Privacy
Effective date: 23 September 2026
TO3D ("we", "us", "our") operates to3d.app. This policy explains what data we collect, why, and how you can control it.
1. Data we collect
Google sign-in
When you sign in with Google we receive your name, email address and profile picture via Google OAuth 2.0 (scopes: openid, email, profile). We use these solely to create and identify your TO3D account. We do not access your Google Drive, contacts, calendar or any other Google service.
Images you submit
We store the images you upload (JPG or PNG, up to 10 MB each) to generate 3D models. Images are sent to third-party AI model providers for processing and are not used to train any model.
Generated models
The GLB files we generate are stored in your account so you can re-download them. You own the output — see our Terms.
Billing data
Payments are processed by Stripe. We do not see or store your full card number. Stripe provides us with a card brand, last four digits and billing email so we can show your transaction history.
Service logs
We log API calls, generation status and error events to operate and debug the service. Logs include timestamps, account identifiers and request metadata (IP address, user agent). We do not log image content in service logs.
2. How we use your data
- Authenticate your account and manage sessions
- Process image-to-3D generation requests
- Maintain your generation history and downloads
- Process payments and prevent fraud
- Provide customer support
- Monitor service health and fix bugs
We do not sell your personal data. We do not use your uploads or generated models to train AI models.
3. Third-party services
We share data with these providers only as needed to operate the service:
- Google — OAuth authentication (name, email, profile picture)
- Stripe — payment processing (billing details)
- PlanetScale — database hosting (account data, generation records)
- AI model providers — image-to-3D processing (uploaded images)
4. Data retention
Account data and generation history are kept while your account is active. If you request account deletion, we remove your personal data and uploads within 30 days. Anonymised service logs may be retained longer for operational purposes.
5. Your rights
You may request access to, correction of, or deletion of your personal data at any time. You may also request an export of your data in a machine-readable format. To exercise any of these rights, email support@to3d.app.
If you are in the EU/EEA, you have additional rights under the GDPR including the right to object to processing, restrict processing, and lodge a complaint with your local data protection authority.
6. Cookies
We use a session cookie to keep you signed in. We do not use advertising or tracking cookies. No cookie banner is needed because we only set strictly necessary cookies.
7. Security
All traffic is encrypted via TLS. Authentication tokens are stored encrypted at rest. We follow industry-standard practices to protect your data, but no system is perfectly secure — use a strong Google account password and enable two-factor authentication.
8. Children
TO3D is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
9. Changes
We may update this policy. Material changes will be posted on this page with an updated effective date. Continued use of the service after changes constitutes acceptance.
10. Contact
Questions about this policy? Email support@to3d.app.