Privacy Notice

Information and purposes

The service stores account identity and profile information, editor preferences, prompts/chats, projects and version history, personal saved shapes, permitted uploads, generation jobs/assets and instruction files. It also processes usage and security information, policy acceptance and reports or privacy requests.

These records support account access, requested design features, work recovery, safety/security, support and legal compliance. Where applicable, processing relies on contractual necessity, legal obligations, appropriately assessed legitimate interests, or separate consent for activities that require it. Marketing and optional tracking require separate choices; signing in is not blanket consent.

Providers, hosting and transfers

Sign-in uses Google through Firebase Authentication. Requested AI assistance uses Anthropic; approved 3D workflows use Meshy. Relevant prompts, project context, renders and permitted references may be transmitted for those features. Provider retention and training depend on the contracted service and settings; do not assume all providers offer no training.

Some geometry loads from a GitHub-hosted LDraw library. Browser dictation uses the browser’s speech-recognition implementation and may involve that browser provider; the app does not promise on-device-only processing. Dictated text remains a draft until sent.

The production service uses Amazon Web Services in Northern Virginia, United States (us-east-1). Depending on your location, using GENBRX may involve processing information in another country. Google and providers used for optional features process information through their own infrastructure.

Private work and disclosure

Projects and saved shapes are private by default. Creating a share link exposes a chosen saved model, its title, a preview image and your display name to anyone with that link. Recipients may forward it. Later edits remain private until you update the shared version. Sharing does not expose chat history or reference uploads, and does not list the project in a feed. You can stop sharing; deleting the project or requesting account deletion also disables its links. Downloaded, cached or externally reposted copies are outside the app’s direct control. Feed publication and the seller marketplace remain unavailable. Content may also be disclosed to contracted service providers, to advisers or authorities where lawfully necessary, or in a lawful business transfer.

Retention and deletion

Saved account and project records are kept to provide your workspace until removed through the supported deletion process. Job checkpoints and processing files support background work and recovery. Logs and backups follow separate retention schedules; deleting live content does not immediately remove older backup copies. Contact us for information about retention of a particular record.

Account settings provide an export and deletion request. A deletion request disables access, revokes sessions and fences projects. Deletion then requires operator confirmation of provider cleanup and storage processing. In-flight workers must drain before purge. Required financial/legal records can delay or limit deletion; they must be separately reviewed rather than automatically destroyed.

Backups follow the disclosed schedule and must remain beyond ordinary use for deleted content. Restores must reapply deletion records. The service cannot guarantee removal of files already exported to third parties.

Sharing measurement

Shared links carry platform campaign parameters. First-party reports aggregate activity by day, event and platform category without visitor identifiers, IP addresses, raw share tokens or full URLs. The new-project request temporarily retains a platform category through sign-in; its project attribution is included in account export and deleted with the project or account. Do Not Track and Global Privacy Control signals suppress measurement. Already aggregated totals do not identify individual accounts.

Optional session statistics

After Accept optional, a 30-minute traffic cookie links visits and selected actions to campaign tags, public referrer domain, normalized page routes, source/platform and device/browser categories. Signed-in sessions may link to an account and its new-project/first-save conversions. These session records are pseudonymous rather than anonymous. No screen replay, keystrokes, form contents, prompt text, IP addresses or raw user-agent strings are captured. Raw sessions/events are eligible for cleanup after 90 days and pruned when new sessions start; deployment retention operations also cover idle periods. Withdraw and delete the current session at browser storage controls. Account export includes linked sessions; deletion requests erase them. Aggregate daily totals remain separate and cannot identify an account.

Learning and improvement

Solver and visual-review outcome records include structural and categorical assessments linked to projects. The current visual-learning representation does not store reference images or prompt text in those assessment fields. Linked records are not claimed to be anonymous; the account purge removes linked learning records. Provider training practices require a separate contractual assessment.

Your rights and choices

Depending on applicable law, you may request access, correction, deletion, portability, restriction or objection; withdraw relevant consent; and complain to a competent privacy authority. Submit a privacy request or use the privacy contact above. Identity verification will be proportionate to the request. A download of a single model is not a complete account export.

See cookies and browser storage for the current inventory and controls. Clearing browser storage does not delete server records.

Children, security and reports

Account onboarding does not ask for an age declaration or date of birth. Parents and guardians can contact the operator about a child’s information or a privacy request.

Security includes account sessions, ownership checks and restricted private responses; no system is completely secure. Reports contain the contact and evidence you submit and are retained for review, appeals and necessary legal handling as needed to handle the request. Do not submit sensitive identity documents or suspected child sexual abuse material through the report form.

Changes

The operator will update this notice when actual processing changes and provide further notice where required. New purposes that require consent will not be inferred from continued use.