Data & privacy
Workspace records
Materials, recipes, quote customer details, orders and production costs are processed in your browser. Explicit cloud saving, or optional automatic saving after you enable it, stores the workspace under your authenticated account in MongoDB. Previous versions support recovery. We do not automatically connect to your marketplace, bank or customer inbox.
Sharing and connections
Owners can grant editor, viewer or production-operator access. Editors and viewers can read financial records; production operators receive only quantities, recipes and task schedules. Anyone holding a valid customer quote link can view its customer details, prices and terms and submit acceptance or a change request. Only token hashes are stored; share links carefully and revoke them when needed. Shop connections require owner authorization. Saved credentials and temporary previews are encrypted; merchant API providers process authorized sync requests. Sync and imports are explicitly initiated.
Local drafts and exports
A browser draft stays on this device when explicitly saved. Exported JSON and PDFs are files you control. Clearing browser storage can remove local drafts. Local drafts are not cloud backups.
Accounts and email
Account identifiers, password hashes, verification status and security records support access. Session cookies keep you signed in. Recovery tokens are hashed, time limited and single use. Queued email bodies are encrypted; Microsoft Graph handles delivery when configured. Authentication counters expire after 15 minutes. Verification links expire in 24 hours and reset links in 30 minutes. Email queue records expire after their delivery window, normally 24 hours (up to seven days for monthly tips). Delivery deduplication metadata is retained until account deletion; it does not contain message bodies. Optional activity emails can be disabled in Account. Monthly tips require explicit opt-in and can be stopped through the unsubscribe link or Account preferences. Opting out does not disable required security or billing messages. Owners may enable transactional customer order updates for customers expecting them. Account deletion may queue a short-lived confirmation message after removing the account.
Optional monthly marketing
Public newsletter signups require an email confirmation. Confirmed account preferences and newsletter contacts share one marketing limit per email address: at most one message every 30 days. We retain bounded signup source and campaign tags, consent dates, follow-up notes and submission status. Imported contacts remain unconfirmed and receive no invitations. Administrators can suppress reported bounces. We do not use email tracking pixels or claim to observe inbox delivery. Unsubscribe stops unsent marketing globally for the address. After deletion, a keyed fingerprint of the address remains to prevent accidental re-import; it contains no plaintext address. Changing the fingerprint secret requires a suppression migration. Campaign and administrative audit references may remain without deleted contact details.
Quick calculators and trials
Account-free calculator inputs run in your browser. Choosing Continue stores a temporary costing handoff in this tab for up to 24 hours; it is imported only after your confirmation and is not automatically saved to cloud. A trial start timestamp controls one-time 14-day access. Trial access does not subscribe you to marketing or create an automatic charge.
Payments
PayU processes new one-time Pro pass payments when enabled. Historical Stripe or Cashfree payments and recurring plans remain separate. Checkout shares the contact information needed by the provider, including name, email and phone when supplied, with purchase and payment references. We store provider and transaction references, payment status, successful payment amounts, currency, refunds and receipt links for access and reconciliation. We do not store full card numbers or bank credentials. Test payments are separated from live subscription access.
Administrator access
Authorized administrators manage account access, billing status, refunds and email delivery. The admin interface does not expose private workspace contents, passwords or recovery links. Administrative actions are logged.
Deletion and retention
Delete a cloud workspace in Settings or delete your whole account from Account using your password and explicit confirmation. Full deletion cancels active maker subscriptions before removing your account, maker workspace, legacy personal records and queued email. Financial records retain pseudonymous references for reconciliation and required record keeping. Provider transaction references and audit records may remain. Files on your devices are unaffected. Backups follow the operator's configured retention and do not automatically restore deleted access.
Site services
The retired marketplace tool advertising integration is disabled. The previous Vercel analytics integration has been removed. Maker calculators, account, customer quote, token, workspace and admin pages do not initialize advertising services. Payment processors, Microsoft and hosting providers have their own policies. We make no blanket GDPR or CCPA compliance claim.
Terms and support →