Privacy policy

Your project files stay on your device

Dielines, artwork, 3D previews, renders and every export are made in your browser. Projects, uploaded images and version history are kept in your browser’s own storage (IndexedDB and local storage) on your device; clearing this site’s data in your browser removes them, so save a project file to keep a copy. A project is uploaded to our servers only when you choose to share a team snapshot. The free tools (barcodes, QR codes, box sizes and the dieline viewer) run in your browser too. When analytics is enabled, session replay sends rendered design preview frames to PostHog; those frames can include artwork and text you add. Replay also captures app text, input values, attributes and displayed images without masking, as described below.

Team workspaces and shared projects

When you create or join a workspace, we store its name, owner, members’ account IDs, names and email addresses, and invitations in Postgres. Workspace members can see each other’s name, email and role; pending invitations are visible to the owner, admins and the invited person. Invitation links expire after seven days and can only be accepted by the verified email address that was invited.

We use Resend to email team invitations. It processes the recipient’s email address, workspace name, inviter’s name and invitation link to deliver the message. The invitation remains available in the recipient’s account if email delivery fails.

When someone signs in with their organization’s single sign-on, we receive their email address, name and the attributes their identity provider sends, through Google’s Identity Platform (Firebase Authentication). We use the attributes only to sign that person in and match them to their workspace, and keep their email address and name in their account profile as for Google sign-in. Every workspace keeps an audit log of changes to members, invitations, roles, seats, verified domains and single sign-on, with the email addresses of the person who made each change and anyone it affects; on Business, the owner and admins can read it. Verified domains and the results of their DNS checks are stored with the workspace.

Sharing a project uploads a snapshot containing its design and artwork to our server. Current workspace members can download it while the workspace’s plan is active. Local edits are not uploaded automatically. The person who shared a snapshot, an admin or the workspace owner can delete it. Removing a member ends access to future snapshots, but does not remove files they already downloaded.

Your account, if you create one

Google sign-in is required to use the design tools and download files. Sign-in uses Firebase Authentication, a Google service. When you sign in, we receive and store:

• your Google account ID, name, email address and profile photo link;
• when your account was created and when it was last used.

This profile is kept in Google Cloud Firestore. We use it to recognise you, show your plan and contact you about your account or subscription.

We also keep your account ID and the time of your most recent free download in Postgres to enforce one free download every eight hours. We do not store the downloaded file or its contents.

Payments and billing records

Paddle.com is our reseller and the merchant of record for every order. When you subscribe, Paddle collects your payment details, billing address and tax information, charges you, sends your receipts and handles taxes, under Paddle’s privacy policy. We never receive your card details.

In our own database we keep the billing records needed to give you the plan you paid for: your Paddle customer and subscription IDs, your plan, its status and billing dates, a record of each checkout you start and of Paddle’s billing notifications, and any complimentary access we grant you, all linked to your account ID.

Support chat

We use Crisp for support chat. Crisp processes your messages, any contact details you choose to provide, and technical information such as your IP address, browser and visited pages so we can answer and follow up. The widget uses cookies and a browser session identifier to preserve your conversation as you move between pages. Crisp can email unread replies if you provide an email address. See Crisp’s privacy policy for details.

Feedback requests

When you request a missing template, report a bug or suggest a feature, we email the search term or report, the page you were on, and your verified account name, email address and ID to our support inbox through Resend. We use this information to review the request and reply to you. Please do not include payment details or private artwork in the report.

Design assistant

When you use the Assistant in the editor, what you type, a resized copy of each picture you attach, and the size and options of the design you have open are sent to our server and on to TypeSafe, whose AI model reads them and returns the choices the assistant shows. Your original picture files stay in your browser until you place them on a design. We keep no copy of your words or pictures on our servers; the model’s answer may be cached in memory for up to 15 minutes so the same question is not asked twice. TypeSafe states that it does not train its models on customer requests. Analytics records only that the assistant answered and how, never your words or pictures.

