Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account Information: Email address, name, password
• Beta Invitations: For individually approved testers, we store the invited email, a one-way hash of the private invitation link, and records of approval, activation, accepted terms version, and revocation. These records are accessible only through authorized server processes.
• Payment Information: Card details for purchases (processed securely by Stripe, we never store your full card details)
• Profile Information: Printer models you own, saved models, custom folders
• File Requests: Details about custom models you request
• Shipping Details: For a printed order, the delivery name, street address, city, state, ZIP code, country, and email address. Stripe collects these at checkout and passes them to us. You can order as a guest, without an account.
• Things You Create: Text you ask us to engrave on a model, the star rating and written comment you leave on a completed order, ideas and votes you add to our roadmap, whether a print worked for you, and build videos you upload
• API Keys: A label you choose, the first few characters of the key, and a one-way hash of it. We never store the key itself, which is why we can only show it to you once.
• Contact Form Messages: The name, email address, topic, and message you enter in our contact form (you do not need an account to use it)
• Commercial License Record: If you hold a StreamSolid Pro membership we issue you a licence number and store it against your account with the date it was issued. This one is deliberately checkable by other people: anyone who is given your licence number can verify it, and doing so shows them your first name, whether the licence is currently active, and the month you joined. Nothing else is returned, and the number cannot be guessed from your name or email. That is the point of a licence you can show a customer.

We keep the delivery details for an order because they are what gets it made and delivered, and because a completed order is a financial record. Your order can be read by you, by our staff, and by our own server processes. If you ordered as a guest and later sign in with the same confirmed email address, that order appears in your account.

Reviews are not published on our site. The rating and comment you leave are visible to you and to our staff. Roadmap ideas work the other way around: the title and description are public, but who submitted an idea is not, and the site itself cannot read that. Engraving text, print outcomes, and build videos are visible only to you and our staff, and build videos are held in private storage rather than a public one.

We store contact form messages in our database as well as sending them to our support mailbox, so that your message is not lost if our email provider fails. Those stored messages are readable only by our own server processes: the website has no access to them, signed in or not.

1.2 Automatically Collected Information

• Usage Data: Models viewed, downloaded, and saved
• Device Information: Browser type, operating system, IP address
• Analytics: Page views, active time, navigation patterns, campaign sources, device categories, and conversion events. First-party session identifiers expire after 30 minutes of inactivity. Reliability reports record error categories and code locations; they exclude form contents, passwords, URL query strings, and raw error messages
• Cookies: Session cookies for authentication and preferences
• Contact Form Abuse Limits: A one-way hash of your IP address when you submit the contact form, used only to limit how many messages can be sent in an hour. We do not store the address itself.
• Referral Anti-Abuse Signals: If you sign up through someone's referral link, we record the IP address the signup came from and a random identifier your browser stores, so we can tell a real referral from someone referring themselves. Here we do keep the address itself. Both are readable only by our own server processes, and not by the person whose link you used.

2. How We Use Your Information

We use your information to:

• Provide the Service: Deliver model files, process downloads, manage your account
• Fulfil Orders: Print, pack, ship, and track physical orders, which means passing your delivery address to whoever is printing it
• Process Payments: Handle subscription and one-time purchases
• Personalization: Show printer-compatible models, save your preferences
• Communication: Send account notifications, file request updates, replies to your contact form messages, newsletters (if opted in)
• Security: Detect and prevent fraud, abuse, and unauthorized access
• Improve the Service: Analyze usage patterns, develop new features
• Legal Compliance: Comply with applicable laws and regulations

3. Information Sharing and Disclosure

3.1 Service Providers

We share information with trusted third-party service providers:

• Stripe: Payment processing and collecting the delivery address at checkout
• Supabase: Database hosting, authentication, and file storage
• Vercel: Website hosting and delivery
• Slant 3D: Prints and ships orders, which means they receive the delivery name, address and email address for those orders
• EasyPost: Delivery tracking updates. We send them the carrier tracking number, not your address.
• Resend: Transactional email delivery
• Google Workspace: Hosts the support mailbox that receives contact form messages
• Autodesk: Generates custom-sized model files in the cloud. It receives the dimensions you choose, not your name, email address, or any other personal detail.
• Cloudflare: Serves a shared 3D viewer catalog to your browser from its public code CDN. Loading it tells Cloudflare your IP address; we send them nothing about you.
• jsDelivr: Serves some of this site's JavaScript from its public code CDN at cdn.jsdelivr.net: the 3D model viewer's loader libraries, the partner map, and the file-packaging code, fetched on the pages that use those features. (The database client used to load from here on every page, this one included; since August 2026 it is served from this site directly.) Loading a file tells jsDelivr your IP address, your browser, and which file was asked for; we send them nothing about you.
• Google Fonts: Serves the two typefaces this site is set in, from fonts.googleapis.com and fonts.gstatic.com. Your browser requests them on every page, this one included, which tells Google your IP address and your browser; we send them nothing about you.

3.2 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

3.3 Business Transfers

If StreamSolid is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

3.4 Aggregate Data

We may share anonymized, aggregated data that does not personally identify you (e.g., "50% of users own a Bambu Lab printer").

