Privacy

Roomforge runs Roomforge and is the controller of the personal data described here. This page says what is stored, why, who else handles it, and how to have it removed. Contact: us.

You can use the planner without an account

Designing a room and downloading an item as an STL needs no sign-in. The plan you are working on is kept in your browser's local storage on your own device. It is not sent to us until you ask for a download, when the plan is posted to the server to build the file and is not kept.

What we hold if you create an account

• Your email address and a salted hash of your password. We cannot read the password.
• Plans you save to your account (Pro). They are private to your account and are not published anywhere.
• Whether you are on Free or Pro, and the Stripe customer and subscription references.
• A sign-in cookie called rf_session. It is needed to keep you signed in, so it is set without asking, and it is removed when you sign out.

The lawful basis is performing the contract with you (providing the account and the service you pay for). Sign-up and billing records are kept while the account exists and for the period tax law requires for invoices.

Export log

Each STL download writes a short log line: the time, what was exported, your account if you are signed in, and your IP address. It is used to spot abuse and is deleted after 30 days.

Analytics

We use Google Analytics to count visits and see which pages are used. It is switched off until you choose "Yes, count me" on the banner. If your browser sends a Global Privacy Control or Do Not Track signal we treat that as a no and do not ask. You can change your mind by clearing this site's data in your browser, which brings the banner back. Your plans and your account details are never sent to Google Analytics.

Who else handles your data

• Stripe takes card payments. Your card details go to Stripe and never reach our server.
• An email delivery provider sends password reset emails, which carry your address.
• Google, for analytics, only if you accepted the banner.
• Our hosting provider, which stores the database and server logs.

We do not sell personal data and we do not use it for advertising.

Your rights

Under UK GDPR you can ask for a copy of your data, a correction, or deletion. You can delete your account yourself from the Account page: that removes your email, password hash and every saved plan straight away, and cancels a Stripe subscription that is still running. For anything else, or to complain, contact us. You can also complain to the Information Commissioner's Office at ico.org.uk.