Privacy Policy
Effective date: [用户填入 — 上线日]
Last updated: [用户填入]
1. Who we are
CleanPaths ("we", "us", "our") is operated by [用户填入：公司主体/个人全名], located at [用户填入：地址]. You can reach us at privacy@cleanpaths.io [待确认：域名邮箱需先开通].
CleanPaths is a browser-based tool that converts images (PNG, JPG, SVG, screenshots) into cut-ready DXF/SVG files for makers, Cricut sellers, and embroidery machine owners.
2. The short version — your files never leave your device
All file conversion happens entirely inside your browser. Your images and the files you generate are processed locally using WebAssembly (WASM) and, for optional AI upscaling, your device's WebGPU. We do not receive, store, see, or transmit your files. When you close the tab, your files are gone — we never had them.
This is not a marketing claim; it is how the tool is built. There is no upload step. (Free tier: fully local. Pro tier: also fully local — Pro unlocks features via a license key, not by moving processing to a server.)
3. What we collect (and why)
Because we have no accounts and no registration, we collect very little. Here is the complete list:
| Data | When | Why | Where it goes | How long we keep it |
|---|---|---|---|---|
| Your image/output files | When you convert | To perform the conversion | Nowhere — processed locally in your browser only | Never received, never stored |
| Feedback form: emoji rating + optional text | When you submit feedback on the result page or footer | To improve the tool | Sent via our form endpoint provider [待回填：08 选型，候选 Web3Forms / Formspree / Cloudflare Worker + Resend] to our mailbox feedback@cleanpaths.io [待确认] | Up to 12 months, then deleted |
| Purchase data: email address, order ID, license key, country (for tax) | When you buy Pro | To deliver your license key, handle refunds, and meet tax obligations | Payment is processed by our Merchant of Record (see §4). We receive only: your email, order ID, license key, and country. We never see or store your card number. | For the life of your license + up to 7 years for tax/legal records |
| License activation data: license key + a one-way device identifier hash | First activation of Pro | To validate your license (one-time online check; afterwards Pro works offline) | Our license server [待回填：MoR License API — 首选 Creem（license keys 官方内建）] | For the life of your license |
| Free-tier rate limiting: hashed IP address + browser storage counter | When you use the free tier | To enforce the free daily limit (10 conversions/day) and prevent abuse | Our edge infrastructure (Cloudflare). IP is stored only as a one-way hash, not used for tracking or advertising | Hash deleted within 24 hours |
| Anonymous, aggregated usage analytics | When you browse the site | To understand which pages are useful | [待回填：08 选型，候选 Cloudflare Web Analytics 或 Plausible] — cookieless, no cross-site tracking, no personal profiles | Aggregate statistics only |
A note on the feedback form
The text field is optional and free-form — please don't include personal information you don't want us to have. If you include your email address so we can reply, we will use it only to respond to your feedback and (with your explicit written consent, see §6) to ask about featuring your words as a testimonial.
4. Payment processing (Merchant of Record)
Purchases are handled by our Merchant of Record [待回填：04 v1.2 首选 Creem，签约后定稿], which acts as the seller of record and an independent controller of your payment data. They process your card, billing details, and applicable taxes (VAT/GST/sales tax) under their own privacy policy. We recommend you read it: [待回填：MoR 隐私政策链接].
We receive from them only what we need to deliver your purchase: your email address, order ID, license key, and country. We never receive, process, or store your card number.
5. Cookies and tracking
We do not use tracking cookies. See our Cookie Policy — the short version is: one strictly-necessary browser storage entry (your free-tier usage counter and license cache) and cookieless aggregate analytics. No ad networks, no retargeting, no selling data. Ever.
6. Testimonials and "Show Your Work" (planned, v1.1)
We may feature user testimonials and photos of finished work on the site. We will only do this with your explicit written consent (obtained by email reply), you can withdraw it at any time by emailing privacy@cleanpaths.io, and we will remove the content within 14 days of withdrawal. We will never lift your feedback text or images without asking first.
7. Third-party services we use
| Service | Role | Data shared |
|---|---|---|
| [待回填：Creem（首选）/ Paddle（备选）] | Merchant of Record (payments, tax, license delivery) | Email, order details — card data handled by them directly |
| [待回填：Web3Forms / Formspree / Worker+Resend] | Feedback form endpoint | Your feedback text (and email if you include it) |
| [待回填：Cloudflare Web Analytics / Plausible] | Cookieless aggregate analytics | No personal data |
| Cloudflare | Hosting / edge infrastructure | Technical request data (hashed IP for rate limiting) |
| [待回填：Resend 等] | Transactional email (license delivery, support replies) | Email address, message content |
We do not sell personal data, and we do not share it with anyone else except as required by law.
8. International data transfers
Our infrastructure providers may process data in the United States and other countries. Where required (EEA/UK/Brazil), transfers rely on appropriate safeguards such as Standard Contractual Clauses via our processors' data processing agreements. [待确认：签约 MoR 时索取 DPA]
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict processing, and to lodge a complaint with a supervisory authority:
- California (CCPA/CPRA): you have the right to know, delete, correct, and to opt out of sale/sharing. We do not sell or share personal data for cross-context behavioral advertising.
- EEA/UK (GDPR): you have the rights listed above; our legal bases are contract performance (license delivery), legitimate interest (abuse prevention, product improvement), and consent (testimonials).
- Brazil (LGPD): you have the rights under Art. 18 of Law 13.709/2018. Our PT-language pages follow the same minimal-collection architecture described here.
To exercise any right, email privacy@cleanpaths.io. We respond within 30 days.
10. Data retention
See the table in §3. In short: feedback emails up to 12 months; purchase/license records for the life of your license plus statutory tax periods; rate-limiting hashes under 24 hours; no file data at all. You can ask us to delete your feedback or personal data at any time (license records may need to be kept for tax/legal reasons — we'll tell you if so).
11. Security
Because your files never reach us, the biggest category of risk simply doesn't exist. For the small amount of data we do hold, we use TLS in transit, access-limited mailboxes, and vendor infrastructure (Cloudflare / MoR) with industry-standard security.
12. Children
CleanPaths is not directed at children under 13 (or under 16 in the EEA/Brazil where applicable), and we do not knowingly collect their data. With no accounts and no uploads, children's use of the converter itself leaves no data with us.
13. Changes to this policy
If we change this policy, we will update the "Last updated" date and, for material changes, note them on this page. This page is part of our copy-freeze set: changes go through review before publishing.
14. Contact
[用户填入：公司主体/姓名] · [用户填入：地址]
Privacy requests: privacy@cleanpaths.io [待确认] · General: hello@cleanpaths.io [待确认]