Privacy policy
Last updated 12 November 2026
This explains what ShapeDis stores about you, who processes it, and what you can ask us to do. The person responsible for your data is Tal Vaknin, Israel, support@shapedis.com.
What we store
- Your projects: your messages, the pictures and files you attach, the instructions that build each part, every saved version and its checks, and the files made for download.
- Your account, when accounts are offered: your email address and the sign-in details needed to recognise you (if you sign in with a password, only a one-way scrambled version of it is stored, never the password itself; when you choose one, the first five characters of its scrambled form are checked against the public Have I Been Pwned list of leaked passwords, which cannot reveal the password), and your plan or credit use if you have one.
- Feedback you send: the note, the kind (idea, problem or something you like) and which project and language you were in, and thumbs up or down on a reply, with the words you add.
- Technical records: such as the time of a request, your IP address and errors. We use them to run the service safely and fix problems, and keep them only as long as we need to.
- Usage statistics: which pages are opened and, once you sign in, which actions you take, kept with your account number: signing in, starting a project, sending a message and whether you pointed at the model or attached a picture, running out of credits, and which tools and buttons in the editor you use, for example Measure or Section, plus downloads, restores and deletions. We record that a button was used, never what you typed. Your country and city are worked out from your IP address, which is then discarded. When a page in your browser hits a fault, an error report is also sent: the error message and where in our code it happened, without your account number. It is not meant to hold your content. We never send your messages, your email address or your name to our statistics provider, and we do not record typing, screens or what is on your screen.
- On your own device: your theme, panel sizes, chosen AI model and unsent drafts are kept in your browser's storage. They never leave your device.
We do not use advertising or tracking cookies. Our statistics are set up without cookies or browser storage, so they leave nothing on your device and do not follow you between sites. We use these statistics only to understand and improve ShapeDis, and we do not sell your data.
Who at ShapeDis can see your content
Your projects are private to you, but they are not hidden from us. The person who runs ShapeDis (today the founder), and anyone we later authorise to help run it, can open your account in a read-only view and see your projects, messages, attached files, versions and credit use, and can read the feedback you send and our technical records. We do this only when we have a reason:
- to answer a question or fix a problem you reported, or one we found, such as a build that fails or a project that will not open;
- to check that the service works and to find out why it was slow or wrong;
- to keep the service safe: to look into abuse, a breach of the Acceptable use rules, fraud or a security problem;
- when the law or a provider such as Anthropic requires it.
The view cannot change anything in your account, and each time an account is opened this way we record who did it, which account and when, and keep that record for a year. We do not browse projects out of curiosity, we do not use them to market anything, we do not show them to other users, and we do not use them to train AI models. If you would rather we did not look at a project, say so when you write to us and we will not, unless one of the reasons above makes it necessary.
Why, and on what basis
| What we do | Basis (where the EU GDPR applies) |
|---|---|
| Give you the service you asked for: your account, projects, the AI's answers, downloads | Performing our contract with you |
| Keep it secure and working: technical records, error reports, looking at an account to fix a problem or to look into abuse | Our legitimate interest in running a safe, working service |
| Usage statistics, to improve ShapeDis | Our legitimate interest in understanding and improving the service |
| Payments, invoices, tax and answering legal requests | Performing our contract, and legal duties |
Where we rely on a legitimate interest you may object to it, and we will stop unless we have a compelling reason, for example security. If we ever ask for your consent for something else, you can withdraw it at any time.
Who handles it
| Who | What for | What they get |
|---|---|---|
| Anthropic (United States) | The AI model that answers your chat and writes the part's instructions | Your messages, pictures, and the part's instructions and check results. Under Anthropic's business terms it may not train its models on this content. |
| Google Cloud (United States, Iowa) | Our server and database, the isolated builds of your parts, and file storage | Everything you store in ShapeDis |
| Resend (United States) | Sending the emails sign-in needs: confirming your address, resetting a password and sign-in links | Your email address and the text of those emails. Not your projects or messages. |
| Cloudflare Turnstile (global network) | A check on the email sign-in forms that you are a person and not a program, to stop abuse | Your IP address and browser details, sent when you use those forms. Not your email or password. |
| PostHog (European Union, Frankfurt) | Usage statistics, so we can see how ShapeDis is used and fix what is confusing | Pages opened, your account number with the actions above, a country and city from your IP address, and error reports from your browser (no account number). Not your messages, email or name. |
| Paddle.com (our payment provider and Merchant of Record) | Taking payment for paid plans and top-ups, tax, invoices, refunds and fraud checks | Your name, email, country and payment details, which you give to Paddle at checkout. We never see your card number. We receive from Paddle that you paid, the plan, and your Paddle customer number. Paddle is an independent controller of this data under its own privacy policy. |
We do not give your content to anyone else, except if the law requires it. Your data is processed in the United States, in the European Union (statistics) and in Israel. Where the law requires a safeguard for sending data to another country, we rely on the provider's data processing terms, such as standard contractual clauses. Write to us if you want to see them.
How long we keep it
- Your projects and account: until you delete them. You can delete a version, a project or your whole account yourself in the app. Deleting your account removes your sign-in, projects with all their versions, chat and files, your credits and your settings, and erases the usage statistics kept under your account number.
- What we keep after you delete your account: only a one-way scrambled copy (hash) of your email, so that deleting and signing up again does not give the free credits twice, and what we must keep by law, such as payment and invoice records, which Paddle holds.
- Technical records: kept in short rolling files on our server that are overwritten automatically. We do not keep a separate backup of the database today. If we start to, a backup will not be kept longer than 30 days.
- Records of staff opening an account: one year.
- Anonymous page views and error reports: they carry no account number, so deleting your account cannot find them. They are kept as long as the statistics are useful to us.
- Feedback you send: deleted with your account.
If you cannot delete something yourself, write to us and we do it within 30 days.
Your rights
You may ask to see the data we hold about you, correct it, have it deleted, restrict or object to how we use it, or receive a copy. Write to support@shapedis.com. We answer within 30 days. These rights come from the Protection of Privacy Law, 1981 of Israel, and from laws such as the EU GDPR where they apply to you. You may also complain to the Privacy Protection Authority in Israel, or to your local data authority.
Security
Connections use HTTPS. Parts are built in an isolated environment with no internet and no access to your account, other projects or our secrets. No service can promise perfect security, and we will tell you and the authorities if a breach affects you, as the law requires.
Children
ShapeDis is for people aged 18 and over. If you think a child has used it, tell us and we will delete their data.
Changes
If we change this policy in a way that matters, we will tell you before it applies. The date above shows the latest version. See also the Terms of use.