Security and your data
A plain account of where your work lives, who can reach it, and what we do not claim. If you are deciding whether to trust a small company with a wall you are about to build, this is the page that should answer it.
Where your work lives
Your account and your designs sit in a managed Postgres database run by Supabase. Traffic between your browser, this site and the services behind it is encrypted in transit with TLS, and the data is encrypted at rest by the providers holding it.
Every workspace is walled off from every other one at the database level, not by a check in the page you are looking at. The rules live next to the data, so a bug in the interface cannot hand your rows to somebody else's account.
Payment cards
Card details go straight to Stripe and never touch our servers. We hold the identifiers Stripe gives us for your customer and subscription records, your plan and your renewal dates. We never see or store a full card number.
Who else touches the data, and why
Seven companies process data on our behalf. The privacy policy names every one of them, what it holds and why it is there.
| Provider | What it is for |
|---|---|
| Supabase | The database and the sign-in system: your account, your projects and your libraries. |
| Stripe | Payments. Card data goes to Stripe directly, so we never hold it. |
| Vercel | Hosting and server logs. |
| Anthropic | The AI assistant, when you use it. |
| Resend | Account email: sign-in links, receipts, replies. |
| Ahrefs and PostHog | Site measurement. |
Your designs are yours
You own what you draw. You can export your cut lists and your material lists, and you can close your account and take your work with you. We do not sell it, and we do not train a model on it.
Signing in
You can sign in with Google or with an emailed link. If you set a password we store only a salted hash of it, so nobody here can read it. One account can be signed in from one place at a time, which is what stops a shared login quietly becoming five.
What we do not claim
We do not hold a SOC 2 report, an ISO 27001 certificate or any other audit badge, and we are not going to print one on a page because it looks reassuring. What is written above is what is actually running. If that changes, this page changes with it.
Found something that looks wrong? Tell us, and you will get a real answer from the person who wrote the code.
The longer versions
The privacy policy lists every category of data, every provider and every right you have over it. The terms cover the agreement itself. The cookie page covers what is stored in your browser.