Privacy Policy
Last updated: November 2026
This policy explains what personal data CommunityCAD collects, why, who we share it with, how long we keep it, and your choices and rights. A shorter, plain-language overview is in the docs: Your data and privacy.
We don't sell your personal data.
Who we are#
CommunityCAD is operated by Iron Pixel Labs LLC, a Florida limited liability company, which is responsible for your personal data (the "controller"). Contact: contact@communitycad.dev.
What we collect#
When you sign in#
We use Google and GitHub sign-in; there are no CommunityCAD passwords.
- Google: we request your basic profile and email address. We store your email address and your Google account ID. Your name is used once, to suggest a username, and isn't stored.
- GitHub: we request your public profile and email addresses. We store your primary verified email address and your GitHub user ID. Your GitHub username is used once, to suggest a username. We also use your GitHub user ID to let you claim models imported from your public repositories.
- We don't receive your Google or GitHub password, don't keep GitHub access tokens, and don't import your profile photo.
What you give us#
- Sign-up details: on the sign-up screen we ask for your username, your date of birth, and your agreement to the Terms; optionally a display name, whether you'd like product-update emails, and a beta invite code. We keep your date of birth only to apply age rules (who can have an account, and who can see 18+ content); it's never shown publicly. We record which version of the Terms you agreed to and when, and when you opted in or out of product-update emails.
- Profile: username, display name, avatar, bio, location, website and social links. These are public.
- Content: models, files, images, descriptions, documents, comments, likes, ratings, follows, print profiles and print posts. Most of this is public: see What's public.
- Messages: what you send through the contact form (including your email address and the page and browser you sent it from), reports you file, and company page requests.
When you use CommunityCAD#
- Downloads: each download is recorded (model, file, where it went, time, and whether it counted toward your limit) to apply download limits and show your history. For signed-out visitors, we record a one-way scrambled (hashed) value derived from the IP address, not the address itself.
- Activity: actions such as uploading, commenting, rating and liking are recorded to show your public activity graph and the community feed.
- Notifications we create for you.
- Usage statistics: we run Umami, an analytics tool we host ourselves. It doesn't use cookies. It records page views and some actions (searches, including the search text; downloads; uploads; subscription and donation events), with your account ID, tier and membership status if you're signed in. We use it only to understand how the site is used, and don't share it.
- Sourcing clicks. When you follow a Buy or Add to cart link on a Sourcing tab, we count the click for that link and day. We store only the count: no account, IP address or other identifier. To count a visitor once a day we keep a one-way hash of the IP address and browser for up to 24 hours, then it's deleted. We never learn what you buy.
- Technical data: our hosting provider logs each request, including IP address, browser user agent, page and time, for security, abuse prevention and debugging. IP addresses are also used briefly for rate limits and download limits for signed-out visitors.
Payments#
Payments are handled by Stripe. When you subscribe, donate or set up payouts, Stripe collects your payment or identity and bank details directly; we never receive your full card or bank details. We store Stripe's reference IDs, your tier and subscription status, and donation records (donor, creator, amount, type, status, dates, and whether it was anonymous). We give Stripe your email address and account ID, and for creator payout accounts, your profile link.
Linked printers (CommunityCAD for Klipper)#
When you link a printer we store its name, the permissions you approved, the plugin's name and version, when it was linked and last used, and a one-way fingerprint of its access token (never the token itself). When you share from a printer we receive what you share: print profiles (the models and files on the plate, the slicer's plate picture, printer name and type, slicer, material and an allowlisted set of slicer settings, result, duration and filament used) and print posts (photos, video and caption). Your printer's configuration and print history stay on the printer. Details: What the plugin sends.
Discord#
If you connect Discord, we store your Discord user ID and username, and an encrypted connection token, so we can add you to the CommunityCAD Discord server and keep your roles in step with your account. Disconnecting removes them.
Photos and location data#
Print post photos and videos are re-encoded, which removes embedded metadata, including GPS location, before they're shown. Avatars and model gallery images are currently stored as uploaded, including any embedded metadata. Please remove location data before uploading them.
What's public#
- your username, display name, avatar, bio, location, links, join date and the company you belong to;
- your public models and their files, images and documentation;
- your comments, accuracy ratings, published print profiles and posts (with your printer name and print result unless you hide them in settings);
- your activity graph, follower and like counts, and whether your account is suspended.
Never public: your email address, Google and GitHub IDs, download history, linked printers, payments, the donations you make, reports you file, and messages to us. Creators see the names of people who donate to them unless the donation was anonymous; the amount is always shown to the creator.
