Privacy Policy

1. Who we are, and what this policy covers

StackDesign is a web-native cabinet and room design service operated by Bespoke Woodcraft Studio LLC, a California limited liability company, whose registered business address is 688 N Rimsdale Ave, Covina, CA 91722, United States ("we", "us", "StackDesign"). Bespoke Woodcraft Studio is the data controller for the personal information described here.

This policy explains how we handle personal information on stackdesign.app and in the StackDesign tools, including the AI Designer. It works alongside our Terms of Service.

What you type about other people is yours, not ours. StackDesign has no contact fields, so there is no customer list to fill in. If you do put someone else's details in a project name, a note, or a message to the assistant, you decide what goes in and why, and we hold it on your instructions. Our Data Processing Addendum sets that split out in full, and section 11 of the Terms of Service says the same thing.

Many StackDesign tools run without an account at all. If you use the site that way, the only data we hold about you is the ordinary web server log described in section 2, the usage measurement described in section 7, an error report if a page breaks, and a recording of a problem if you choose to make one for us.

2. What we collect

We do not ask for and do not want sensitive personal information such as government identifiers, health data, precise geolocation or biometric data. Please do not enter it into StackDesign.

3. Why we use it

• To run your account. Signing you in, keeping you signed in, syncing your work between your devices.
• To provide the tools. Storing and computing your designs, cut lists, materials and standards so the Service does what you asked.
• To bill you. Starting, renewing, changing and cancelling a paid plan, and keeping the record of your consent to a recurring charge that the law requires us to keep.
• To run the AI Designer. Sending your message and the necessary project context to our AI provider and returning the reply. See section 4.
• To keep the service working and secure. Diagnosing errors, preventing abuse, enforcing usage limits, protecting accounts, and running the security check that stands in front of creating an account, signing in, deleting an account and asking us to email you our free plans, so that a script cannot open accounts all night and use up the sign-in emails real people are waiting for.
• To fix the problems you show us. When you record a problem for us, we watch the recording and read what the page logged while it ran, so we can find the cause and fix it. Our own team records problems the same way while testing.
• To find and fix the bugs that break the site. When a page hits an error, the error report tells us what broke and where, so we can fix it for everyone who uses that page. We do not use it to measure you or to advertise to you.
• To see how the tools are really used. Counting page views, keeping our own record of when you sign in and which pages you open, and, if you accepted the cookie banner, which features get used and where people get stuck, so we know what to fix next. See section 7.
• To communicate with you. Service notices, billing notices, security notices, and replies to your support messages. One of those security notices is a message telling you your account has been signed into on a browser it has not been used on before, so a stolen password does not stay quiet. These are sent through our email provider, listed in section 5.
• To meet legal obligations. Tax and accounting records, and responding to lawful requests.

If you are in a region with a legal-basis requirement such as the European Economic Area or the United Kingdom, our bases are: performance of our contract with you (running your account and the tools), legitimate interests (security, abuse prevention, improving the Service), legal obligation (tax and accounting), and consent where we ask for it.

4. The AI Designer: what happens to what you type

When you use the AI Designer, your message and the project context needed to answer it are sent from our server to Anthropic's API, which generates the reply. The call is made server side, so your browser never talks to the AI provider directly and no AI provider key is exposed to you.

Under Anthropic's standard commercial API terms, which is how StackDesign uses the service:

• the content you send and the replies you receive are not used to train models;
• Anthropic's operational logs are deleted automatically on a short rolling window, currently around seven days; and
• Anthropic acts as our sub-processor under a data processing agreement that includes Standard Contractual Clauses for international transfers.

Those three points describe Anthropic's commercial terms as they stood when this version was published. Vendor terms drift, so we re-read them whenever we publish a new version of this policy, and we will change this section rather than leave a stale promise standing.

We keep your conversation and any project facts it produced in your own workspace so the assistant has continuity between sessions. That copy is yours: you can delete it, and it goes when your account goes (see section 9).

There is a second AI provider, and it is connected but not yours to use. Your conversations are answered by Anthropic. StackDesign also carries a model switch that routes a conversation to Google instead, using Google's Gemini API, and that switch can only be turned on by one of our own platform administrator accounts. There is no address you can type, no setting in your account and no supported way for you to reach it, so no customer conversation is sent to Google. We use it for our own testing. It is disclosed here, and Google is listed in the table below, because the connection is live on our server and we would rather name a thing that exists than describe Anthropic as the only provider wired up. If we ever make a second provider available to you, we will say so on this page before any of your data reaches it. A third option labelled ChatGPT appears in the same internal switch but is not connected to anything.

