Privacy Policy

1. Introduction and Scope

This Policy applies to personal information we process through the Service, whether you use it in your browser or as an installed Progressive Web App (PWA) for offline use. It covers visitors who use the Service without an account as well as registered users who sign in.

You can use the editor without creating an account. When you work without an account, or while signed out, your projects and edits are stored only in your browser and remain under your control on your own device. We do not receive that local data unless and until you sign in and choose to save or sync it to our servers.

This Policy does not cover the practices of third parties whose services you may use through the Service, including Google and Anthropic. Their handling of your data is governed by their own privacy policies, which we describe further below.

2. Who We Are (Data Controller)

The Service is operated by [Legal Entity Name], which acts as the data controller for the personal information described in this Policy. As controller, we decide why and how your personal information is processed when you use the Service.

Where we rely on third parties such as Google and Anthropic to process data on our behalf or in connection with the Service, those parties act as our processors, as independent controllers, or as providers acting under their own agreement with you, as described in the relevant sections below.

If you have any questions about this Policy or wish to exercise your rights, you can contact us at [privacy@home3dplan.com].

3. Information We Collect

Account data. You can use the editor without an account. When you choose to sign in, sign-in is provided exclusively through Google using Firebase Authentication. We receive your Google account identifier and the email address associated with your Google account. That email address is managed by Google. We do not collect or store a password for you, because authentication is handled by Google.

Content data. When you save your work, we store the content you create, including your projects, plans, 3D models, and any materials or textures you upload. Our native project format is the .hdp file, and you can export your work as GLB or OBJ files (and, from DraftCAD, as DXF, SVG, or PDF). Content data is stored using Google Firebase and Firestore.

Shared projects. When you create a live share link, anyone who has the link can open the shared project, and where you grant edit access can change it, including people who do not have an account. Any edits a collaborator makes are stored as part of the project content. Because a shared project is visible to others with the link, please avoid including personal information you do not want shared. See Section 7 for how live share links work.

Optional AI key. If you choose to enable the AI features, you provide your own personal Anthropic API key. We store that key encrypted, as ciphertext, on our server. The application only exposes a boolean flag indicating that a key is saved. The key itself is never exposed to the browser client. You can remove your key at any time.

Analytics data. We collect basic, anonymous usage analytics only with your opt-in consent, given through the cookie banner. If you do not opt in, we do not collect analytics. Analytics are off by default.

Cookies and local storage. We use necessary cookies (such as session, language, and security cookies) that are always on, analytics cookies (opt-in), and marketing cookies (opt-in and reserved for possible future advertising partnerships). Because the Service is a PWA, your projects and edits may also be stored locally in your browser, for example in local storage, so that the Service works offline. See Section 5 and our Cookies Policy at /cookies for details.

Technical and log data. Like most online services, our hosting infrastructure may process limited technical information needed to deliver the Service securely and reliably, such as your device and browser type and information needed to route and secure your connection. We use this information to operate and protect the Service rather than to identify you personally.

4. How We Use Your Information

We use your information to provide and operate the Service. This includes authenticating you when you sign in, saving and syncing your projects across your sessions and devices, rendering the live share links you create, and enabling the optional AI features you choose to turn on.

We use analytics only if you opt in, to measure anonymous usage so we can understand how the Service is used and improve it. We use necessary cookies and local storage to make the Service function, remember your language preference, keep your session secure, and support offline use.

Legal bases (EEA and UK). If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR. We process account data and content data to perform our contract with you and to provide the Service you request (Article 6(1)(b)). Storing your Anthropic API key and operating the optional AI features you enable is likewise performance of our contract with you, or rests on your consent where applicable (Article 6(1)(b) or Article 6(1)(a)). We rely on your consent for analytics cookies, marketing cookies, and any optional features that depend on consent (Article 6(1)(a)), and you can withdraw that consent at any time. We process technical and log data, and we operate, secure, and improve the Service and prevent fraud and abuse, on the basis of our legitimate interests in reliable and secure delivery of the Service (Article 6(1)(f)), balanced against your rights. Where the law requires it, we process data to comply with our legal obligations (Article 6(1)(c)).

We do not sell your personal data, and we do not use your content to train AI models.

5. Cookies and Similar Technologies

We use cookies and similar technologies, including browser local storage, in three categories. Necessary cookies are always on and are required for the Service to function, including session, language preference, and security. Analytics cookies are opt-in and help us understand usage. Marketing cookies are opt-in and are reserved for possible future advertising partnerships; none are active today.

You can choose which optional categories you allow through the cookie banner when you first visit, and you can change your choices at any time using the cookie settings available from the site footer. Your choice is remembered in your browser so the banner does not reappear unnecessarily.

Because the Service is a PWA, your projects and edits may also be stored in your browser to support offline use. This local data lives on your device and stays under your control. For full details, please read our Cookies Policy at /cookies.

6. AI Features and Data Sent to Anthropic

The AI features, including AI plan recognition and the optional AI design partner, are optional and use your own Anthropic API key. They are inactive unless you enable them and save your key.

When you use the AI features, your prompts and the relevant design context are sent to Anthropic, the provider of the Claude model, for processing, using your key. Anthropic processes that information under its own terms of service and privacy policy, and Anthropic bills you directly for usage. We do not control Anthropic's processing of your prompts or design context.

We do not use your content to train AI models. We store your Anthropic API key only as encrypted ciphertext on our server and never expose it to the browser client; the client can only see a flag indicating that a key is saved. If you do not enable the AI features, no prompts or design context are sent to Anthropic.

