Privacy policy.

This policy explains what personal data Bake3D collects, why, and what happens to it. The controller is Bake3D Inc., 607 Deemer Pl, New Castle, DE 19720, United States; contact hello@bake3d.ai. Short version: we keep what we need to run your account and your jobs, we do not sell it, we do not train models on your content, and we use Google Analytics and Google Ads measurement only as far as your cookie choices allow.

What we collect

  • Account data: email address, name (it starts as the part of your email before the @ until you change it), plan, credit balance and credit history. If you sign in with Google or GitHub we receive your name, email address, profile picture and whether the provider has verified the address. Accounts created before September 2026 may also hold a hashed password.
  • Sign-in data: one-time sign-in links and 6-digit codes (stored hashed, valid for 15 minutes), and for each session its IP address, browser user agent and expiry.
  • Content: images you upload, text prompts, and the meshes, rigs, animations and exports generated from them.
  • Billing: handled by Stripe. We store a Stripe customer id, purchase and invoice records, never card numbers.
  • Usage: job records (timings, stage, credits, errors), API request counts, the time of your last activity, and standard server logs with IP address and user agent.
  • How you found us: on your first visit we note the campaign tags in the link (utm_source and similar), the referring website’s domain and the first page you saw, in a first-party cookie. If you click one of our sign-up buttons, the note also records which button. If you create an account, that note is stored with it. It contains no identifier and is not shared.
  • Daily totals: we count, per day, how many new visitors first arrived on each page, how many files were converted with each free tool and how many times each sign-up button was clicked. These are plain totals with no identifier, cookie value or IP address attached. The files you convert never leave your browser.
  • Analytics and ad measurement (Google): see “Google Analytics and Google Ads” below.

Google Analytics and Google Ads

We use Google Analytics 4 to understand which pages, free tools, campaigns and ads bring people to Bake3D and which of them lead to a sign-up or a purchase, and Google Ads to measure and improve our ads. Google acts as our processor for Analytics and as an independent controller for some advertising uses; see how Google uses information from sites that use its services.

  • In your browser: the Google tag records page views and actions such as viewing prices, starting a checkout, playing the demo, running a free tool, checking a picture, starting a bake and exporting a model. It sends the page address, the referring site, your browser and device type, an approximate location from your IP address and, when you are signed in and allow analytics, our internal account id (never your name or email).
  • From our server: when an account is created, when Stripe confirms a payment or a renewal, and when a payment is refunded, our server tells Google Analytics directly: the event, the amount, the currency, the item bought, a transaction number and your country. When you allow analytics it also sends the Analytics id of your browser and our account id, so the event joins the visit that led to it. When you allow advertising it also sends a one-way hash (SHA-256) of your email address, which Google uses only to match the conversion to an ad click; the address itself is never sent. Without analytics consent the event is sent with no identifier at all, only so totals are correct.
  • Your choice: in the EU/EEA, the UK and Switzerland nothing is stored for analytics or advertising until you allow it. Elsewhere both are on by default and you can switch either off at any time with “Cookie settings” at the bottom of every page or in Account → Settings; a browser that sends Global Privacy Control starts with advertising off. Google Consent Mode passes your choice to Google with every request. Without consent Google receives only cookieless signals that carry no identifier.
  • Retention: Google Analytics keeps event data for up to 14 months. Our own log of the server events sent to Google is deleted after 90 days.

Why, and on what basis

  • To provide the service and your account: performance of our contract with you.
  • To bill you and keep financial records: contract and legal obligation.
  • To keep the service secure and fair: legitimate interest. This includes rate limits, blocking disposable email addresses, detecting duplicate free accounts, and limiting how many accounts one network can create per day.
  • To understand which pages and campaigns bring people to Bake3D, in aggregate: legitimate interest.
  • Google Analytics and Google Ads measurement that stores or reads cookies, or links an event to you: your consent where the law requires it (EU/EEA, UK, Switzerland), otherwise our legitimate interest in measuring our marketing, with an opt-out at any time. Counting a sale or sign-up with no identifier: legitimate interest.
  • To send product news: only with your consent, and you can withdraw it at any time. Sign-in and billing emails are part of the service.

Who processes it for us

We use a small number of service providers (subprocessors), each bound by a data-processing agreement:

  • Hosting and storage — Cloudflare: runs the application, database, file storage, caches and job workflows, and optionally the bot check on the sign-in form (Turnstile).
  • Payments — Stripe: checkout, subscriptions, invoices and card data.
  • Email delivery — Cloudflare Email Service or Resend: sign-in links and codes, receipts and account notices.
  • AI inference and GPU compute providers: run the geometry, rigging, vision and motion stages. They receive your image, intermediate renders, skeleton descriptions and motion prompts only for the duration of a job, may not retain them afterwards, and may not use them for training. We will name the current providers on request.
  • Sign-in providers — Google and GitHub, only if you choose to sign in with them.
  • Fonts — Google Fonts: our pages load typefaces from Google’s servers, which therefore see your IP address and browser details when a page loads.
  • Analytics and ad measurement — Google (Google Analytics 4, Google Ads), as described above and only within your cookie choices.

Some providers process data outside your country, including in the United States, under standard contractual clauses or an equivalent safeguard. We do not sell personal data.

Cookies and similar storage

  • Session cookie (better-auth.session_token): keeps you signed in; lasts up to 30 days or until you sign out.
  • Sign-in state cookies: short-lived, set only while a Google or GitHub sign-in is in progress, to protect it from forgery.
  • First-visit cookie (b3_ref): the “how you found us” note described above; first-party, expires after 30 days.
  • Cookie choice (b3_consent): remembers whether you allowed analytics and advertising; first-party, expires after 6 months, then we ask again.
  • Google Analytics (_ga, _ga_*): tell your visits apart from others; up to 2 years. Only with analytics consent.
  • Google Ads (_gcl_*): remember an ad click so a later sign-up or purchase can be credited to it; up to 90 days. Only with advertising consent.
  • Local storage: remembers small interface choices, such as a dismissed announcement.

When you withdraw consent we delete the Google Analytics and Google Ads cookies from your browser straight away.

Retention

  • Projects and files stay in your account until you delete them.
  • Sessions expire after 30 days; server logs are kept for up to 30 days; rate-limit and abuse counters expire within 2 days.
  • When you delete your account, your profile, projects, files, API keys and credit history are deleted immediately and removed from backups within 30 days. We keep invoices and payment records as tax law requires, and a one-way hash of your normalised email address so the free sign-up credits cannot be claimed again with the same address. The hash cannot be turned back into your address.

Your rights

You can export your data at any time from Account → Settings → “Download my data”: one JSON file with your profile, credit history, purchases, projects, animation data and download links for your files. You can delete your account from the same page. You may also ask us to access, correct, port or erase your data, restrict or object to processing, or withdraw consent, by writing to hello@bake3d.ai. If you are in the EU/EEA or the UK you may complain to your data protection authority.

Security

Traffic is encrypted in transit, one-time sign-in links, codes and API keys are stored hashed, and access to production data is limited to the people who run the service.

Children

The service is not directed at children under 16 and we do not knowingly collect their data.

Changes

We post changes here and email account holders about material ones before they take effect.