Privacy
Last updated 11 September 2026.
What we store
An account holds your email address, a display name, and the credentials you sign in with: a salted password hash, or a link to your Google, GitHub or Discord identity (their user id and the avatar they provide). We store session records (an opaque id, its expiry and the browser's user-agent string) so you stay signed in.
Scenes you save are stored on the server under your account, one file each, so that you can open them on any device and share a table by link. They are yours: export any scene as JSON at any time, and deleting a scene or your account removes the files. The models you upload stay in your browser; a scene only names them.
Payments
Premium subscriptions are sold through Creem, our merchant of record. Checkout, card details and invoices are handled on Creem's pages under Creem's privacy policy; we never see or store a card number. On our side we keep the Creem customer and subscription ids, the subscription's status and the date the paid period ends, so that the app knows which plan you are on. Nothing about your scenes is sent to Creem.
What we do not store
Your uploaded models, images and prefabs stay in your own browser's storage. Exported scene files go where you put them.
Analytics
We use Google Analytics to count visits and to see which parts of the site and app get used: pages viewed, which links and buttons are clicked, how far an article is read, a scene opened, a room built, play mode started, and errors the app hits. Advertising features and Google signals are switched off, and no email address or scene content is ever sent. Signed-in use is tied to your account's opaque id so that we can see a sign-up turn into a first map. If your browser sends Global Privacy Control or Do Not Track, nothing is loaded at all.
We email you only to confirm your address, to send a sign-in link you asked for, or to reset a password you asked to reset.
Cookies
One session cookie keeps you signed in; one short-lived cookie carries state during a "Sign in with…" flow. Google Analytics sets its own first-party cookies to tell one visit from the next, unless your browser signals Global Privacy Control or Do Not Track.
Deleting your account
Open your account and choose delete. Your account, sessions, sign-in links and every saved scene are removed immediately, and an active subscription is cancelled.
Self-hosting
If you run your own copy, the host you sign up with is the party responsible for your data. This page describes what the software stores.
Contact
Questions about your data, or a request to see or delete it: [email protected].