Privacy Policy

Draft — this policy is a working draft pending legal review and is provided for transparency, not as legal advice.

This Privacy Policy explains what information StashGrid collects when you use our website and the StashGrid insert designer, why we collect it, and the choices you have. By using StashGrid you agree to the practices described here.

Information we collect

• Account data. When you create an account we store the details you provide (such as your email address) and authentication records through Supabase. We record verified registration, successful app sign-ins, the sign-in provider, and authorized STL export attempts. These records are linked to your account; an export authorization does not confirm a download.
• Saved designs. Account-enabled workspaces save your case choice, item arrangement, surface settings, generated design name, and editor view in Supabase. We remember your editor language and last-opened design. Your browser may also keep an account-scoped recovery copy of changes that have not yet reached the server. Before you create an account, the designer keeps your design in your browser’s local storage so it survives a reload; it moves into your account when you sign up. STL files are generated on your device and are not kept in a cloud STL library.
• Optional product questions and requests. While you design, we may ask a few optional questions (such as firearms or airsoft, which guns you use, and where you heard about us) and offer a box to request a case, gun or accessory we don’t support yet. Before you have an account, your answers and requests stay in your browser; when you create an account they are stored with it. We store your selected options, response language, and any text you choose to type. These answers help us decide what to support next. Authorized staff can review them alongside account activity. You can skip every question; selections are not proof of ownership.
• Usage analytics. Across the site we send page views, clicks on marketing pages, page performance timings and approximate country (from your IP address, which PostHog discards) to PostHog EU. In the editor, we also send app action events, including selected case and gear models, layers, design identifiers, exports, failures, browser/device context, and campaign attribution. Signed-in activity is linked using your account ID so we can understand usage across visits. When you have an account, we also send its email address, name, profile picture, sign-in method, language and sign-up date, and your answers to the optional questions (including any text you type under “Other”), so we can understand who uses StashGrid. Guest activity records only which options you choose, never text you type. We do not send the text of gear or case requests, credentials, item positions, full design files, or screen recordings. Analytics uses a browser identifier stored in cookies and local storage, which is reset when you sign out. We respect browser Do Not Track and Global Privacy Control signals. This is separate from essential account activity records.
• Error telemetry. We use PostHog EU error tracking to capture errors in the site and the designer so we can diagnose and fix problems. Error reports carry the page, the browser identifier above and the stack trace, not request or response bodies, cookies, headers or local variable values.
• Feedback. If you use the in-app feedback form or email us, the message you send, the email address you choose to give, the page, the selected case and your browser type are stored in our database (Supabase) so we can respond and improve StashGrid. Feedback from a signed-in account is linked to that account.
• Cookies and local storage. We use cookies and browser local storage to keep you signed in, remember your designer preferences, and support the analytics and error tools above.

How we use information

We use the information we collect to operate and secure your account, provide and improve the insert designer, diagnose technical issues, understand product usage in aggregate, and respond to feedback and support requests. We do not sell your personal information.

Data processors

We share data only with the service providers that help us run StashGrid: Supabase for accounts and saved designs, Resend for account email, Google when you choose Google sign-in, PostHog EU for product analytics and error telemetry. Authentication providers process the information needed to complete your chosen sign-in method. Account emails are separate from any future optional newsletter subscription.

Data retention

Saved designs remain until you delete them or your account. Account deletion removes the active account, saved designs, preferences, and optional onboarding answers and associated app activity records. Local recovery copies are eligible for recovery for 30 days and are cleared on a successful sign-out from that browser. Clearing site data in your browser also removes them. Provider backups, security logs, delivery logs, analytics, and error telemetry have separate retention settings; these settings and the final retention schedule must be confirmed before this draft is finalized.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can also delete your account, which removes your associated account data. The account menu lets you request an email change, sign out of other devices, or delete your account. Sensitive actions require a recent sign-in. For help, contact hello@stashgrid.io.

Changes to this policy

We may update this policy as StashGrid evolves. When we make material changes we will update the date at the top of this page.