Privacy Policy

Last updated: [DATE]

Placeholder notice: bracketed fields like [Company Legal Name] and contact email below need your real details filled in. This reflects what the ForgePoly codebase actually collects and does with data as of this writing, not a guess - update it if the product changes.

1. What we collect

Account info: email address and a hashed password (we never store your password in plain text).
Billing info: handled entirely by Stripe - we store your Stripe customer/subscription IDs, not your card number.
Content you submit: text prompts and any reference images you upload for generation.
Generated output: the 3D assets (and their file formats) created from your prompts/images.
Usage data: which plan you're on, your token balance and transaction history, and basic logs of generation jobs (status, timing) for billing accuracy and debugging.

2. How we use it

To provide the Service (process your generation requests, enforce plan limits, bill your subscription), to communicate with you about your account, and to diagnose and fix technical problems. We do not sell your personal data.

3. Third parties we share data with

Stripe - payment processing and subscription billing.
Cloudflare R2 - object storage for your uploaded images and generated assets.
RunPod (or equivalent GPU cloud providers) - receives your prompt/image and reference data solely to run the AI generation pipeline; it is not used by that provider to train their own models beyond standard infrastructure logging.

Each of these providers processes data under their own privacy policy and security practices.

4. Cookies and sessions

We use a single session cookie (via NextAuth) to keep you signed in. We do not use third-party advertising or tracking cookies.

5. Data retention

We retain your account data and generated assets for as long as your account is active. If you delete an asset or your account, we remove the associated files from storage; billing records are retained as required for tax/accounting purposes.

6. Your rights

You can access, update, or delete your account data at any time from your account settings, or by contacting us. Depending on where you live, you may have additional rights (e.g. under GDPR or CCPA) to request a copy of your data or object to certain processing - contact us to exercise them.

7. Children's privacy

The Service is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect data from them.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact

Questions about this policy or your data: [support@yourdomain.com].