We would rather tell you the switch exists than describe a single provider and leave you to discover a second one. If we connect another provider, we will name it here before any customer data reaches it.

Please do not paste anything into the assistant that you would not want processed by a third-party AI provider, including other people's personal information you have no right to share.

5. Who processes data for us

Each of these providers processes data for us under its own data processing agreement, which forms part of the terms we accepted when we opened the account and which restricts that provider to processing data for the purpose we engaged it for. Those agreements also carry the transfer protections described in section 12.

Google, if you sign in with it. This is a different thing from the Gemini row above, and the distinction matters. For the AI model, Google processes your conversation on our behalf, as our sub-processor. For sign-in it does not: When you choose Sign in with Google, you are asking Google to confirm who you are, and it hands us your name, email address and a reference to your profile picture. Google decides for itself what it records about that sign-in, under its own privacy policy, not ours. If you would rather not involve Google, use a password or an email sign-in link instead.

Beyond those twelve, we share personal information only when we have to: with professional advisers under confidentiality, in response to a lawful legal request, to protect the rights or safety of people or of the Service, or to a successor if the business is sold, in which case we would tell you first.

6. What we never do

7. Cookies, local storage and tracking

StackDesign uses browser storage for four things of its own:

• Keeping you signed in. Your authentication session is stored by the Supabase client in your browser. Clearing it signs you out.
• Remembering your settings. Small preferences such as your chosen colour theme, your unit of measure, and unsaved work in progress are kept in your browser's local storage so the tools behave the way you left them. Some tools work entirely on your device this way, with nothing sent to us.
• Remembering your cookie answer. Your answer to the banner below is stored under bws:cookie-consent, with the date you gave it. That entry is the only reason we stop asking.
• Two markers that stop us repeating ourselves. One is bws:usage-login-logged, kept only for as long as the tab is open, so the usage record in section 2 counts one sign-in for that tab rather than one for every page you click through. The other is bws:known-device followed by your account id, which is how we know we have already sent you the note about this browser and do not send it again every time you sign in. Neither holds a name, an email address or anything you typed, and neither is read by anyone but this site.

The cookie banner, and what each answer does

The first time you open StackDesign you get a banner asking about analytics cookies. PostHog does not load until you answer it, and the answer sticks.

• Accept loads PostHog, our product analytics service. It stores its own identifiers in cookies and in your browser's local storage, and while you are signed in what it records is tied to your account. It sees which pages and features you use and where you get stuck. We run it with two of its features switched off on purpose, autocapture and session recording, so it never records what you click on, what you type, or a picture of your screen. It never receives your designs, your dimensions or your AI Designer messages.
• Decline means PostHog is not loaded at all: no script, no request, no cookie and no local storage entry of its own, then or later. There is no reduced or cookieless version of it running quietly instead.

What runs either way. Ahrefs Web Analytics counts page views on this site, including this page, and it sits outside the cookie choice. Ahrefs states that it sets no cookies, stores nothing on your device, collects no personal data, and never keeps a raw IP address, hashing it with a daily salt instead. We rely on that description, and it is why there is nothing here for you to consent to. Ahrefs is listed in section 5 with every other provider.

Vercel's page count and page-speed measurement, which also run either way. Every page tells Vercel, the company that hosts the site, that it was viewed, and sends it a few timing numbers about how fast that page loaded in your browser (the Core Web Vitals), along with the page path, the page you came from, your browser and operating system, the kind of device and connection, and the country, region and city. Neither sets a cookie or stores anything in your browser, neither carries an account identifier, and the visitor count works from a hash of the request that Vercel discards after 24 hours, so both sit outside the banner for the same reason the Ahrefs page count does. Section 5 says what Vercel holds.

The record we keep ourselves, and why it is not part of the banner question. While you are signed in we write the short usage record described in section 2 straight into our own database. It sits outside the cookie choice for a different reason from Ahrefs: there is no third party in it at all. Nothing about it is sent to another company, none of it is sold or shared, and the only thing it leaves on your device is the one per-tab marker listed above, which disappears when you close the tab. The banner is a question about handing data to an analytics company, and this is not that. Section 9 says how long we keep it, and it goes when your account goes. The one exception is a problem recording you choose to make, which captures the page's network requests, these among them.

The security check on sign-in, account deletion and the free plans. Cloudflare's check runs on those pages whatever you answered to the banner, because it is part of doing the thing you came to do rather than a way of measuring you. It does not run anywhere else on the site, and section 5 says exactly what Cloudflare is told.

