Privacy Policy

The short version

• This site sets no cookies and runs no analytics or advertising trackers.
• Your licenses, your optional licensee name, your saved work, and any image you bring into the Studio are stored and processed only in your own browser, and are never sent anywhere.
• Activation codes travel in the part of a link that browsers never send to a web server, so we never see them.
• Payments are handled by third-party payment providers under their own privacy policies. We never see your full card details.
• We receive basic order information from the payment provider and use it only for support, refunds, and tax and accounting obligations.
• Nothing is ever sold, rented, or shared for advertising.

Cookies and tracking

This site sets no cookies of any kind. There are no analytics, no pixels, no advertising trackers, no session recording, no fingerprinting, and no third-party scripts. There is no cookie banner because there is nothing to consent to.

The site does use your browser's own local storage and IndexedDB to remember your licenses, your display settings, and your saved work. That is storage on your device, under your control, which you can clear at any time from your browser's settings. It is not a cookie, it is never transmitted, and it is not readable by anyone but you.

What stays on your device

These things are stored in your browser and are never sent to us or to anyone else:

• Your license codes and the records of which products are activated.
• The licensee name, if you choose to enter one for your certificate. It is optional, it never leaves your device, and it exists only so that your certificate can carry your name.
• Everything you save in the Studio: presets, layouts, colorways, and other work.
• Any image you bring into the Studio. Images are read and processed by your own browser on your own machine. Nothing is uploaded.
• Your display settings: theme, interface size, and motion preference.

We have no copy of any of it. That is the point of building it this way, and it is also the catch: if your browser data is cleared, or your device is lost, we cannot recover it for you, because we never had it. The Studio can export a backup file of everything at once, and we would encourage you to use it.

Activation links

An activation link looks like https://tilecraft-site.vercel.app/studio/#activate=YOUR-CODE. Everything after the # is a fragment, and browsers do not send fragments to the web server. Your license code is read by the page in your browser and is never transmitted. This is deliberate: it means scanning the QR code on your certificate, or clicking the link in it, tells us nothing.

Payments

Payments are handled by third-party payment providers. When you pay, you are on their system, under their privacy policy, and their terms. We never see your full card number, and we never store card details.

After a purchase, the payment provider gives us order information. That is typically your name, your email address, the products you bought, and your country — the country because tax is charged by where you are.

What we do with order information

Three things only:

• Support. Answering you when you write, and matching your message to your order.
• Refunds. Finding and processing a refund when you ask for one.
• Tax and accounting. Meeting the record-keeping obligations that apply to a business that sells things.

We do not use it for marketing. There is no mailing list. We will not email you about new products, and nothing on this site signs you up for anything.

Our legal basis, if you are in the EU or UK

• Performance of a contract for processing your order and providing support about it.
• Legal obligation for keeping tax and accounting records.
• Legitimate interests for keeping basic records of correspondence so that a conversation about an order makes sense when you write again.

We do not rely on consent for anything, because we do not do anything that would need it.

Who else sees anything

The payment provider, because they process the payment. The company that hosts this site, which receives the ordinary web request logs any web server receives — the page requested, the time, the browser's user agent, and the IP address the request came from. We do not add anything to those logs, do not use them to build a profile, and do not combine them with order information.

Nothing is ever sold. Nothing is ever shared for advertising. Nothing is handed to a data broker. We do not run an affiliate program, and no third party is given access to your order information for their own purposes.

How long anything is kept

Order information is kept for as long as tax and accounting law requires records of a sale to be kept, and then deleted. Correspondence about an order is kept while it is useful for supporting you and is deleted when it is not. Data on your own device stays there until you remove it; we have no part in that and no way to reach it.

Your rights under the GDPR

If you are in the EU or the UK, you have the right to ask for a copy of the personal data we hold about you, to have it corrected if it is wrong, to have it erased, to restrict or object to how it is processed, and to receive it in a portable form. You also have the right to complain to your national data protection authority.

Exercise any of these through the Contact page. We will reply within the response time stated there and act on the request within one month. There is one limit worth stating plainly: we cannot erase records we are legally required to keep for tax purposes until that period has run out, and we cannot produce data we never held, which includes everything that lives only in your browser.

Your rights under the CCPA and CPRA

If you are a California resident, you have the right to know what personal information we have collected about you, where it came from, why we collected it, and who we shared it with; the right to have it deleted; the right to correct it; and the right not to be discriminated against for exercising any of these rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We have not done so in the preceding twelve months. There is therefore no opt-out to offer, because there is nothing to opt out of.

Exercise any of these rights through the Contact page.

Children

This site is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, tell us through the Contact page and it will be deleted.

Security

The site is served over an encrypted connection. We hold very little: no card details, no passwords, and no accounts, because there are no accounts. The data that would be most sensitive — your work — is never in our hands at all.

International transfers

Our payment provider and our host may process data in countries other than your own, including the United States. Where that involves personal data of people in the EU or the UK, those transfers rely on the safeguards those providers have in place, such as standard contractual clauses.

Changes to this policy

If this policy changes, the new version is posted on this page with a new date at the top. For a change that materially affects how we handle personal data, a short note saying what changed will sit at the top of this page for at least 30 days. Since there is no mailing list, this page is how changes are communicated, and it is worth checking it if you are about to buy.