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: All data transmitted over HTTPS with TLS encryption
• Authentication: Secure password hashing with bcrypt
• Access Controls: Row-level security policies on database
• Monitoring: Automated security scans and intrusion detection

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you ask us to delete your account, we will delete or anonymize your personal information within 30 days, except:

• Information required for legal compliance (tax records, transaction history)
• Anonymized analytics data
• Information needed to resolve disputes or enforce our Terms

Order records are the main thing that outlives an account. We keep the order for as long as we need it for accounting, tax, and any dispute or warranty question, which is what the first exception above refers to. There is no automatic cutoff for them, and closing your account does not remove them. What we can do, and do when you ask us to delete your account, is redact the address inside the order: see section 6.3 for exactly which parts are removed and which stay.

Everything else tied to your account is removed when we act on your request: saved models and folders, your printer list, engraving text, reviews, roadmap votes, print outcomes, build videos, referral records, and API keys. There is no delete button and no scheduled job behind any of this: a person works through the list. That is why the window we quote is thirty days rather than minutes.

Contact form messages are handled separately, because you do not need an account to send one. The copy stored in our database is deleted automatically 90 days after you send it, by a scheduled nightly job. The email itself stays in our support mailbox for as long as the conversation is useful to answer or reopen. If you would like a message deleted sooner, email privacy@streamsolid.com and we will remove both copies.

6. Your Privacy Rights

6.1 Access and Portability

You can download a copy of your account data from your account settings. That file covers your profile, saved models, folders and saved configurations, personalizations, downloads, and unlocks. It does not cover everything else this policy describes, such as your order history. Email privacy@streamsolid.com for the rest and we will send it to you.

6.2 Correction

You can update your profile information, email preferences, and printer list at any time in your account settings.

6.3 Deletion

There is no self-service delete button today. To close your account and have your personal information removed, email privacy@streamsolid.com, or send the same request through our contact form. Both reach us and we act on them within 30 days. We would rather point you at a route that works than a button that does not exist.

When we act on your request we remove your saved models and folders, your printer list, engraving text, reviews, roadmap votes, print outcomes, build videos, referral records, and API keys. We do that by hand, working through the list. Nothing in the product deletes them on its own, and we would rather tell you that than describe a cascade that does not exist.

Orders are the exception, and this is exactly what happens to them. We keep the order itself, because it is a financial record we have to hold for tax and accounting, and an order attached to an account is what stops that account being erased outright. But a tax record does not need your address, so we take it out: the name, street address, city, ZIP code, and email address are removed from the order, and only the state and country remain, because that is the part the tax record actually rests on. An order also carries a log of what our print and delivery partners told us while the parcel was moving, and those updates quote the destination. The same request strips the raw copy out of that log, keeping what the update said about the order but not where it was going.

Anything sent through a form that needs no account stays too, because it was never attached to your account to begin with: a contact form message or a roadmap idea. Ask us at privacy@streamsolid.com and we will remove those as well.

Contact form messages are not attached to an account, because anyone can send one without signing in, so deleting your account does not delete them. They are removed on the 90-day schedule above, or sooner if you ask us at privacy@streamsolid.com.

6.4 Email Preferences

You can control which emails you receive (announcements, new models, file request updates) in your email preferences.

6.5 Do Not Track

We do not currently respond to "Do Not Track" browser signals, but you can control cookies through your browser settings.

7. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and security (cannot be disabled)
• Preference Cookies: Remember your settings (filament color, sort order, etc.)
• Analytics Cookies: Track usage patterns to improve the service

You can control non-essential cookies through your browser settings, but this may limit functionality.

7.1 Analytics and Cookies

We use two analytics services to understand how the site is used:

• Vercel Web Analytics: Cookieless. Records page views, referrers, and coarse device and country information, with no persistent identifier.
• Google Analytics 4: Uses cookies to recognize a returning browser. Records page views, the pages you move between, actions such as a download, a Custom Size request, or a purchase, and coarse device, browser, and country information. IP anonymization is on and no advertising features are used. Where consent is required, Google Analytics sets no cookies until you choose Accept in the cookie bar.

Where Google Analytics is active, you can change your choice at any time with the Cookie Settings link in the footer.

8. Third-Party Links

Our Service may contain links to third-party websites, including affiliate links to hardware suppliers. We are not responsible for the privacy practices of these sites. Please review their privacy policies.

9. Children's Privacy

StreamSolid is not intended for users under 13 years of age. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

11. California Privacy Rights (CCPA)

California residents have additional rights:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to request deletion of personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights

To exercise these rights, contact us at privacy@streamsolid.com

12. European Privacy Rights (GDPR)

If you are in the European Economic Area, you have additional rights:

• Right to access your personal data
• Right to rectification (correction)
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights, contact us at privacy@streamsolid.com

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice on our website. Your continued use after changes constitutes acceptance.

14. Contact Us

If you have questions about this Privacy Policy or your data:

Email: privacy@streamsolid.com
Support: support@streamsolid.com