Policies

Privacy Policy

What we collect, why we collect it, who else touches it, and how to get it back or delete it. Kiln has no advertising business, so there is no tracking to disclose — the data we hold is the data needed to run your account.

Last updated: September 7, 2026

The short version. We store your account details and the projects and assets you choose to save. We never see your card details. We do not run advertising or third-party analytics trackers, do not sell data, and do not use your designs to train AI models. You can export everything and delete your account yourself, at any time.

1. Who is responsible for your data

The data controller is Maxim Kuznetsov, an individual entrepreneur registered in Georgia, trading as Disarto and operating Kiln at getkiln.app. For any privacy question or request, email hi@getkiln.app.

2. What we collect

Account data

Your email address and password (stored only as a secure hash — we never see it).
Your display name and, if you upload one, your avatar image.
If you sign in with Google or GitHub, the basic profile information those services return (name, email, avatar).
Your plan, subscription status and renewal date.

Content you create

Projects you save to the cloud, including the scene document and its settings.
Assets you upload — images, video, SVG and 3D models — and the thumbnails generated from them.
Interface preferences, such as your file-browser filters and which panels are open.

Technical data

Standard server logs from our hosting and database providers (IP address, browser/user-agent, timestamps, error traces), used for security and debugging and retained for a short period by those providers.
Timestamps of account creation and last sign-in, used to operate the service and understand aggregate usage.

Payment data

If you subscribe, the payment is handled entirely by Dodo Payments, who act as merchant of record. They collect your payment details and any billing address or tax information required. We never receive or store card numbers. What we store is limited to your plan, subscription status, renewal date and the opaque customer and subscription identifiers Dodo gives us so we can match a payment to your account.

3. Why we use it, and our legal basis

To provide the service — sign you in, store and load your projects and assets, and apply your plan's limits. Legal basis: performance of our contract with you.
To take payment and manage subscriptions. Legal basis: performance of a contract, and compliance with tax and accounting law.
To keep the service secure and working — abuse prevention, debugging, backups. Legal basis: our legitimate interest in a secure, functioning product.
To contact you about your account: password resets, email confirmations, billing notices, and material changes to the service or these policies. Legal basis: contract and legitimate interest.
Product updates and announcements, if you opt in. Legal basis: consent — you can unsubscribe from any such email.

We do not use your content for advertising, do not sell or rent personal data, and do not use your projects, designs or uploaded assets to train machine-learning models.

4. Who processes data on our behalf

We keep the list of third parties deliberately short. Each is a processor acting on our instructions under a data-processing agreement:

Supabase — user accounts, authentication and the project database.
Cloudflare R2 — storage for the assets and thumbnails you upload.
Vercel — hosting and delivery of the website and application.
Dodo Payments — payment processing, invoicing and tax, as merchant of record. Dodo is an independent controller for the payment data it collects.
Loops — transactional email (sign-up confirmation, password reset, billing and service notices).

We may add or replace a provider as the product changes; this list is kept current, and material changes are announced as described in section 9.

5. International transfers

Our providers operate globally and data may be processed outside your country, including in the United States. Where personal data of EU/UK residents is transferred, it is done under appropriate safeguards — typically the European Commission's Standard Contractual Clauses as included in our providers' data-processing terms.

6. Cookies and local storage

We use no advertising, marketing or cross-site tracking cookies, and as of this update we run no third-party analytics at all — so there is nothing to consent to. What the app does store in your browser is functional and necessary:

your sign-in session, so you stay logged in;
interface preferences such as filters, sort order and open panels;
a local copy of unsaved work, so that a lost connection or a closed tab does not lose your edits — this is on your device and is cleared once the work syncs.

7. How long we keep it

While your account exists: your account data, projects and assets are kept so you can use them.
When you delete your account: your projects, assets and profile are deleted from our database and object storage, and any active subscription is cancelled. Deletion is immediate and cannot be undone.
Backups and provider logs may retain residual copies for a short period (typically up to 30 days) before rotating out.
Payment and tax records are retained by Dodo Payments for the period their legal obligations require, independently of your Kiln account.
Assets stored above your plan's allowance may be removed after two continuous years above the limit, with advance notice — see the Terms.

8. Your rights

Depending on where you live, you have the right to access, correct, export, restrict or delete your personal data, to object to processing based on legitimate interests, and to withdraw consent. Most of these you can exercise directly in the product:

Access and export: every project can be saved as a self-contained file from the editor at any time, on any plan.
Correct: change your name, email, password and avatar in Settings.
Delete: Settings → Delete account removes everything.

For anything else, email hi@getkiln.app and we will respond within 30 days. If you are in the EU or UK and are not satisfied with our response, you may complain to your local data-protection authority.

9. Security and children

Access to your data is enforced at the database level: each row is readable only by the account that owns it, and asset files are served through short-lived signed links rather than public URLs. Passwords are hashed, traffic is encrypted in transit, and payment details never reach our systems. No service can promise perfect security, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.

Kiln is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.

10. Changes to this policy

We will update this page as the product changes; the “last updated” date above always reflects the current version. Material changes are announced by email or in the app before they take effect.

11. Contact

Maxim Kuznetsov — hi@getkiln.app.