Privacy Policy

The short version

We collect the bare minimum needed to run the site: your email so you can sign in and re-download your files, your purchase history so we can show you what you own, and basic analytics so we know which designs people love. We do not sell your data. We do not run third-party advertising.

What we collect

Account info: your email address (always) and your name + profile photo if you sign in with Google.
Purchase records: credit-pack orders, credits spent, files downloaded, free-file grants.
Payment metadata: Stripe's customer ID and the Stripe checkout session ID for each order. We never see your card number, which Stripe handles directly.
Site usage: page views, broad referrer info, anonymized device class via Vercel Analytics & Speed Insights. No cross-site tracking.
How you found us: the first page you landed on, the site that linked you here, any campaign tags on that link, and the country the visit came from. It sits in a cookie in your browser for 30 days and is only saved against an account if you make one (or generate a free design on /create, which keeps it for up to 30 days alongside the design). We use it to learn which channels bring people here and to keep anything we send you relevant.
Account activity: when you last signed in, and whether you have asked us not to send product emails.
Design emails: if you ask us to email you a design you generated on /create, the address you give is stored with that design so we can send the files and answer a question about them. It goes on no list.
What you tell us about a design: if you answer a question under a design you generated (what is off about it, or how it cut), the answer is stored with that design. If you send us a photo of a design after cutting it, we keep the photo with the design. We only show a photo on the site if you ticked the box saying we may.
Server logs: IP address and request metadata, retained for ~30 days for abuse detection.

What we don't collect

Full card numbers (Stripe holds those).
Browsing data from other websites.
Phone numbers, addresses, or other personal info beyond what's above.

Third parties we share with

We hand off specific data to a small set of providers, only as needed to run the site:

Stripe (payment processing): name, email, card details you enter.
Mailjet (email): your email address and the contents of what we send you, including the magic-link token.
Google (OAuth sign-in, optional): your Google profile info, only if you choose Google sign-in.
Vercel (hosting, analytics, file storage): site traffic plus the cookie that keeps you signed in.
Neon (Postgres database): your account row and order history.
AI providers (Anthropic, Runway, OpenAI): only used by site admins generating new designs. Your account info is never sent to them.

Email

We email you sign-in links and receipts; those are part of the service and cannot be turned off. We may also send the occasional note about new designs and features. You can turn those off any time from account settings, and we stop straight away.

Cookies

We use a session cookie to keep you signed in (set by Auth.js, our authentication library), a CSRF cookie for form security, and a first-party cookie that remembers the page you first landed on and where you came from, for 30 days. Vercel Analytics uses a privacy-preserving cookie-less measurement system. We don't use third-party advertising or cross-site tracking cookies.

Your rights

You can:

Download your account data. Email hello@cutfilevault.com and we'll send a JSON export within 7 days.
Delete your account from the account settings page (or by emailing us). This permanently removes your CutFileVault profile, library, credit ledger, and order history. Stripe retains a separate copy of payment records on their side as required by their own financial-services regulations; we have no control over that retention.
Opt out of analytics by enabling "Do Not Track" or installing a content blocker; we won't penalize you.

If you're in the EU/UK (GDPR) or California (CCPA), you have additional rights to access, correct, or restrict processing of your data. Contact us using the email above.

Children

The site isn't directed at children under 13. If you believe a minor created an account, email us and we'll delete it.

Changes

We'll update this page when our practices change and revise the "last updated" date above. Material changes will be announced by email to active customers.

Contact

Questions, requests, or complaints: hello@cutfilevault.com.

What we collect

Account info: your email address (always) and your name + profile photo if you sign in with Google.

Purchase records: credit-pack orders, credits spent, files downloaded, free-file grants.

Payment metadata: Stripe's customer ID and the Stripe checkout session ID for each order. We never see your card number, which Stripe handles directly.

Site usage: page views, broad referrer info, anonymized device class via Vercel Analytics & Speed Insights. No cross-site tracking.

How you found us: the first page you landed on, the site that linked you here, any campaign tags on that link, and the country the visit came from. It sits in a cookie in your browser for 30 days and is only saved against an account if you make one (or generate a free design on /create, which keeps it for up to 30 days alongside the design). We use it to learn which channels bring people here and to keep anything we send you relevant.

Account activity: when you last signed in, and whether you have asked us not to send product emails.

Design emails: if you ask us to email you a design you generated on /create, the address you give is stored with that design so we can send the files and answer a question about them. It goes on no list.

What you tell us about a design: if you answer a question under a design you generated (what is off about it, or how it cut), the answer is stored with that design. If you send us a photo of a design after cutting it, we keep the photo with the design. We only show a photo on the site if you ticked the box saying we may.

Server logs: IP address and request metadata, retained for ~30 days for abuse detection.

Third parties we share with

We hand off specific data to a small set of providers, only as needed to run the site:

Stripe (payment processing): name, email, card details you enter.

Mailjet (email): your email address and the contents of what we send you, including the magic-link token.

Google (OAuth sign-in, optional): your Google profile info, only if you choose Google sign-in.

Vercel (hosting, analytics, file storage): site traffic plus the cookie that keeps you signed in.

Neon (Postgres database): your account row and order history.

AI providers (Anthropic, Runway, OpenAI): only used by site admins generating new designs. Your account info is never sent to them.

Your rights

You can:

Download your account data. Email hello@cutfilevault.com and we'll send a JSON export within 7 days.

Delete your account from the account settings page (or by emailing us). This permanently removes your CutFileVault profile, library, credit ledger, and order history. Stripe retains a separate copy of payment records on their side as required by their own financial-services regulations; we have no control over that retention.

Opt out of analytics by enabling "Do Not Track" or installing a content blocker; we won't penalize you.

If you're in the EU/UK (GDPR) or California (CCPA), you have additional rights to access, correct, or restrict processing of your data. Contact us using the email above.