Overview
This Privacy Policy explains how 3D Box Studio (“we”, “us”, or “our”) handles information when you visit 3dboxstudio.com, use the browser-based studio, create an account, save or share designs, or contact us. By using the site, you agree to this policy.
Who we are
3D Box Studio is operated by Syed Kashan Ali Shah. The public website is available at 3dboxstudio.com. For privacy questions, use our contact form.
Account and authentication
If you create an account, we collect your email address and, optionally, a display name. If you sign up with email and password, your password is stored as a one-way hash—we never store it in plain text. If you sign in with Google, we receive basic profile information from Google (such as your email address and name) to create or link your account.
Designs, uploads, and cloud save
Using the studio requires a free account. When you upload artwork or save a design, we store your box configuration (dimensions, materials, openings, and related settings) and uploaded images. Images are stored in Amazon Web Services (AWS) S3; configuration and project metadata are stored in a PostgreSQL database hosted by Neon.
- Saved designs can be linked to your account when you are signed in.
- Anonymous cloud saves may be created when you upload artwork before signing in.
- Share and preview links use unique tokens. Opening a shared or preview link may increment a view counter.
- Saved shares may expire after a configured retention period (currently up to 90 days unless renewed).
Contact form
If you submit our contact form, we collect the information you provide (such as your name, email address, topic, subject, and message). Submissions are stored in our internal systems so we can review and respond. We use Cloudflare Turnstile to help prevent automated spam before a message is sent.
Usage analytics
We use privacy-oriented analytics to understand how the site is used and to improve the product. Depending on configuration, this may include:
- Vercel Web Analytics — aggregated page views and traffic patterns.
- Google Analytics — if enabled, page views and general usage metrics via Google’s analytics service.
- PostHog — if enabled, product usage events, autocapture, and session replay used to understand how visitors use the site and Studio.
- Admin routes are excluded from analytics tracking where technically possible.
Server logs and abuse prevention
Our servers and hosting provider may log technical data such as IP address, request time, and user agent for security, debugging, and rate limiting (for example, on sign-in, password reset, and contact form submissions). Contact form submissions are also checked with Cloudflare Turnstile to reduce spam and automated abuse.
How we use information
- Provide, operate, and improve the studio and website.
- Authenticate you and maintain your account.
- Save, load, and share your designs when you use cloud features.
- Send transactional emails (such as email verification and password reset) via Resend.
- Respond to contact form messages.
- Measure site usage and fix issues.
- Protect the service against abuse and unauthorized access.
Legal bases (EEA/UK visitors)
If you are in the European Economic Area or United Kingdom, we process personal data where necessary to perform our contract with you (providing the service), based on our legitimate interests (security and product improvement), or with your consent (analytics cookies and session recordings, which only run after you accept them in the cookie banner).
Data retention
- Account data is kept while your account is active and as needed to provide the service.
- Cloud-saved designs and uploaded images are retained according to share expiry settings and operational needs.
- Contact form submissions are kept as long as needed to respond and maintain records.
- Server logs and analytics are retained for limited periods according to provider defaults and our operational needs.
Your choices and rights
- Using the Studio requires a free account; you can view a design someone shared with you without one.
- You can update your profile name and email from account settings when signed in.
- You can delete your account yourself from Account settings → Password & security. This permanently removes your designs, projects, uploaded images and share links. Export ratings you gave are kept without your account details. For other data questions, use the contact page.
- Depending on where you live, you may have rights to access, correct, delete, or restrict processing of your personal data, or to object to certain processing.
Security
We use reasonable technical and organizational measures to protect information, including HTTPS, hashed passwords, HttpOnly session cookies, and access controls on cloud infrastructure. No method of transmission or storage is completely secure.
International transfers
Our service providers may process data in the United States and other countries. When you use 3D Box Studio, your information may be transferred to jurisdictions with different data-protection laws than your own.
Children’s privacy
3D Box Studio is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us so we can delete it.
Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of the site after changes means you accept the updated policy.
Contact us
Questions about this Privacy Policy or your data? Visit the contact page on 3dboxstudio.com or use the contact form there.