Privacy Policy

Re:Form is operated by Frame Sixty Labs, LLC ("Frame Sixty", "we", "us"). This policy explains what personal data we collect when you use reformsculpt.com and the Re:Form application, why we collect it, and what you can do about it. We have tried to write it in plain language, and it describes what the software actually does today.

1. Your sculpts stay on your device

This is the most important thing to know about how Re:Form handles data. The mesh you sculpt lives on your computer's graphics card while you work, and your projects are saved to your own machine — automatically into your browser's local storage (the dated autosave slots) and into the .clay and exported model files you save yourself. In the current version of Re:Form, your sculpts are not transmitted to us, and we hold no copies of them.

Cloud saving is on our roadmap. If we introduce it, this policy will be updated to describe exactly how it works before it applies to your work, and you will be told about the change.

2. What we collect

Account data. When you create an account, Firebase Authentication (a Google service) stores your email address, a unique user identifier, and your sign-in method. If you use a password, Firebase stores it in hashed form — we never see or hold your password. If you sign in with Google, we receive your email address and identifier from that account.

Consent records. When you accept the Terms of Use at signup, we store a record containing your user identifier, the version of the terms you accepted, the time you accepted it, and whether you opted in to product-update emails. We keep this because we are required to be able to show that consent was given.

Billing data. If you subscribe to Pro, Stripe processes the payment and holds the payment details. Your full card number never reaches our servers — checkout happens on Stripe's own hosted page. We store the identifiers linking your account to its Stripe customer and subscription, plus a cached record of which plan you are on and when that cache expires, so the app can unlock your plan quickly.

Messages you send us. If you use the contact form or email us, we keep your name, email address, and the content of your message so we can reply. The contact form also keeps a short-lived counter tied to your network address for a minute at a time, purely to slow down automated spam.

Analytics on our public pages. Our marketing pages — the home page, pricing, docs, blog and so on — include Google Analytics, which sets cookies and collects usage information such as pages viewed, approximate location derived from your network address, and browser and device type. The sculpting application itself does not include analytics; what you do inside the studio is not tracked by us.

Technical logs. Cloudflare, which hosts the site, processes standard server logs (including network addresses) as part of delivering and protecting it.

3. Why we use it, and our legal basis

We use account and billing data to provide the service you asked for and to manage your subscription — the legal basis is performance of our contract with you. We keep consent records to meet a legal obligation. We use analytics and abuse-prevention data on the basis of our legitimate interest in understanding how the site is used and keeping it working. We send product-update emails only where you have given consent, which you may withdraw at any time.

We do not sell your personal data, and we do not use it for advertising profiles.

4. Who processes data on our behalf

• Google (Firebase Authentication) — account creation and sign-in.
• Google Analytics — usage measurement on our public marketing pages only.
• Stripe — payment processing and subscription status.
• Cloudflare — website hosting, serverless functions, and storage of consent records, contact messages, and the plan cache.

These providers operate internationally, so your data may be processed outside your own country, including in the United States. They provide contractual safeguards for those transfers, such as the European Commission's standard contractual clauses where relevant.

5. Cookies and local storage

Our public marketing pages set Google Analytics cookies as described above. The application uses your browser's local storage and IndexedDB for things it needs to work — your sign-in session, your saved preferences, and your autosaved sculpts. That storage is functional, stays on your device, and is not used to track you across other websites. Clearing your browser storage for this site will sign you out and delete your autosaves, so export anything you want to keep first.

6. How long we keep it

Account data is kept while your account exists. Consent records are kept while your account exists and for a reasonable period afterwards, because their purpose is to evidence what you agreed to. Billing records are kept as long as tax and accounting law requires, typically several years. Contact messages are kept while we need them to deal with your enquiry and for a reasonable period after. Analytics data is retained according to Google Analytics' configured retention period. The spam-prevention counter expires after one minute.

7. Your rights

Depending on where you live, you have rights over your personal data — and we will honour these requests wherever you are. You may ask us to give you a copy of the data we hold about you, correct it if it is wrong, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on consent — product-update emails — you can withdraw it at any time, and every such email includes an unsubscribe link.

To exercise any of these, email hello@reformsculpt.com from your account address. We will respond within one month. Deleting your account removes your authentication record and your consent entry; billing records that we are legally required to retain are kept until that obligation expires. Because your sculpts are stored on your own device, deleting them is something you do locally — we have no copy to delete.

If you are in the European Economic Area or the United Kingdom and you believe we have handled your data improperly, you may complain to your local data-protection authority. We would appreciate the chance to put it right first.

8. Children

Re:Form is not intended for children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

9. Security

Sign-in is handled by Firebase Authentication and payments by Stripe, both of which are established providers with their own security programmes. Traffic to the site is encrypted in transit. Consent records, contact messages, and the plan cache are stored in Cloudflare's key storage with no public read endpoint. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify affected users and the relevant authority if a breach occurs that requires it.

10. Changes to this policy

We may update this policy as Re:Form changes — in particular if cloud saving is introduced. Each version carries the date at the top of this page, and material changes will be brought to your attention in the app rather than made quietly.

11. Contact

Privacy questions, or a request about your data? Email hello@reformsculpt.com.