Privacy Policy

1. What we collect

• Account: your name, email, a scrambled (hashed) version of your password, and your plan. If you sign in with Google, the name, email and Google account ID Google gives us.
• Your work: projects, designs, logos, photos you upload to measure a vehicle, and your company profile (name, logo, phone, email, website, address, rates) if you fill it in.
• Payments (when paid plans open): Stripe handles your card; we keep only the plan, the billing dates, the last four digits and the card brand Stripe shows us.
• Client links: the design you share, an optional password (hashed) and how many times the link was opened.
• Technical data: our hosting provider keeps standard server logs (IP address, browser, pages requested, time) to keep the service safe and running.
• Messages you send us by email.

2. Where your work is kept

Projects are saved in your own browser first. On plans with cloud save, a copy is also kept on our servers so it opens on your other devices. Photos you use to measure stay inside the project. A Free plan account keeps projects only on the device, so clearing the browser deletes them; export a Project file to keep a copy.

3. Why we use it

• To create and run your account, save and sync your projects, and make the files and links you ask for.
• To charge paid plans and send receipts and the notices the law requires (renewals, price changes).
• To answer you, keep the service secure, stop abuse and fix problems.
• To understand, in total and not person by person, which features are used, so we can improve MASK.

4. Who helps us (service providers)

We share personal information only with providers that run parts of MASK for us, under contracts that limit them to that job:

• Vercel: hosting, file storage (projects, client links) and server logs.
• Neon: the database for accounts, sessions and the project list.
• Stripe: payments (when paid plans open).
• Resend: account emails such as password resets.
• Google: only if you choose “Continue with Google”.
• Anthropic: when you ask Masky, the assistant, your question and the chat so far go to Anthropic's Claude to write the answer. MASK doesn't keep the chats; don't type passwords or personal details in them.
• NHTSA (US government): when you look up a VIN, we send that VIN to the NHTSA vehicle database. No personal data goes with it.
• Visit counter (MASK's own, no cookies): which page you open, the site that sent you, your approximate city and country from your connection, phone or computer, and how long the page stayed open. Visitors are counted with a code that changes every day, so you can't be followed from day to day, and your IP address isn't kept.

5. What we don't do

• We don't sell your personal information and don't share it for cross-context behavioral advertising.
• We don't use advertising or tracking cookies. MASK uses only cookies needed to keep you signed in and settings saved in your browser (like the day/night look).
• We don't look inside your projects except when you ask us for help, or when the law or a safety problem requires it.

6. How long we keep it

We keep your account and cloud projects while your account is open. When you delete your account, we delete your account data and cloud files within 30 days; backups expire within another 30 days. Payment records are kept as long as tax law requires. Server logs are kept for a short time, usually under 30 days.

7. Your choices and rights

• See, correct, download or delete your information: most of it is in your account and projects; for anything else write to hello@mask3dstudio.com.
• Delete your account: write to hello@mask3dstudio.com from the account's email. We answer within 30 days.
• California residents have the right to know what personal information we collect and how we use it, to delete it, to correct it, and not to be treated differently for using these rights. We don't sell or share personal information, so there is nothing to opt out of.

8. Security

Passwords are stored hashed, never as typed. Sign-in sessions use secure, http-only cookies, and only a scrambled copy of the session is kept on the server. Traffic is encrypted (HTTPS). No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.

9. Children

MASK is for adults and businesses. We don't knowingly collect information from anyone under 18. If you believe a child gave us information, write to us and we'll delete it.

10. Changes

If we change this policy in a way that matters, we'll tell you by email or in the studio before it applies.

11. Contact

MASK 3D Studio · Hesperia, California · hello@mask3dstudio.com