Privacy policy

Who we are

Ishai Rubinfeld, a sole proprietor in Israel trading as Extrudio, runs Extrudio and decides how and why your personal data is used: in the law’s terms, the controller.

For anything about your data or this policy, write to support@extrudio.site, or use our contact form.

What we collect

Your account

Your email address, and when your account was created and last signed in. If you sign in with Google, also the name, profile picture and Google account ID that Google sends (see “Sign in with Google”).

Sign-ins

Our sign-in provider logs each sign-in with your account ID and email address, for security.

Messages and requests

What you send through the contact form on this website: your email address, your name if you give it, the topic and your message. What you send from the app is kept the same way, with your account’s address: a request to delete your account, and a problem report about a render, with the render it’s about. We store them in our database, in Frankfurt, to answer you.

Blocked addresses

If we block an email address from rendering, for abuse, we keep the address with a short note, whether or not it has an account.

Your print files

Each .gcode, .gcode.3mf or sliced .3mf file you upload, exactly as uploaded, with its name and size. Slicers write their settings into these files, such as printer and filament profiles, so whatever your slicer put in is stored with it. We also keep what we read from each file: the slicer and its version, the printer, the nozzle and filament settings, and statistics about its layers and moves.

Your renders

The images we render for you, and each render’s settings: colors, scene, sizes, quality, the platforms you picked, and the credits it used.

Your credits

The credits you were given or bought, and the credits you spent.

Your purchases

If you buy a plan or credits: Polar’s IDs for you as its customer, for your subscription, for each order and for any refund; your plan, its status and its billing period; and for each payment, what you bought, the credits it added, the amount paid with tax, its currency and the time, and any refund, with its amount. Polar’s dashboard for sellers also shows us what Polar shares about each sale, such as your email address, your country and what you bought. Your card details stay with Polar and its payment partner, Stripe: we never receive them.

A link’s code

If a link from a creator, or from one of our ads or posts, brought you to this website or the app, the code in it: “example-maker” from a link ending in ?ref=example-maker. We keep it on your account if that sign-in creates the account, and a link you follow later changes nothing. Nothing else from the link is kept.

Before you sign in

You can look around the app, but uploading, previewing and rendering need an account. The app sets no cookie until you start to sign in.

Technical data

Our hosting providers log every request: your IP address, your browser’s user agent, the address you asked for and the time. When you upload a file or open an image, your browser talks straight to our storage provider, which sees your IP address too.

Page statistics

When you open a page on this website or in the app, our hosting provider, Vercel, counts the view: when it happened, the page and the page you came from, your country, region and city, and your browser, operating system and kind of device. It uses no cookie and stores nothing in your browser. To tell visits apart, it uses a hash of your request, discarded after 24 hours, and it keeps the statistics in aggregate, not tied to you or to your IP address. Before a view is counted, the app takes the IDs of your files and renders out of the page’s address, and every part of a link but its code.

Emails you send us

When you write to us, for help or with a question, we get your email address and your message.

How we use it

To run the service

Signing you in, storing your files, rendering your images and keeping your credits. In the EU and UK, the legal basis is our contract with you.

To sell you plans and credits

Adding the credits you bought, renewing or ending your plan, showing your purchases with their invoices, and handling refunds and chargebacks. In the EU and UK, the legal basis is our contract with you.

To keep it safe

The sign-in log, the check at sign-in, daily render limits and request logs help us stop abuse and fix problems. Our forms also count recent messages from each address, and from each connection for ten minutes, without storing your IP address. The legal basis is our legitimate interest in a service that is secure and works.

To thank creators

A creator’s code tells us which creators bring people to Extrudio, so we can thank them or pay them. Only we see it. The legal basis is our legitimate interest in knowing where sign-ups come from.

To see which ads and posts work

If one of our ads or posts brought you, its code tells us which of them bring people to Extrudio, so we know where to put our time and money. Only we see it. We use no advertising pixel, here or in the app. The legal basis is our legitimate interest in knowing where sign-ups come from.

To give what an offer promised

If the link you signed up through offered something, such as credits for the first members to sign up, the code kept on your account also decides whether you get it, in the order accounts were opened. The legal basis is our contract with you: the offer you signed up through.

To see what works

Page statistics show us, in aggregate, which pages and links people use, creators’ links and our own included. The legal basis is our legitimate interest in improving this website and the app.

To answer you

Messages from the contact form, and emails. The legal basis is taking the steps you ask for, and our legitimate interest in replying.

We open your files or renders only when you ask for help, to fix a problem with them, or to look into a report that they break someone’s rights.

We run the service with a tool of our own. It shows your email address, when you signed up and last signed in, how you sign in, your credits, your files’ names and sizes, and how your renders went, but not the files themselves. Opening one of your renders in it takes a reason, which is recorded, and print files can’t be downloaded from it. We can also add credits to your account, which you’ll see on your account page. Everything done in it is logged.

We don’t sell your data, show ads or send marketing email. We don’t use your files, your renders or any other data to train AI models. We make no automated decisions about you that have legal or similarly significant effects.

Who helps us

These companies process data for us, under their data processing terms, only to provide their part of the service:

Vercel

Hosts this website, the app, and the interface of our rendering service. The app, that interface and this website’s forms run in Frankfurt, Germany. Vercel keeps request logs, and counts page views for our statistics.

