Privacy Policy

Last updated: August 6, 2026

This Privacy Policy explains how Meshcraft ("we", "us", or "our") collects, uses, and protects your personal information when you use our 3D model generation service at meshcraft.xyz. By using Meshcraft, you agree to the collection and use of information as described in this policy.

1. Information We Collect

We collect the following categories of information when you use Meshcraft:

Account information: Your email address, collected at registration
Authentication credentials: Your password, stored as a secure hash by Supabase Auth (we never store plaintext passwords)
Input content: Images you upload and text prompts you submit for 3D generation
Generated content: 3D models (GLB files) produced from your inputs
Usage data: Credit consumption, generation history, subscription tier, and account activity
Consent records: Timestamps indicating when you accepted our Terms of Service and whether you opted into marketing communications
Billing information: Managed entirely by Stripe; we do not store your full payment card details

2. How We Use Your Information

We use the information we collect for the following purposes:

Account creation, authentication, and management
Processing your 3D model generation requests using AI engines
Managing your subscription, billing, and credit allocation via Stripe
Sending transactional emails (email verification, password reset, billing receipts)
Sending product updates and tips, if you opted in during registration
Improving the Service by analyzing usage patterns and generation outcomes
Investigating and resolving technical issues, security incidents, and support requests

3. Data Storage and Security

Your data is stored on infrastructure provided by Supabase, a secure cloud database and authentication platform. Specific details:

Account data and profile information are stored in a Supabase PostgreSQL database
Uploaded images and generated 3D models are stored in Supabase Storage
Passwords are hashed using Supabase Auth's built-in bcrypt hashing, never stored in plaintext
All data transmission between your browser and our service is encrypted via HTTPS
We apply security headers, including HSTS, to protect against common web attacks, and run Content Security Policy in report-only mode

While we take reasonable measures to protect your data, no system is completely immune to security breaches. We cannot guarantee absolute security.

4. Third-Party Services

Meshcraft relies on the following third-party services to operate. Each has its own privacy policy that governs how they handle data:

Supabase: Authentication, database, and file storage. Your account data and generated models are stored here.
Stripe: Payment processing and subscription management. Stripe handles all payment card data; we never see your full card number.
Hugging Face: Hosts the Trellis 2 AI model used for 3D generation. Your input images are transmitted to Hugging Face Spaces during generation.
fal.ai: Used for text-to-image generation (when using text-to-3D mode) and the Hunyuan premium engine. Text prompts are transmitted for text-to-image generation, and input images are transmitted when using the Hunyuan engine.
Netlify: Hosts and deploys the Meshcraft web application. Netlify may log request metadata (IP addresses, user agents) for operational purposes.
Upstash Redis: Rate limiting for selected endpoints. User IDs or client IP addresses are used as rate-limit identifiers.
Resend: Transactional and campaign email delivery. Resend receives your email address and the message content when we send you email.
Email measurement: We record whether our emails are opened and whether links in them are clicked, through Resend, so we can tell whether our messages are useful. This applies to the emails described above and is never used for advertising.
Google Analytics: Site usage analytics. Google Analytics receives usage data about visits to the site after you accept analytics cookies.

5. Cookies and Authentication

Meshcraft uses cookies for the following purposes:

Session management: Supabase Auth sets session cookies to keep you logged in across browser sessions
Authentication state: Your login status is maintained via Supabase session tokens stored in your browser
Analytics: Google Analytics sets analytics cookies after you accept them to help us understand site usage

Google Analytics sets analytics cookies only after you accept them, and we use them to understand site usage. We do not use advertising or cross-site tracking cookies. You can change your choice at any time from the Cookie settings link in the footer.

6. Email Communications

We send the following types of email:

Transactional emails (mandatory): Email verification, password reset, billing receipts, subscription change confirmations, and pre-charge trial reminders. These are essential to the Service and cannot be opted out of.
Optional email: Product updates, new features, and tips, as well as occasional announcements about your account, such as an offer to return after a trial has ended. The ongoing product newsletter is sent only to people who opted in at registration. Account announcements may be sent to any registered user. You can opt out of all optional email at any time by contacting us at [email protected].

7. Your Rights

You have the following rights regarding your personal data:

Access: You can view your account information, credit usage, and subscription status through your account page. Paid users can view generation history on the My Models page
Correction: You can update your password through your account settings
Deletion: You can request account deletion by contacting us at [email protected]. Account and associated data will be removed within 30 days.
Export: Data export is not currently available as a self-service feature. Contact us to request a copy of your data.
Marketing opt-out: Contact us to remove yourself from optional marketing communications at any time

8. Data Retention

We retain your data for as long as your account is active. Specific retention policies:

Input images uploaded for generation are deleted from storage immediately after the 3D model is produced
Generated 3D models are stored until your account is deleted
Account and profile data is retained while your account is active
Upon account deletion, all personal data is removed within 30 days, unless we are required to retain it by law
Stripe billing records may be retained longer to comply with financial reporting obligations

9. Children's Privacy

Meshcraft is not intended for use by individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately at [email protected] and we will take steps to delete that information.

10. International Data Transfers

Meshcraft operates using cloud infrastructure that may process your data in multiple geographic regions. Specifically:

Supabase and Netlify infrastructure may be hosted in the United States or European Union
Hugging Face Spaces (used for 3D generation) processes data on servers in the United States and Europe
fal.ai processes image and generation requests on infrastructure in various jurisdictions

By using Meshcraft, you consent to your data being processed in these jurisdictions. We rely on each third-party provider's data transfer mechanisms to handle international transfers in compliance with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page when changes are made. For material changes that significantly affect how we use your personal data, we will notify you via email or a prominent notice on the Service.

We encourage you to review this policy periodically to stay informed about how we protect your information.

12. Contact

If you have questions or concerns about this Privacy Policy, or if you wish to exercise your data rights, please contact us at [email protected].