7. How We Share Your Information

We share information only as needed to operate the Service and as described in this Policy. We do not sell your personal data.

Live share links. When you create a live share link for a project, that project becomes viewable, and where you grant edit access editable, by anyone who has the link. No account is needed to open a shared project. Anyone who has the link can view the shared content, and change it if you shared an edit link. You control whether to create a share link, so share it only with people you intend to give access.

Third parties and sub-processors. We rely on the following service providers. Google provides Firebase Authentication, the Firestore database, and hosting, and processes account data and content data so we can authenticate you and store your projects. Anthropic provides AI processing through your own API key when you enable the AI features. Each of these providers handles data according to its own policies.

We may also disclose information if required to do so by law, to respond to valid legal process, to protect the rights, safety, and security of our users or the Service, or in connection with a merger, acquisition, or sale of assets, in which case we will continue to protect your information consistent with this Policy.

8. Data Retention

We keep your projects and associated data until you delete them or delete your account. While your account is active, we retain your account data and content data so we can continue to provide the Service to you.

When you delete a project or your account, the associated data is removed promptly from our active systems, as described in Section 10. Residual copies that remain in routine system backups are purged on our regular backup cycle, typically within 30 days. We may retain limited information for longer where we are required to do so by law or where it is necessary to protect the security and integrity of the Service.

Any anonymous usage analytics we collect, if you opted in, are retained only in aggregate and anonymous form and are not tied to your account, so they are not deleted as part of your account deletion. Data you create offline or while signed out lives only in your browser and is retained on your device under your control. You can clear that local data through your browser at any time.

9. Your Rights and Choices

Depending on where you live, you may have rights over your personal information. We honor these rights for all users where we can.

EEA and UK (GDPR). If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to correct inaccurate data, to delete your data, to receive a portable copy of your data, to restrict or object to certain processing, and to withdraw consent where we rely on it (such as for analytics). Withdrawing consent does not affect processing carried out before you withdrew it. You also have the right to lodge a complaint with your local data protection authority.

California (CCPA and CPRA). If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it, the right to access and delete your personal information, the right to correct inaccurate information, the right to limit the use and disclosure of any sensitive personal information, and the right not to be discriminated against for exercising your rights. On request, we will disclose the categories of personal information we collect, the categories of sources from which we collect it, the business or commercial purposes for collecting it, the categories of third parties (including the sub-processors described in Section 7) with whom we share it, and the specific pieces of personal information we hold about you. You may make a verifiable request to access this information, including for the 12-month period preceding your request, and you may use an authorized agent to submit a request on your behalf, subject to verification. We do not sell or share your personal information as those terms are defined under California law, so there is no need to opt out of a sale.

How to exercise your rights. You can access, edit, export, and delete much of your information directly from the Settings and Profile panel within the Service, including deleting your account and all associated data. You can manage your cookie and analytics consent through the cookie settings in the site footer. For any request you cannot complete yourself, or to ask a question about your rights, contact us at [privacy@home3dplan.com], and we will respond as required by applicable law. We may need to verify your identity before acting on a request.

10. Account Deletion and Data Export

You can delete your account and all associated data at any time from the Settings and Profile panel. Deletion is permanent, so please export or back up anything you want to keep before you delete your account.

You can export your work at any time from within the Service using the supported export formats, including GLB, OBJ, and PDF, as well as the native .hdp project file. This gives you a portable copy of your designs.

Data you created offline or while signed out is stored only in your browser and is under your control. You can remove it by clearing your browser storage for the Service.

11. International Data Transfers

We and our service providers operate globally. Your information may be processed in the United States or in other countries where Google and Anthropic operate, which may have data protection laws different from those in your country.

Where personal data is transferred out of the EEA or the United Kingdom, we seek to ensure that appropriate safeguards recognized under applicable law are in place to protect it, and our service providers such as Google and Anthropic implement their own transfer safeguards as described in their policies. You can contact us at [privacy@home3dplan.com] for more information about how your data is protected when it is transferred internationally.

12. Security

We take reasonable technical and organizational measures to protect your information. Authentication is handled by Google through Firebase Authentication, and your content is stored using Google Firebase and Firestore. Your optional Anthropic API key is stored only as encrypted ciphertext on our server and is never exposed to the browser client.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play an important role in keeping your information safe, for example by protecting access to your Google account and by sharing live share links only with people you trust, since anyone with a link can view the shared project, and change it if you shared an edit link.

13. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal information from children under the age required by applicable law in your jurisdiction (for example, under 13 in the United States, or the relevant age of digital consent in the EEA and UK).

If you believe a child has provided us with personal information without appropriate consent, please contact us at [privacy@home3dplan.com] and we will take steps to delete that information.

14. Third-Party Links and Services

The Service relies on and may link to third-party services, including Google and Anthropic, and may export files that you can open in other applications. When you use the AI features with your own Anthropic API key, your interaction with Anthropic is governed by Anthropic's terms and privacy policy and is billed to you by Anthropic directly.

We are not responsible for the privacy practices or content of third-party services. We encourage you to review the privacy policies of any third party whose service you use in connection with the Service.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in the Service, our practices, or the law. When we make changes, we will revise the "last updated" date shown on this page.

If we make material changes, we will take reasonable steps to notify you, for example through the Service. Your continued use of the Service after an update takes effect means you accept the revised Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Policy or your personal information, you can contact us at [privacy@home3dplan.com].

For related information, please see our Terms of Service at /terms and our Cookies Policy at /cookies. Where this Policy refers to a governing jurisdiction for the resolution of privacy matters, that jurisdiction is [Jurisdiction].