Privacy Policy

Project storage and backups

Paid plans include hosted storage within their limits. Free project storage lasts seven days. When paid access ends, existing hosted work becomes read-only for a seven-day export window and is then permanently deleted. Exact deletion dates appear in Account → Storage. Existing free work receives advance notice and a full seven-day window when this policy first applies.

Trash counts toward storage and is recoverable for up to seven days, subject to an earlier project deletion date. Delete forever and Empty Trash cannot be undone. Download archives expire after 24 hours. Keep your own backups: download editable project packages or connect Google Drive. A backup is complete only when marked Saved; failed backups do not extend deletion deadlines.

Connecting Google Drive authorizes app-accessible files and folders. We retain encrypted authorization credentials for requested backups and automatic saving. Disconnecting removes the connection credentials and stops future backups, while existing Drive copies remain under Google's terms and privacy policy. Hosted copies remain subject to SliceForge storage limits and deletion dates. These rules do not change separate retention of billing, security, legal, or support records.

1. Responsibility and contact

Strategic Sloth LLC, a Wyoming limited liability company operated from Quebec, Canada, provides SliceForge and is responsible for the personal information described here. For the person responsible for the protection of personal information, write to support@sliceforge.io, addressed to “Privacy Officer,” or use support. Our mailing address is below. You do not need a paid subscription to make a privacy request.

2. Information and purposes

• Accounts: email, account identifiers, profile information, sign-in/session records, and information from Google or GitHub if you choose that sign-in method. We use these to create and secure your account.
• Legal and privacy records: policy version, document fingerprint, chosen language, server acceptance time, and confirmations; privacy requests and their status. These let us record agreements, respond to your rights requests, and meet legal obligations.
• Your work: uploads, images, prompts, AI results, projects, layouts, settings, and collaboration records. We process these to edit, generate, save, synchronize, export, and share work as requested.
• Billing: subscription status, customer/transaction identifiers, amounts, and credit usage, to deliver purchases, resolve payment issues, and keep required records. Stripe collects payment details; SliceForge does not receive or store your full payment-card number.
• Support and email: correspondence, request category, email address, and browser/window diagnostics you optionally send. Delivery, bounce, and complaint records help us deliver account, billing, security, and support messages.
• Technical records: IP addresses or derived rate-limit identifiers, browser/device information, request timestamps, errors, and usage records used to operate the service, prevent abuse, and improve reliability.

Avoid uploading sensitive personal information, passwords, payment-card details, or information you lack permission to share. Required account and transaction information is necessary to provide the corresponding services; optional diagnostics are voluntary.

3. AI and service providers

AI generation, analysis, and editing send relevant prompts, images, references, or layout content to OpenAI or Google Gemini, depending on the feature and model. Some tools choose a provider automatically. Local editing does not mean AI requests or cloud saves stay on your device. Use AI features only with content you are allowed to send for this processing.

Supabase provides authentication, database, and cloud storage; Vercel provides hosting; Stripe handles payments; Resend handles service email; and Cloudflare Turnstile verifies support submissions. They receive information needed for their functions. Sign-in providers also process information under their own policies.

Online fonts and browser-based model downloads may connect to Google Fonts, jsDelivr, unpkg, or Hugging Face, which can receive your IP address and ordinary request information. A locally running model may still require a network download.

Provider retention and use depend on the service and account configuration. This policy does not promise zero provider retention or that every provider excludes every request from model improvement. Contact us before sending confidential material if you need specific processing commitments.

4. Sharing and disclosure

Inviting collaborators or enabling project sharing makes the selected information available according to that sharing mode. Recipients may retain copies; revoking access cannot recall downloaded copies. Check sharing settings before including private material.

We disclose information to providers for the purposes above, where legally required, to protect rights and security, or in a business transfer subject to applicable protections. We do not sell personal information or share it for cross-context behavioral advertising. The current application does not use advertising trackers.

5. Cookies and local storage

Authentication cookies, local storage, session storage, and IndexedDB support sessions, preferences, project recovery, caches, and local work. Blocking or clearing them can sign you out or permanently remove unsynchronized work. Logging out does not necessarily erase local projects. On a shared device, export anything you need and clear this site’s browser data.

Payment and anti-abuse providers may use their own cookies or similar technologies when you interact with them. We will provide required consent controls before introducing optional tracking. This notice is not consent to future advertising or marketing.

6. Processing outside Quebec and legal grounds

Information may be processed outside Quebec, including elsewhere in Canada, the United States, and countries where providers operate. Courts or authorities there may access information under local law; protections may differ. Where required, transfers need an appropriate assessment and legal safeguard. Contact the Privacy Officer for information about arrangements applicable to your data.

Where Canadian law requires consent, we seek consent appropriate to the information and purpose. You may withdraw consent, subject to legal restrictions, and we will explain effects on service availability. Where EU or UK law applies, processing may be necessary to perform our contract (accounts, requested features, billing), meet legal obligations (such as accounting), or pursue legitimate interests (security, fraud prevention, reliability), balanced against your rights. We rely on consent where required for optional processing. Accepting Terms does not waive privacy rights.

7. Retention and security

Account and cloud project information is generally kept while needed for your account and requested storage. On a deletion request we assess removal or anonymization, subject to records needed for legal obligations, fraud prevention, disputes, or legal claims. Billing records may remain after closure. Support and diagnostic retention depends on operational need; backups and provider records may remain for their applicable retention cycles. Contact us for applicable retention criteria.

We use access controls and other safeguards, but no service is completely secure or a substitute for your own backups. Cloud deletion does not clear local browser data or copies retained by people you shared with.

8. Access, correction, deletion, and complaints

Depending on applicable law, you may request access, a copy or portable export, correction, deletion, restriction, information about disclosures, object to certain processing, or withdraw consent. Send your account email and request to the Privacy Officer. We may verify identity proportionately; do not send identity documents unless we explain why and how to provide them securely.

Submit account deletion or full access requests through Privacy & data or support. These requests require review; submitting a request is not confirmation that deletion is complete. Account downloads and editor exports are not complete personal-data exports. We will respond within applicable deadlines, explain any permitted extension or refusal, and provide applicable review or appeal options. We will not discriminate against you for exercising protected rights.

You may complain to the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, or your applicable local authority. You do not have to contact us before complaining to a regulator.

9. Age eligibility and changes

SliceForge is intended for people at least 18 and old enough to enter a binding contract where they live. Contact us if you believe a child supplied personal information so we can investigate and take appropriate action.

The date above identifies this version. We will provide notice of material changes and obtain additional consent where required before using personal information for a new purpose.