How we use it, and why#
| Purpose | Data | Legal basis (where GDPR applies) |
|---|---|---|
| Provide your account and the Service: sign-in, hosting and showing your content, downloads, linked printers | Account, content, downloads, printers | Performing our contract with you |
| Payments, subscriptions, donations, receipts | Payment records, email | Contract; legal obligations (tax, accounting) |
| Emails about your account: receipts, payment problems, content removed, and the optional print and post emails | Email, notification settings | Contract; legitimate interests (optional emails can be turned off) |
| Applying age rules: no accounts under 13, no 18+ content under 18 | Date of birth, content filter setting | Legal obligations; legitimate interests (protecting minors) |
| Product-update emails, only if you opted in | Email, opt-in record | Consent (withdraw any time in settings) |
| Download limits, rate limits, security, preventing abuse and fraud | Downloads, IP-derived data, logs | Legitimate interests |
| Moderation and enforcing our Terms | Content, reports, account data | Legitimate interests; legal obligations |
| Understanding and improving the Service | Usage statistics | Legitimate interests |
| Ads for signed-out and Free-tier visitors | See Advertising | Legitimate interests, or consent where required |
| Complying with the law and responding to lawful requests | As needed | Legal obligations |
Cookies and similar technology#
CommunityCAD sets only strictly necessary cookies:
| Cookie | Purpose | Duration |
|---|---|---|
access_token | Keeps you signed in (secure, not readable by page scripts) | 7 days |
oauth_state, oauth_verifier, oauth_nonce, oauth_next | Protect the sign-in process | 10 minutes |
age_block | Set only after a date of birth under 13 is given: stops this browser creating a new account | 1 day |
We also store your theme choice, and for signed-out users your Mastodon server for sharing, in your browser's local storage. Our analytics use no cookies. Payment pages load Stripe's scripts, which may set cookies for fraud prevention, under Stripe's privacy policy.
Advertising#
Signed-out visitors and Free-tier members see ads. Most are sponsored listings we place ourselves, which use no tracking. When none are available, we may show ads from Google AdSense. Google and its partners may then use cookies or similar technology to show and measure ads, including ads based on your visits to this and other websites. You can:
- turn off personalised ads in Google's Ad Settings, or opt out of third-party vendors' use of cookies at aboutads.info;
- read how Google uses information from sites that use its services.
Where the law requires it (for example in the EU, the UK and Switzerland), Google ads are shown only after asking for your consent. Members on any tier above Free see no ads.
Who we share it with#
We share personal data only with the service providers that run CommunityCAD for us, under contracts that restrict them to that purpose, and when the law requires:
| Provider | What for |
|---|---|
| Google Cloud (USA) | Hosting, database, file storage, search and background processing |
| Stripe | Payments, subscriptions, donations and creator payouts |
| Google and GitHub | Sign-in, when you choose them |
| Google Workspace | Sending and receiving email |
| Discord | Where our team receives messages sent through the contact form |
| Google AdSense | Ads, as described above, when shown |
| IndexNow (Microsoft Bing and partners) | Telling search engines when public pages change (public URLs only) |
Sourcing links take you to the retailer's own site (for example Amazon), which sets its own cookies and handles your data under its own privacy policy. Affiliate links carry only our tracking id, nothing about you.
We may also disclose data:
- to comply with the law, a court order or a valid legal request;
- to protect the rights, safety and property of our users, the public or CommunityCAD;
- as part of a merger, acquisition or sale of the Service, in which case this policy continues to apply to your data.
We don't sell personal data, and we don't share it with third parties for their own marketing.
Where your data is stored#
Your data is stored in the United States (Google Cloud, us-central1). If you use CommunityCAD from elsewhere, your data is transferred to and processed in the US. Where required, we rely on appropriate safeguards for these transfers, such as the European Commission's standard contractual clauses in our providers' terms.
How long we keep it#
- Account and content: while your account exists. When you delete content, it's removed from the Service, and backups are overwritten over time.
- When you ask us to delete your account: we delete your profile, content and linked printers within 30 days, except what we must keep by law.
- Payment and donation records: as long as tax and accounting laws require (generally up to 7 years), with your profile details removed once your account is deleted.
- Download history: while your account exists. For signed-out visitors, only the hashed value described above is kept.
- Server logs: about 30 days.
- Rate-limit data: minutes to one week.
- Messages and reports: as long as needed to handle them and keep a record of moderation.
Security#
We protect your data with industry-standard measures, including encrypted connections (HTTPS), secure cookies, hashed printer tokens, access controls, and providers with strong security practices. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.
Your choices and rights#
Wherever you live, you can:
- see and correct your profile at any time with Edit profile;
- delete your comments and print posts, and ask us to delete anything else;
- turn off optional emails and notifications in your settings;
- disconnect linked printers;
- ask for a copy of your data, or for your account to be deleted, by emailing contact@communitycad.dev from your account's email address. We'll respond within 30 days.
Depending on where you live (for example under the EU and UK GDPR, or California and other US state privacy laws), you may also have the right to access, correct, delete or receive a portable copy of your data; to object to or restrict processing; to withdraw consent; and to complain to a data protection authority. We'll verify requests by confirming they come from your account's email address. We won't treat you differently for using these rights.
California and US state privacy notice: we collect the categories of data described above (identifiers, commercial information, internet activity, approximate location from IP addresses, and user content) for the purposes described above. We don't sell personal information. If Google ads are shown, personalised advertising may count as "sharing" for cross-context behavioural advertising under California law; you can opt out using the Google links above, or by emailing us.
Children#
CommunityCAD isn't for children under 13, and we don't knowingly collect their personal data. If someone gives a date of birth under 13 on the sign-up screen, their new account is deleted straight away, without keeping their details (an account that already had activity is suspended for review and then deleted). If you believe a child under 13 has an account, contact us and we'll delete it.
People aged 13 to 17 can use CommunityCAD, but never see content marked 18+.
Changes to this policy#
We'll update this policy as the Service changes. The date at the top shows the last change. For significant changes, we'll give notice on the site or by email.
Contact#
Questions or requests about your data: contact@communitycad.dev CommunityCAD (Iron Pixel Labs LLC), Florida, USA.