Cookies and browser storage

DielineMaker uses browser storage for your projects and settings, Firebase’s record that you are signed in, and your analytics preference. Unless you disable analytics, PostHog also stores a random visitor identifier and session information in local storage. The site loads Google’s sign-in code (Firebase Authentication), which may contact Google, when it may be needed: on the pricing and account pages, when you reach for Sign in or open the phone menu, on any page once you have signed in on this browser before, and in the editor when you open the export options or export (to check your plan). Paddle’s checkout uses its own cookies and similar technology while it is open, to process the payment and prevent fraud. Our network provider may set strictly necessary security cookies.

Analytics and session replay

Analytics is enabled by default. PostHog collects page visits, referral sources and campaign tags, device and browser information, approximate country, performance and network timing measurements, application errors, clicks, scrolling, and actions such as choosing a template, importing artwork, exporting a file or opening checkout. We send metadata such as the template, file format, duration and whether an action succeeded; an unsuccessful catalogue search also sends its normalized search term and search location so we can see which templates are missing. Other product events do not include file names, artwork, project contents, input text, payment details or your email address. Session replay can include app text, input values, displayed account information and rendered design previews as described below. When you sign in, we link enabled browser activity to your account ID and set your name, email address, email verification, sign-in provider, account creation time, plan, subscription status and team ID on your PostHog person profile. This lets us identify signed-in users in session replay. Explicit product-event metadata does not include your Google profile; unmasked replay can include account details and profile images displayed in the app.

PostHog session replay records the app interface and interactions without text, input or attribute masking. Recordings can include search queries, project names, text you enter, displayed account information, image elements and 2D/3D design previews, including your artwork and design text. App sections previously marked private are included. Replay also retains app links and URL state. Embedded pages on another origin require their own recorder support; temporary or protected media may not remain available in replay. Console logs and network request headers and bodies are disabled. Ordinary analytics event URLs still lose query strings and fragments.

Browser analytics and replay start automatically. Use the control below to turn them off or on for this device. Previously saved opt-outs and your browser’s Do Not Track and Global Privacy Control signals are respected. Turning analytics off does not remove data already collected; contact us if you want it deleted.

Separately, we send limited operational billing events to PostHog: checkout creation, plan changes, verified subscription status and confirmed transaction totals and currency, linked to your account ID. This lets us monitor subscription delivery and payment problems. These events do not include payment details, email addresses or replay, and are independent of your browser analytics choice.

Server logs

Like most websites, our servers and network providers (including Cloudflare) process technical data such as your IP address, browser type and the pages you request, to deliver the site and keep it secure. We do not use these logs to profile you.

Who processes data for us

• Google (Firebase Authentication and Cloud Firestore): sign-in and your account profile.
• Paddle: checkout, payments, tax, receipts and subscription management.
• Resend: delivering team invitation and feedback emails. See Resend’s privacy policy.
• PostHog (US cloud): analytics and unmasked session replay, plus limited operational billing metrics. See PostHog’s privacy policy.
• TypeSafe: reading what you ask the design assistant and the pictures you attach to it. See TypeSafe’s privacy policy.
• Our hosting and network providers, including Cloudflare: delivering and protecting the site.

These providers may process data outside your country, under their own data protection terms and safeguards such as standard contractual clauses. We do not sell your personal data or share it for advertising.

Why we may use it

We use your account and billing data to provide the service you signed up for (the contract with you), keep server logs to secure the site and monitor subscription delivery (our legitimate interest), and keep billing records where accounting and tax law require it (legal obligation). Browser analytics and replay help us understand usage and diagnose problems; you can turn them off on this page.

How long we keep it

We keep account and billing records while you have an account. If you ask us to delete your account, we delete your profile and keep only the billing records we need for accounting, tax or legal reasons. Analytics and replay are retained according to our PostHog project’s retention settings; you can request deletion of analytics linked to your account ID by contacting us.

Your rights

You can ask for a copy of the personal data we hold about you, or ask us to correct or delete it, or to stop using it, by emailing [email protected]. Depending on where you live, for example under the GDPR or UK GDPR or California law, you may also complain to your data protection authority.

Children

DielineMaker is not directed at children under 16, and we do not knowingly collect their personal data.

Changes

If what we collect changes, we will update this page and the date at the top. See also our terms and refund policy.

Contact

Privacy questions and requests: [email protected].