Privacy Policy

You can browse the whole library without an account. An account is needed only to save projects, upload your own files, connect a plug-in or download a plug-in installer. An account is an email address, a password, and a name if you give one; you can also sign in with a Google account instead of a password.

Signing in sets the session cookies and tokens that keep you signed in between pages. A new account confirms its email address with a short code sent to that address. Passwords are held by the sign-in service in hashed form and are never readable by us.

Files you add to a project - your own models, images and documents - and the converted files made from them are stored in private cloud storage (Cloudflare R2). They are not public. They are read back only through short-lived signed links, issued to your own signed-in account or to someone you share a read-only link with.

Published library models, their preview images and their downloadable files are public: anyone with the link can open them, which is the point of a published catalogue.

Connecting a plug-in to your account uses an eight-character code you read off the plug-in and approve while signed in. The plug-in then holds a connection token. Those tokens are stored only as one-way hashes, together with a label and the time one was last used; you can revoke any of them from your account, and a revoked token stops working immediately.

The contact form and the report and claim forms store the name, email address and message you write, so we can reply and keep track of the request. They also store a one-way hash of the address the form was sent from, used only to limit how often one connection can send messages; the address itself is not stored.

Opening a model or downloading a file increases that model's view or download count. A view is counted once per browser session per model. These counts are attached to the model, not to a profile of you.

The app does not load advertising or third-party analytics scripts, and does not build advertising profiles of visitors.

WorkVault runs on Base44, which provides the hosting, the sign-in service, the database and the delivery of account emails. Files are stored and served by Cloudflare R2. Once paid plans are billed, a payment processor will handle card details; card details are never handled by this app itself.

We do not sell personal data, and we do not share it for advertising.

Account information is kept while the account exists. Models you delete are recoverable for 36 hours and are then removed. A message you send us is kept while it is being handled.

To have your account and its data deleted, or to ask what is held about you, write to us from the contact page. We answer at the address the request came from.