Privacy
Cookies and browser storage
The current app uses browser storage to keep requested workspace actions working. No advertising or third-party analytics scripts are installed. First-party measurement includes aggregate counters and optional visit sessions.
Session statistics
Current choice: not selected. Browser Do Not Track and Global Privacy Control signals take precedence.
Current inventory
On a narrow screen, scroll the table horizontally to read every column.
| Use | Storage | Lifetime |
|---|---|---|
| Signed-in session | HttpOnly __Host-genbrx-session cookie (genbrx-session in development) | Up to 7 days; revoked on sign-out/deletion request |
| Sign-in verification | HttpOnly __Host-genbrx-login cookie (genbrx-login in development) | 10 minutes |
| Active projects, versions and pending work | genbrx-/legacy jamblox- localStorage | Until replaced, cleared, sign-out or deletion request in this browser |
| Pending prompts, shape placement and preview cache | Session storage | Browser session or workflow completion |
| Requested new-build handoff through sign-in | genbrx-new-build-intent sessionStorage (request ID and optional platform category) | Consumed after creation, invalid after 30 minutes, or cleared with the browser session |
| Optional traffic session | HttpOnly __Host-genbrx-traffic cookie (genbrx-traffic in development), set after Accept optional | 30 minutes of inactivity; raw records eligible for cleanup after 90 days, pruned when sessions start |
| Statistics choice | genbrx-traffic-choice localStorage | Until changed or the choice version changes |
| Chosen editor theme | Local storage | Until changed or cleared |
Your controls
You can clear site storage in your browser. This may reset pending local work or sign you out; it does not delete server-side projects. Account settings offer an export and deletion request. Optional session statistics use a short-lived cookie after you choose Accept optional. Do Not Track and Global Privacy Control signals suppress collection.
Sharing measurement
Share links include platform-specific campaign parameters. We count share attempts, shared-page opens, create clicks, new projects and first saved builds by day and platform category. Reports contain no visitor IDs, IP addresses, share tokens, prompts or full URLs. Counts are activity totals, not unique people or verified social posts. A project may retain its platform category to attribute its first saved build; that linked record is included in account export and removed when the project or account is deleted.
Recorded visits
With permission, a session records its start and last activity, normalized page routes, campaign tags, public referrer domain, source/platform category, device/browser family and selected action events. Signed-in sessions may link to your account and project conversions. We do not capture screen contents, keystrokes, form text, prompts, IP addresses, raw user-agent strings or private project/share IDs in page routes. Sessions expire after 30 minutes of inactivity. Duration and active time are estimates; anonymous sessions are visits, not a count of unique people. You can withdraw here and delete the current session. Account export includes linked records; deletion requests erase linked sessions and events. Raw anonymous records are eligible for cleanup after 90 days; cleanup runs when sessions start.
External services
Some geometry loads from a GitHub-hosted LDraw library. AI requests use the providers described in the Privacy Notice. Browser dictation may use the browser provider’s speech service. Those requests are not made private by disabling cookies.
Deployment-level analytics, future embeds or tracking must be inventoried and reviewed before activation. Where consent is required, they must remain blocked until a valid choice and offer accessible rejection and withdrawal.