Jam, the bug-reporting service, which loads either way. Every page loads two small scripts from Jam and a hidden Jam frame, so that a recording link we send you works on whichever page it opens. On an ordinary visit they record nothing. Jam still receives what any server receives when your browser fetches a file from it, which is your IP address, your browser and our site's address, and the hidden frame tells Jam that its script is working here and how quickly the frame loaded. In our own tests in Chrome this set no cookie and wrote nothing to this site's storage. The Jam frame keeps one note in its own session storage, which your browser deletes when you close the tab. A recording starts only when you open a recording link we sent you and start it yourself. Your browser then asks which screen, window or tab to share, and asks for your microphone if you choose to narrate. That request names this site, because Jam's recorder runs inside our page. Whatever you share is recorded, including anything else on that screen and, if you allow it, the sound your computer is playing, so close anything private before you start. You can stop at any time. Section 5 lists what a recording holds.

Sentry, the error reporter, which loads either way. Our pages load one small script from Sentry so that a page that breaks can tell us. If nothing breaks, nothing is reported, and Sentry receives only what any server receives when your browser fetches a file from it, which is your IP address, your browser and our site's address. When the code running a page hits an error that nothing caught, the page sends Sentry an error report, and section 5 lists what one holds. It carries no account id and no email address, the page address is cut off at any question mark or # sign, and screen recording and performance tracing are switched off. Sentry sets no cookie and stores nothing on your device, so, for the same reason as Ahrefs and Vercel's counters above, it sits outside the cookie choice: there is nothing on your device to consent to or to switch off. It is there to find and fix bugs, not to measure you or to advertise to you. It does not run in our own test accounts or on a developer's computer.

Changing your mind. Clear my cookie choice Clearing it makes the banner ask again the next time you open StackDesign, and nothing goes to PostHog until you have answered it.

If you had accepted and then cleared it, PostHog stops at once in any StackDesign tab you still have open, and the cookie and the random id it kept in your browser are deleted. If no tab is open, they are deleted the next time you open StackDesign. One entry is deliberately kept: PostHog's own note that you opted out, which is the thing that stops it starting again. Clearing your browser's site data for this site removes that too.

Do Not Track and Global Privacy Control. California law requires us to tell you how we respond to Do Not Track signals. We do not follow you across other websites and we run no advertising trackers, so there is no cross-site tracking here for a Do Not Track signal to switch off. There is nothing for a Global Privacy Control signal to switch off either, because we never sell or share personal information in the first place.

8. Where your data lives, and how it is protected

Your account and your work are stored in our Supabase database. Traffic between your browser, our site and our providers is encrypted in transit using TLS, and data is encrypted at rest by our providers.

Access between workspaces is enforced in the database itself, using row level security policies, so one customer's account cannot read another customer's projects or materials. Administrative access on our side is limited to the people who need it to run and support the Service.

No system is perfectly secure, and we cannot promise that a determined attacker will never succeed. If a breach affects your personal information, we will notify you and any regulator as the law requires.

9. How long we keep it, and how to delete it

We keep your account and your work for as long as your account is open, and for as long afterwards as we need to meet a legal or accounting obligation.

Usage records. This is the record described in section 2: a row when a browser tab signs in, a row each time you open a page, and a row every two minutes while a tab is open and in front of you. It holds no design work and nothing you typed. We keep those rows for three years and then delete them, on a job that runs once a month. Only we can read them, and they answer one question for us, which is what parts of StackDesign people actually use. They are tied to your account, so deleting your account deletes them at the same time.

Deleting your account. You can delete your StackDesign account yourself from your account settings. Doing so removes your account and the project data attached to it from the live database.

If you cannot sign in. You can ask us to delete your account by email instead, on our Delete my data page. One account covers both products, so that one page removes it everywhere. Type the address on the account and we send a link to it. That link opens a page showing what is about to be removed, and nothing goes until you confirm it there. Once you confirm, the removal runs on its own rather than waiting for somebody here to get to it. The link works once and stops working a short time after it is sent, so an old copy of the email cannot delete an account later.

Backups, honestly. Deletion from the live database does not instantly erase every encrypted backup copy. Backups roll over on a fixed schedule, and a deleted record disappears from them as they age out. We do not restore deleted data from a backup except to recover from a genuine system failure. Here is the actual number: our database runs on the Supabase Pro plan, which takes a backup once a day and keeps each one for seven days. So a record you delete today is gone from the live database immediately and out of the last backup copy within a week.

