This policy explains what personal data LowPolyCrate collects, why, how long it is kept and what you can ask us to do with it. We aim to collect as little as possible.
1. What we collect
When you create an account
- your email address and, if you choose, a display name;
- if you sign in with Google: Google tells us your email address, that Google has verified it, and your name (used as your display name unless you set one). We do not get your Google password, contacts or anything else, and we do not post anything to your Google account;
- whether you agreed to receive product emails (off unless you turn it on).
When you buy a plan or an asset
- the order: what you bought, the price, the license version, and the date;
- the payment confirmation that Dodo Payments sends us, so we can match payments to orders and process refunds. It contains the payment reference numbers, your name, email and billing address, the tax charged, and the card's network and last four digits.
We never receive or store full card numbers or bank details. You enter those on Dodo Payments' checkout page, and Dodo Payments handles them under its own privacy policy.
When you use the site
- Product statistics: we count things like "an asset page was viewed", "the 3D preview loaded", "a download started" and search terms. These records contain the asset involved and the time, but no account, IP address, cookie or device identifier. They cannot be traced to you. Search terms that look like an email address are discarded.
- World Builder: a scene you save to your account is stored with it: the scene's name, which assets stand where, and a picture of the scene made in your browser when you save or share it. If you share it, the name, picture, scene and your display name can be seen by anyone with the link.
- API keys: if you make one, we store its name, when it was made and last used, whether it was revoked, and how many requests and downloads it made each day. The key itself is shown to you once and stored only as a one-way hash.
- Connected apps: if you connect an app such as Claude by signing in from it, we store the app's name and web address, the permissions you allowed, when it was connected and last used, and the same daily counts. The tokens we give the app are stored only as one-way hashes and expire on their own; disconnecting the app on your account page cancels them at once. A connected app can see your display name, email address and plan, and what the permissions you allowed cover.
- Server logs: like every website, our server records requests (including the IP address and browser type) to keep the service secure and fix problems.
2. Cookies
We use only the cookies the site needs to work:
| Cookie | Purpose | Lasts |
|---|---|---|
sessionid | keeps you logged in | 2 weeks, or until you log out |
csrftoken | protects forms against cross-site attacks | 1 year |
The World Builder also keeps the scene you are working on in your browser's local storage, so it is still there when you come back. It never leaves your device unless you save the scene to your account, and clearing your browser's site data removes it.
There are no advertising, tracking or third-party analytics cookies. The checkout page is on Dodo Payments' own website, which sets its own cookies.
3. Why we use your data
- to run your account and deliver what you bought (performing our contract with you);
- to send sign-in links, receipts and replies to your messages;
- to keep accounting and tax records that the law requires;
- to keep the site secure and working;
- to send product emails, but only if you opted in. You can opt out at any time from your account page.
We do not sell your data, and we do not use it for advertising.
4. Who else handles it
- Dodo Payments sells and processes plans and purchases as our merchant of record. When you start a checkout we send it your email address and display name, so you don't have to type them again.
- Our email provider (Resend) delivers sign-in links and receipts.
- Google, only if you choose "Continue with Google", confirms who you are; it learns that you signed in to LowPolyCrate.
- Our hosting provider runs the servers that store the site's data.
- Bunny.net stores the site's files and delivers them through its content delivery network. Those files are the previews, the downloads and the pictures of saved World Builder scenes. When your browser fetches one, Bunny.net sees your IP address and browser type, as any web server does.
Each receives only what it needs for that job. We may also disclose data where the law requires it.
5. How long we keep it
| Data | Kept for |
|---|---|
| Account details | until you ask us to delete your account |
| Saved World Builder scenes | until you delete them or your account |
| API keys, connected apps and their daily usage counts | until you delete your account (revoked keys and disconnected apps stay on record, unusable) |
| Orders and payment references | as long as Indian tax and accounting law requires (currently up to 8 years), even after an account is deleted |
| Product statistics (anonymous) | 180 days |
| Server logs | about 2 months |
| Backups | up to 14 days for the database |
6. Your rights
Under India's Digital Personal Data Protection Act, 2023, you can ask us to:
- tell you what personal data we hold about you;
- correct or complete it. You can change your display name and email settings from your account page yourself;
- delete your account and personal data, except records we must keep by law;
- withdraw consent to product emails at any time.
You may also nominate someone to exercise these rights for you in the event of your death or incapacity.
To use any of these rights, write to the address on the support page from the email address on your account. We reply within 30 days. That address also serves as our contact for grievances about personal data. If we do not resolve a complaint, you may contact the Data Protection Board of India.
7. Security
There are no customer passwords to leak: sign-in links work once and expire after 15 minutes. The site is served only over HTTPS, paid files are reachable only through short-lived download links checked against your purchases, and the database is backed up every night. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.
8. Children
The site is not intended for children under 18. We do not knowingly collect data from children without a guardian's consent.
9. Changes
When this policy changes, the date at the top of the page changes. If a change is significant, we also email account holders.