Privacy Policy

1. What we collect

• Account: your email address and a securely hashed password. We never store or see your actual password — see "How your password is protected" below.
• Purchases: the amount, currency, and status of any purchase, plus Stripe's own transaction/session IDs, used to confirm you're entitled to download the app. Your card details never reach us — see "Payments" below.
• Licence keys and devices: when you purchase (or are granted) LayerMate, we mint a licence key for your account. When the desktop app checks for updates or verifies a key, it may send that key plus a device identifier and platform so we can enforce the two-device limit — see "What we don't collect" and "Emails" below.
• Free trial: if you generate a trial key from your account, we keep your account email, a name taken from that email, and the trial key, linked to your account, so each email gets one trial. When the app first activates the key, we keep the date and a hashed device ID. The app makes that ID from your computer's hardware IDs and scrambles it before sending; we scramble it again and never see or store the hardware IDs themselves. We keep it to stop the trial being reused on the same computer.
• Reviews/feedback: if you submit a star rating or written feedback, it's stored against your account until you edit it or an admin removes it. Published reviews may appear on this website with the display name you chose.
• Password reset and email-change requests: if you request a reset or change your email, we temporarily store a one-way hash of the confirmation token (not the token itself, and not recoverable from the hash) for 30 minutes.
• Website analytics: which pages get visited, the referring site, campaign tags from the link you opened (source, medium, and campaign, plus whether a Facebook click id was present — not the id itself), and a coarse country/region resolved from your IP address at that moment — never your actual IP address, never your browser/device details, and never tied to your account or a tracking cookie. See "Analytics" below.
• Optional advertising measurement: if you choose to allow it, we may use Meta's advertising tools to understand whether an advertisement led to a visit, checkout, or purchase. Depending on the event, this may include the page visited, the action taken, purchase value and currency, device or browser information, IP address, advertising identifiers, and a one-way-hashed version of your email address used for matching. See "Advertising measurement" below.
• SlicerMate test builds send anonymous diagnostic logs (no personal details) to help fix bugs; testers can turn this off in SlicerMate settings.
• If a tester chooses Report a problem, the files they tick are uploaded privately and deleted after 30 days.

2. What we don't collect

• We don't sell or rent your information to anyone.
• The desktop app itself never sends us your files, folder structure, filenames, or anything about your library. The only network activity it initiates on its own is checking for app updates and (when you open it) fetching changelog notes. Once you've entered a licence key, those requests include your key and may include a device id so we can enforce the two-device limit — they are not anonymous. Your library contents still never leave your computer.
• We never send Meta or any other advertising provider your 3D model files, filenames, folder names, model geometry, library contents, or anything you process through LayerMate or the browser demo.

3. Trying it in your browser

The "Try it" demo on this site runs entirely inside your own browser tab. When you pick a folder or files, your browser reads them locally using the file-access features built into the browser itself — nothing is uploaded to our servers, and no file, filename, folder name, geometry, colour, or any other detail about what you scanned is ever sent to us or to anyone else. We have no way to see what you tried it on, and no account is needed to use it.

The page itself is served like any other page on this site, so it's subject to the same anonymous, cookie-free page-view analytics described below — that's the only thing about visiting this page that reaches us. Nothing from a session is saved anywhere, by us or in your browser — no cookies, no local storage. Close or reload the tab and everything from that session, including any thumbnails generated, is gone for good.

4. How your password is protected

Passwords are hashed with bcrypt — a one-way, industry-standard algorithm — before they're ever written to disk. Even we can't read your actual password back out. Logging in issues a random session token stored in a cookie your browser's page scripts can't read (HttpOnly; also Secure and SameSite=Lax in production), and that token can be revoked at any time — for example, automatically, the moment you reset your password.

5. Payments

Handled entirely by Stripe. Checking out takes you to Stripe's own secure payment page — your card number, expiry, and CVC go directly to Stripe and never touch our servers. We only receive back a payment confirmation, an amount, and Stripe's own reference IDs. Stripe's handling of your information is governed by Stripe's own privacy policy.

6. Emails

Transactional emails are sent through Resend, an email delivery service. Depending on what you do on the site, that can include:

• Welcome messages after you create an account
• Your licence key when you purchase (or when you ask us to resend it from the dashboard)
• Your trial key when you generate one from your account's Trial tab
• Password-reset links and notices when you change your password or email
• Affiliate programme invites, decisions, and messages if you take part
• Bug-report acknowledgements and occasional admin-composed messages about your account

Licence-key emails may also BCC Trustpilot's Automatic Invitation Service so you can be invited to leave a review after purchase — that BCC only carries the same transactional email Trustpilot needs to send the invite; it does not include your library or files.

7. Analytics

LayerMate's own website analytics are self-hosted and cookie-free. Each page view records the page path, the referring site (if any), campaign tags from the link you opened (source, medium, and campaign, and whether a Facebook click id was present — the id itself is not stored), and a coarse country/region resolved from your IP address at that moment. The IP address itself is never written to our database — it's used for that one lookup and discarded. These analytics are separate from the optional advertising measurement described below.

8. Advertising measurement

We advertise LayerMate through services including Facebook and Instagram. If you choose to allow advertising measurement, we may use the Meta Pixel and Meta Conversions API to understand whether an advertisement resulted in a website visit, checkout, or purchase; measure the performance of our advertising; and improve which advertisements are shown to people likely to be interested in LayerMate. When a link includes a Facebook click id, we set a first-party cookie (_fbc, kept for 90 days) so a later purchase can be matched to that click.

Meta may use cookies, pixels, advertising identifiers, and similar technologies to collect or receive information from this website and elsewhere on the internet. Meta handles that information under its own privacy policy. Optional advertising measurement does not receive any files or file details from the browser demo.

Advertising measurement is non-essential. Where the option is available, you can reject it without losing access to the website, browser demo, checkout, downloads, or desktop application. You can also manage information Meta receives from other businesses through Meta's off-Facebook activity controls.

9. How long we keep it

• Account, purchase, and licence records are kept for as long as your account exists. Purchase records may be retained afterward for bookkeeping/tax purposes even if you delete your account.
• Password-reset and email-change tokens expire and are automatically cleared after 30 minutes.
• Rate-limiting records (used only to slow down repeated login/signup attempts from the same source) are automatically cleared after about an hour.
• Analytics records are kept in aggregate for measuring site traffic — they were never tied to your identity to begin with.
• Information handled by Meta for advertising measurement is retained by Meta according to its own policies and the settings of our Meta business account.
• The browser demo (Try it) keeps nothing at all, for any length of time — there's nothing on our servers to retain in the first place, since the files never reach us.

10. Your choices

You can delete your own account at any time from your dashboard — this permanently removes your login, purchase history, and reviews from our systems. Stripe keeps its own transaction records independently, as required for payment processing and fraud prevention, so deleting your LayerMate account doesn't delete Stripe's records of a payment you made.

You can reject optional advertising measurement through the privacy choices presented on the site where those tools are enabled. Your choice does not affect the essential session cookie used to keep you securely logged in.

You're also welcome to email support@layermate.app any time to ask what we hold about you, correct it, or have it deleted manually.

11. International visitors

This site is operated from Australia. Third-party services we rely on — Stripe, Resend, Railway (our hosting provider), Cloudflare R2 for installer downloads, Trustpilot when review invites are enabled, and Meta when optional advertising measurement is enabled — may process data in other countries as part of providing their services to us.

12. Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page.

13. Contact

support@layermate.app