Privacy Policy
Last updated: 15 October 2026
- Designing and previewing happen in your browser. Pictures you upload never leave your device; only the outlines traced from them are saved, and only if you save a design to an account.
- An account stores your e-mail, a scrambled form of your password that cannot be turned back into it, your plan and your saved designs.
- No ads, no analytics, no tracking, no selling or sharing of your data for marketing.
- No cookies unless you sign in. Signing in sets one cookie: it keeps you signed in for 90 days, or only until you close the browser if you untick “Keep me signed in”. Fonts and videos come from this site, not from third parties.
- You can delete your account and everything in it at any time, from the account menu.
1. Who is responsible
MeshMolded (this website and its design studio) is run by an independent maker based in the European Union ("we", "us"). MeshMolded is used worldwide, and we give everyone the same protection, wherever they live: the one of the EU General Data Protection Regulation (GDPR), which applies to us and is among the strictest in the world. We are the controller of the personal data described here.
Contact for anything about your data: meshmolded@gmail.com.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Account: e-mail address, password hash (PBKDF2 with a random salt; the password itself is never stored), plan and its end date, date the account was made | To give you an account, sign you in and apply your plan | Contract, Art. 6(1)(b) |
| Backer code you redeem, and when | To unlock your plan; one code works for one account only | Contract, Art. 6(1)(b) |
| Saved designs: the design's name, shape, stickers, text, colours and settings, including outlines traced from pictures you added | So you find your designs again on any device | Contract, Art. 6(1)(b) |
| Downloads: date and design name of each download | To count the downloads of your plan each month | Contract, Art. 6(1)(b) |
| Security records: the IP address and the e-mail address used in sign-in, sign-up, password-reset and code-reset attempts | To stop password guessing, mass sign-ups and abuse | Legitimate interests, Art. 6(1)(f): keeping accounts and the service safe |
| Anti-robot check when you create an account (Cloudflare Turnstile): technical signals about your browser and connection | To tell people from scripts that create accounts in bulk | Legitimate interests, Art. 6(1)(f) |
| Account e-mails: your e-mail address, when you create an account (a link to confirm it), ask for a password reset link, or change your password; and the date you confirmed it | To confirm the address belongs to you before a backer code is redeemed, to send reset links, and to tell you your password was changed | Contract, Art. 6(1)(b), and legitimate interests (account security) |
| Technical data our host processes to deliver any web page: IP address, browser type, time of the request | To deliver the site and protect it from attacks | Legitimate interests, Art. 6(1)(f) |
We do not collect payment details: rewards and backer codes are bought on MakerWorld, which handles payment under its own privacy policy. If you back the campaign, MakerWorld shows us, as the campaign's creator, your MakerWorld username and your reward tier. We use them only to send you your code in a MakerWorld private message, and we keep a private list of which code went to which username so we can help if you lose it; it never goes into the website's database. We do not receive your payment details or anything else from your MakerWorld account.
You do not need an account to design and preview. Without an account, nothing about your designs reaches us.
3. Pictures you upload
When you start from a picture, a logo or an emoji, it is processed entirely in your browser: we never receive the picture itself. Only the outlines traced from it become part of your design, and they reach us only if you are signed in (your design is then saved to your account). Please only upload pictures you have the right to use, and avoid photos of people.
4. Who else processes your data
- Cloudflare, Inc. hosts the website, runs its server code and stores the database (Cloudflare D1). It acts as our processor under its data processing agreement. Cloudflare's network is worldwide, so data may be processed outside the EU; transfers are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
- Google (Gmail) sends the account e-mails (confirmation and password links). It then receives your e-mail address and the message.
- Cloudflare Turnstile runs the anti-robot check on the sign-up form, loaded from
challenges.cloudflare.comonly while you create an account. Cloudflare uses what it collects only to run the check, not for advertising.
We share nothing else, sell nothing, and give data to authorities only when the law requires it.
5. How long we keep it
- Account, plan, redeemed code, saved designs and download records: until you delete your account. An account keeps its 60 newest designs (up to 3 MB); older ones are removed automatically.
- Sign-in sessions: 90 days with “Keep me signed in” (ticked unless you untick it), otherwise until you close the browser (the server forgets them after 24 hours); always ended when you sign out or change your password.
- Password reset links: valid 30 minutes, deleted within a day after that. E-mail confirmation links: valid 24 hours, deleted once used or expired.
- Security records (attempts) and the log of requested account e-mails: deleted after one day.
- When you delete your account, your account, designs, sessions and download records are deleted at once. A code you redeemed is kept only as "used", without any link to you. Our host's database backups may hold a copy for up to 30 days before it is overwritten.
6. Cookies and storage on your device
Visitors who do not sign in get no cookies at all. Signing in sets a single cookie, which the site needs to know it is you; nothing else is stored in cookies. A short notice says so on your first visit; there is nothing to refuse, because privacy laws do not require consent for what a service strictly needs, and accepting it only hides the notice (the browser remembers that).
| Name | Type | What for | How long |
|---|---|---|---|
mm_session | Cookie (HttpOnly, Secure, first-party), only after you sign in | Keeps you signed in | 90 days with “Keep me signed in”, or until you close the browser if you untick it; deleted when you sign out |
meshmolded.design, meshmolded.designId | Browser storage | Keeps the design you are working on, so it is still there next time | Until you clear it |
meshmolded.printer | Browser storage | Remembers your printer choice | Until you clear it |
meshmolded.scene, meshmolded.candy | Browser storage | Remember the 3D scene you picked and whether the piece is shown full of sweets | Until you clear it |
meshmolded.cookies | Browser storage | Remembers that you closed the cookie notice | Until you clear it |
Browser storage stays on your device: it is never sent to us, and you can clear it in your browser's settings at any time. No advertising, analytics or social media cookies, and no third-party scripts, except the anti-robot check on the sign-up form. Links to MakerWorld, YouTube or other sites take you to those sites, where their own policies apply.
7. Your rights
Under the GDPR you may ask us for access to your data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format. You can delete your account yourself (Account → Delete account). For anything else, write to meshmolded@gmail.com; we answer within one month. You may also complain to the data protection authority where you live or work, or to the one of the country where we are established.
If you live in California or another US state with a privacy law: we do not sell or share personal information, we do not use it for targeted advertising, and you can use the rights above, which we never answer with worse service.
8. Security
Passwords are never stored in readable form. Connections are encrypted (HTTPS), the session cookie cannot be read by scripts, sign-in attempts are limited, and the database is reachable only by the site's own server code. No system is perfectly secure, so please use a password you do not use anywhere else.
9. Children
MeshMolded is not meant for children under 16 without a parent's or guardian's permission. If you believe a child gave us data without it, write to us and we will delete it.
10. Changes
If this policy changes, the new version appears on this page with a new date. If a change matters for how we use your data, we will also say so on the site.