Privacy
3D Room Maker stores your current unsaved design in this browser’s local storage so you can recover it. Anyone using the same browser profile may be able to access this draft. Clear the site’s storage to remove it.
Your account and rooms
When you sign in with Google, we receive your Google account identifier, name, and email address to identify your account. We do not receive your Google password. A secure session cookie keeps you signed in for up to seven days. Saved rooms and exported PNG images are stored in our Neon database and require your account to access. Vercel hosts the website and processes requests to the service. We do not publish a public room gallery from your saved designs.
Retention and account deletion
We retain your account, saved rooms, and exported images until you delete your account. In the editor, open My rooms, choose Delete account, and confirm the deletion. This removes your account and its saved rooms and images from the service and ends all active sessions. Deletion cannot be undone. It does not delete your Google account. Recovery snapshots may temporarily retain deleted records until the database provider’s backup retention period ends.
Your current room and local browser draft remain on your device after account deletion. Clear this site’s browser storage if you also want to remove the draft. Download any images you want to keep before deleting your account.
Optional analytics and your choice
Analytics is off until you choose Allow analytics in Analytics settings at the bottom of any page. Declining does not limit the editor, sign-in, saved rooms or exports. We also keep this tracking off when your browser sends Global Privacy Control or Do Not Track. We do not replay actions from before your consent.
If you allow analytics, a random browser identifier connects visits with actions such as editing a room, saving, opening a saved room, exporting an image and handing an image to your browser for download or sharing. It represents a browser, not a verified person across devices. We record broad traffic sources, country when provided by our hosting service, device category, event times and controlled error categories. We do not include room contents, room names, email addresses, exact locations, raw IP addresses, raw user-agent strings or device fingerprints in these measurement records. We do not retain advertising click IDs or private URL query strings in our measurement database.
After consent, Google Analytics may also measure page views and these actions. We remove query strings and fragments from the page URL sent in our analytics configuration and disable advertising personalization and Google signals. Google processes the requests under its own privacy policy. Browsers marked for our testing do not send Google Analytics events and are excluded from the customer report.
Our analytics preference and random browser cookies last up to 90 days. A new visit starts after 30 minutes of inactivity. We retain detailed measurement records for up to 90 days, with expiry cleanup during subsequent service activity. Withdraw consent in Analytics settings to stop future tracking and clear our measurement and Google Analytics cookies. We also delete detailed measurement records for that browser when the database is available; otherwise they expire under the retention policy. Withdrawal does not remove data already processed by Google or delete your account, rooms or exported images.
Anonymous page and button totals
Separately, our server counts page requests, and the browser reports visible public page openings and native button activations. These counts respect an explicit analytics rejection, Global Privacy Control and Do Not Track. A page opening has one random event key held only in that page’s memory for retry deduplication; it does not identify a browser, visit or account and cannot connect separate pages. The independent browser total does not add optional consented page events, so allowing analytics on the same page does not count it twice. We group counts by broad source, country and device category. The event totals do not require browser identification or a fingerprint. For basic site-only audience counts, requests from every region can receive a separate random browser cookie lasting up to 90 days. It links these page and button events only, not accounts, designs, payments, or other sites. No regional opt-in is required for this basic identifier. Rejection, Global Privacy Control, and Do Not Track stop this linking. Withdrawal removes the linked identifiers when storage is available while preserving anonymous event totals. Missing historical identifiers cannot be reconstructed. They can include repeat requests and automated traffic; server requests are not proof that a person viewed a page, and neither count identifies unique people. Browser event keys and their coarse dimensions are retained for the same period as these totals. These totals are kept for up to 90 days. Private search queries and referrer paths are not stored.
Third-party services
Google handles sign-in. When enabled, Cloudflare Turnstile checks for automated abuse during sign-in. Neon provides database storage and Vercel provides hosting. These providers may process technical request information, such as IP addresses, to operate and protect their services. Their own privacy policies describe their processing.
Contact
For questions about your data, email cnvx.studio@gmail.com.