived rate-limit counters keyed to your user ID, and salted/truncated hashes of IP addresses for users submitting abuse reports. Raw IPs are not persisted.

4. Data We Do Not Collect

We do not collect, store, or process:

• Payment or financial information (we don't yet accept payments)
• Precise location data
• Advertising profiles or cross-site tracking data
• Biometric data, device identifiers, or browser fingerprinting information
• Photos uploaded by users who haven't signed in (uploads require an account)
• EXIF metadata beyond what is needed to display photos correctly (we recommend stripping GPS data from photos before upload)

4. Legal Basis for Data Processing

Where applicable (including under the EU General Data Protection Regulation), our legal basis for processing any data is:

• Legitimate interest: We collect minimal, anonymized analytics data to improve CraftCut's performance and user experience. This processing is proportionate and does not override your privacy rights.
• Consent: Where required by local law, we will obtain your consent before setting any non-essential cookies or collecting analytics data.

5. Cookies & Local Storage

CraftCut uses browser local storage to save your projects and preferences locally on your device. This is essential for the application to function and does not involve transmitting data externally.

We do not use tracking cookies. If we use analytics, they rely on privacy-respecting, cookie-free methods where possible. No third-party advertising or retargeting cookies are set.

6. Third-Party Services

CraftCut uses the following third-party services:

• Cloudflare (Pages, Workers, D1, R2, KV): hosting, content delivery, application database, and image storage. Subject to Cloudflare's Privacy Policy.
• Google Sign-In (OAuth): used for account creation/login. We receive your name, email, profile photo URL, and a stable user ID. Subject to Google's Privacy Policy.
• Google Fonts: for typography on landing pages. Font files are loaded from Google's servers. Subject to Google's Privacy Policy.

We carefully vet third-party services and only use those with strong privacy commitments. We do not sell, rent, or share any data with third parties for advertising or marketing purposes.

7. Data Retention

Retention depends on storage mode:

• Local project data (no account): Retained in your browser until you delete it or clear browser storage. There is no expiration date.
• Cloud-synced projects, journal entries, and photos (account holders): Retained until you delete the project, journal entry, or your account. After deletion, data is purged from our active database within 7 days. Backups may persist for up to 30 days before being overwritten.
• Public Build Journals after unpublishing: Removed from CraftCut immediately, though search engines and third-party caches may take longer to update.
• Account records: Retained while your account is active, plus up to 30 days after deletion to allow for recovery and to satisfy our legal obligations.
• Abuse reports: Retained up to 24 months for safety review and to spot patterns.
• Analytics data: Anonymized analytics retained up to 24 months, then automatically purged.
• Error logs: Automatically deleted after 90 days.

To delete your account and all associated cloud data, sign in and use the in-app delete option, or email [email protected] from the email address on your account.

8. Data Security

We take the security of our service seriously:

• The CraftCut website and application are served exclusively over HTTPS, ensuring all data in transit is encrypted.
• We use Cloudflare's security infrastructure, including DDoS protection and Web Application Firewall (WAF).
• Since no user data is stored on our servers, the risk of server-side data breaches affecting your personal information is effectively eliminated.
• We regularly review and update our infrastructure and dependencies to address known vulnerabilities.

9. International Data Transfers

CraftCut's website is delivered via Cloudflare's global CDN network. When you access the site, your request may be routed through servers in various countries. However, since CraftCut does not collect or store personal data on its servers, no personal data transfers occur as a result of using the application.

For anonymized analytics data, processing may occur on servers located in the European Union or the United States. Where transfers outside the EU occur, they are governed by appropriate safeguards such as Standard Contractual Clauses.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

• Right of access: You can request a copy of any data we hold related to you. Account holders can also export their projects directly from the app.
• Right to erasure: Delete projects, journal entries, photos, or your entire account from inside the app at any time. Local-only data can be deleted by clearing your browser storage.
• Right to rectification: Update your profile, project content, and journal entries directly in the app.
• Right to object: You can object to our processing of analytics data. You may also use browser settings or extensions to block analytics scripts.
• Right to data portability: Export your projects and journals as standard files from inside the app.
• Right to lodge a complaint: You have the right to file a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. Transparency

CraftCut is committed to being transparent about how data is handled. We believe privacy should be the default, not an afterthought. If you have questions about our data practices, we encourage you to contact us and we will provide clear, honest answers.

12. Children's Privacy

CraftCut is not directed to children under 13. We do not knowingly collect personal information from children under 13 (or the applicable age in your jurisdiction). If you are under 18, do not create an account or upload personal photos without a parent or guardian's involvement. If you believe a child has signed up or uploaded content, contact us at [email protected] and we will delete the account.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable laws. Changes will be posted on this page with an updated revision date. For material changes, we may also provide notice within the application. Continued use of CraftCut after changes constitutes acceptance of the updated policy.

14. Contact

If you have questions about this privacy policy, your data, or wish to exercise your rights, contact us at [email protected].