Privacy Policy

Effective October 1, 2026

This policy explains how openscad-web handles data when you use its website or connect an MCP client such as ChatGPT. The service lets you create, edit, render, and export OpenSCAD designs in your account.

Data we collect

• Account information: When you sign in with Google, we receive your Google account identifier, email address, name, and profile picture. We use these to identify your account.
• Design content: We store designs you create or edit, including names, OpenSCAD source code, notes, parameter values, units, and reference images you upload. Designs also have creation and update dates.
• Connection information: We store browser sessions, the browser user agent associated with a session, MCP client registration details, and records of authorized MCP connections. MCP access keys are stored as hashes. Short-lived authorization requests and codes support the sign-in and consent process.
• Technical data: Our hosting and security provider, Cloudflare, may process your IP address and request details when you access the service. The app also records server errors for troubleshooting. We do not use advertising trackers. Cloudflare Web Analytics, a cookie-free service, counts page visits in aggregate.
• Feedback you send: If you use the "의견 보내기" (Send feedback) button, your feedback goes to our feedback service at feedback.bongkow.com. It collects a type, title and message, and optionally the app version, your OS and a reply email. The title and message are shown publicly on feedback.bongkow.com; the email is never shown. We don't collect account names. IP addresses are not stored; only a daily-changing anonymized value is kept for 7 days for spam protection. A reply email is encrypted, used once to notify you of a reply, and deleted after 90 days.

When you ask a connected assistant to work on a design, its MCP tool calls send the task inputs needed for that action to our server. The server does not request your full conversation history.

How we use data

We use account and connection data to sign you in, protect your account, and let clients you authorize access your designs. We use design content to save, display, compile, render, and export your models, and to keep your browser and connected clients in sync. We use technical data to operate and secure the service and diagnose failures. We do not sell your personal data.

Who receives data

Google handles sign-in. Cloudflare delivers and protects the website and MCP endpoint. The infrastructure hosting openscad-web stores the app database. A client you authorize, including ChatGPT if you connect it, can receive the design data and generated outputs returned by the tools it calls; that client handles those results under its own privacy policy. We do not send your designs to Google for processing. Feedback you submit is stored by our own feedback service (feedback.bongkow.com), which is operated by the same maintainer.

How long data is kept

• Account details, designs, reference images, and connection records remain until you delete the relevant design or ask us to delete your account. Revoked connection records remain until account deletion.
• Browser sessions expire after 30 days; signing out deletes the current session. The temporary Google sign-in cookie expires after 10 minutes.
• Pending MCP authorization requests expire after 10 minutes and authorization codes after 5 minutes. Expired database records are removed by a periodic cleanup, normally within another 10 minutes.
• Cloudflare may retain network and security records under its own retention settings and policy. We do not set a separate retention period for those records.

Your choices

You can view and edit your designs in the app, delete individual designs and reference images, revoke an MCP connection from the Agent panel, and sign out to end your current browser session. You can request access to, correction of, or deletion of your account data using the contact link below. Deleting your account also removes its designs, images, sessions, and connection records from the app database. Browser display preferences are stored locally in your browser; you can clear them in your browser settings.

Security

Connections to the public site use HTTPS. Browser session cookies are HTTP-only, and MCP access keys are stored as hashes. An authorized MCP client can read or change designs within your account, so only approve clients you trust and revoke access when you no longer need it.

Changes and contact

We may update this policy as the service changes. The effective date above shows the latest version. For privacy questions or data requests, email the openscad-web maintainer at [email protected].