Records we keep after deletion. We retain what the law requires us to retain, which is mainly the billing and tax record of what you paid, and the record of your consent to a recurring charge, which California's automatic renewal law requires us to keep. We keep that consent record for three years, or for one year after the subscription ends, whichever is the longer of the two. Most accounts have no such record: nothing is charged during the open beta and signing up never asks for a card. We write one when you are SHOWN the optional offer to put a card on file. If you agreed, it holds what you were shown at the time, the price and the first charge date, when you agreed, and the email address on your account. It identifies you by the email address on the account and by your Stripe customer reference, so the record can show whose consent it was. That one is kept even if you delete your account, because keeping it is what the law requires. If you declined, the record holds only the fact that you declined and the date, and it is deleted with your account. Neither one holds anything about your designs.

Our newsletter. Deleting your account also takes the email address on that account off our newsletter. We keep one line about it, the address and the date it came off, so that a later import cannot put you back on a list you have left. If you signed up to the newsletter separately with a different address, that one is left alone, and you can take it off yourself using the unsubscribe link on any newsletter we send.

AI conversations. Your AI Designer conversation history and the project facts it produced are part of your workspace and are deleted with it.

Problem recordings. A recording you make for us is kept in our workspace at Jam, not in our database, so deleting your account does not remove it. We keep a recording while we work on the problem it shows and delete it once that problem is fixed, and no later than 90 days after you made it. If you want yours deleted sooner, write to us through the contact form on our support page and we will delete it.

Error reports. Sentry keeps an error report for up to 90 days and then deletes it. A report carries no account id, so it is not tied to your account and deleting your account does not change it. It deletes itself within those 90 days.

10. Your privacy rights

Whoever you are and wherever you live, you can ask us to:

• tell you what personal information we hold about you and where it came from;
• correct anything that is wrong;
• give you a copy in a portable format;
• delete your account and the personal information attached to it; or
• stop a particular use of it.

Contact us as described in section 14. We will respond within the time the applicable law allows, and we will not treat you worse for exercising a right.

If you are in California

The California Online Privacy Protection Act applies to StackDesign regardless of our size. This page is our conspicuously posted privacy policy under that law: it names the categories of personal information we collect (section 2), the third parties we share it with (section 5), how you review and change your information (section 10 and your account settings), how we announce changes to this policy (section 13), and our Do Not Track disclosure (section 7).

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to businesses above certain revenue and volume thresholds. StackDesign does not meet those thresholds today, so we are not currently a covered business under that law. We nevertheless offer the rights it grants, as a matter of practice: to know, to delete, to correct, to opt out of sale or sharing (which never happens here), and to limit the use of sensitive personal information (which we do not collect). We do not sell or share personal information as those terms are defined in that law, and we have not done so in the preceding twelve months.

If you are in the European Economic Area, the United Kingdom or Switzerland

The General Data Protection Regulation may apply to you even though we are based in the United States, because it follows the person rather than the company. You have the rights to access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where we rely on it. You also have the right to complain to your local supervisory authority.

We have not appointed an Article 27 representative, and we would rather say so plainly than leave the question open. That obligation applies to companies outside the European Union or United Kingdom that offer goods or services to people there, or monitor their behaviour, on more than an occasional basis. We are a small California company, we do not target or advertise to the European Union or the United Kingdom, and any use from there today is occasional. We review that as the business grows and will appoint a representative, and name them here, if the position changes. In the meantime you can reach us directly using section 14, and you keep every right described above, including the right to complain to your local supervisory authority.

11. Children

StackDesign is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

12. International transfers

StackDesign is operated from the United States, and our sub-processors process data in the United States and, depending on the provider, in other countries where they operate. If you use StackDesign from outside the United States, you are sending your information to the United States.

Where personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, our providers' data processing agreements include the European Commission's Standard Contractual Clauses, or an equivalent approved transfer mechanism.

13. Changes to this policy

We will update this policy when our practices or the law change. The effective date at the top of the page always shows the current version.

If we make a material change, for example adding a sub-processor that handles personal information or starting to use a new category of data, we will post the updated policy here before the change takes effect and tell account holders by email or by a notice in the Service.

14. How to reach us

For any privacy question, or to make a request under section 10, write to us through the contact form on our support page. We acknowledge privacy requests within 10 business days and complete them within 45 days of receiving them. Where the law that covers you sets a shorter deadline, we meet that one instead.

Written requests and formal notices can be posted to us at:

We have not appointed a dedicated data protection officer. One is required only of public authorities and of organisations whose core activity is large-scale monitoring or large-scale processing of sensitive data, and we are neither. Privacy requests go to the address above and are handled by the company's owner.

To help us find your records quickly, write from the email address on your StackDesign account where you can. If we cannot verify that a request comes from you, we may not be able to act on it, which is a protection for you rather than an obstacle.