Supabase

Our database, sign-in and file storage, in Frankfurt, Germany.

RunPod

Renders your images on GPUs in the United States. For each render it gets the settings, your file’s name and a link to the file that expires within 24 hours. It gets no name or email address, deletes its working copy after each render, and keeps the job’s details for about 30 minutes.

Resend

Sends your sign-in codes, from Ireland.

Google

Signs you in, if you choose Sign in with Google, and hosts the mailbox that receives email sent to support@extrudio.site.

Cloudflare

Runs our domain’s DNS. When the app’s sign-in window opens, its Turnstile checks that you’re a person: usually you see nothing, and sometimes it asks you to tick a box. It sees your IP address and your browser’s details, not what you type, and also uses them, as a controller in its own right, to improve its bot detection.

Polar (Polar Software, Inc., in the United States) sells our plans and credits as our reseller, and is the merchant of record: the seller in each purchase. Its checkout, on its own website, takes your payment details and your country for tax, and its payment partner, Stripe, processes your card. Polar sends your receipts, and runs the billing page that opens from your account page. With each purchase, we send Polar your account’s ID, and fill in your email address at its checkout. Polar uses this data as a controller in its own right, under its privacy policy.

Where it’s needed, we also share data with our professional advisers, such as a lawyer or an accountant, and with authorities when the law requires it.

Where your data is

Your data is stored in the EU, in Frankfurt. Rendering happens in the United States, some of our providers are US companies, and so is Polar. When data leaves the EU, it’s protected by the European Commission’s standard contractual clauses, or by the EU–US Data Privacy Framework where the provider is certified under it. We run Extrudio from Israel, which the European Commission recognizes as protecting personal data adequately.

How long we keep it

We keep your account, your print files, your final renders and the record of your purchases until you ask us to delete them. When you do, we delete your account and everything in it within 30 days, the messages you sent through our forms included.

A few things stay after that. If we blocked your address, we keep the block, so it holds if you sign up again. Our own records keep your account’s ID, with when and why it was deleted, but not your address. Polar keeps its own records of your purchases, as the seller, under its policy. Copies in our database provider’s backups expire on its schedule.

Some things we delete on our own:

• Previews: 7 days after they’re made. The app still lists the job, marked as expired.
• What we read from a print file: 30 days after it was last used. We read the file again the next time you render it.
• An upload that never finished: a day after its link expired.
• The sign-in log: 90 days.
• Messages and requests from our forms, on this website or in the app: a year after we close them, or 30 days after we mark them as spam.

We keep the log of what is done in our own tool. It refers to your account by its ID.

We keep emails you send us for as long as we need them to help you. Our providers keep their own logs for the periods their terms set.

Keeping it safe

Every connection to Extrudio is encrypted. Our database lets each account read only its own data, our operator tool needs a second step to sign in, and everything done in it is logged. No system is perfectly secure: if a breach puts your data at risk, we’ll tell you, and the authorities, as the law requires.

Your rights

You can ask us to:

• send you a copy of your data, in a format you can reuse;
• correct it;
• delete it;
• stop or limit using it, or object to how we use it.

To have your account deleted, ask from its settings in the app. For anything else, or if you can’t sign in, write to support@extrudio.site from the address on your account. We’ll reply within 30 days.

If you’re in the EU or UK, you can also complain to your country’s data protection authority. In Israel, that’s the Privacy Protection Authority.

Cookies and browser storage

This website sets no cookies. If you pick a theme at the bottom of the page, your browser remembers the choice in its local storage, and it never leaves your device. Page statistics, here and in the app, use no cookies and nothing in your browser’s storage. A code from a link stays in the page’s memory while you browse this website, never in a cookie or your browser’s storage, and the links into the app carry it.

The app sets no cookie until you start to sign in, and then only the ones it needs to work:

sb-…-auth-token

Keeps you signed in. It lasts up to 400 days, and signing out removes it.

sb-…-code-verifier

Set by our sign-in provider when you ask for a sign-in code.

google_nonce

Ties a Google sign-in to your browser. It goes once the sign-in uses it, or after an hour.

g_state

Google’s own cookie, set when the sign-in window loads Google’s button. Google decides how long it lasts.

In your browser’s storage, the app keeps your theme if you change it, and, while you work on a file, its settings and previews for the session. A code from a link stays in the page’s memory until you sign in, never in a cookie or your browser’s storage. Cloudflare’s check at sign-in sets no cookie of ours and stores nothing in your browser for the app; anything it keeps for itself is under Cloudflare’s own policy. There are no analytics, advertising or tracking cookies.

When you buy, the app takes you to Polar’s checkout, on Polar’s own website, and Polar brings you back. The app loads nothing of Polar’s. What Polar’s pages store is on Polar’s site, under Polar’s policy.

Sign in with Google

If you sign in with Google, Google sends us your email address, name, profile picture and Google account ID. We use the email address and the account ID to sign you in and to link your account. Our sign-in provider stores the name and picture, and we don’t use them.

We don’t share this data except with the providers listed above, and with Polar when you buy, don’t use it for advertising, and don’t use it to train AI models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Children

Extrudio is for people 18 and older. We don’t knowingly collect data from anyone younger. If you think we have, write to us and we’ll delete it.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change affects how we use data you’ve already given us, we’ll email account holders before it takes effect.