What we keep

Written the way the rest of this shop writes about storage: what is kept, where, and for how long. If anything here reads as vague, that is a fault and not a style.

Your world never leaves your device

The save you choose is opened and read in your browser. The save file itself never leaves your device: not the zip, not the regions inside it, not the blocks you built. The model is built on your own device, by code the page downloads, and everything else on this page follows from that.

Three things worked out from it do leave, and each has a heading of its own below. Saving a crop sends the world key and the choices you made: which box, which dimension, what size, what finish, and the angle you were looking from, so it opens facing the same way. Paying sends the same to Polar, with the revision it is buying. The file you paid for is geometry built here from the blocks inside that box, and a copy of it is uploaded. Nothing else goes anywhere, and the save is not among them.

Two more things leave, and neither of them is worked out from your world. The first you send on purpose: the feedback box at the bottom of the shop, which has a heading of its own below. The second is the visit itself, counted as it happens, and What we count says exactly what that records and what it strips off first. That is the whole list.

This is not a policy of ours that could change quietly. It is the rule the whole product is built on, and the parts of it that would need our servers do not exist.

If you buy something

The finished file, for ninety days

When a payment goes through, the archive you paid for is uploaded to private storage and kept for ninety days so you can download it again. That is the 3MF, the STL, the print notes and the README that explains them: the output, built on your device from a save that stayed there. A job deletes it on the ninety-first day. Keep your own copy.

Signing in is not part of it. Polar collected your email address when the card was charged, so the purchase is on the account it belongs to whether or not anybody signs in that day, and signing in later finds the file waiting. The tab you paid in is the tab that hands the file over either way, and nothing of it is kept in your browser afterwards.

The store is private. Knowing where a file sits gets nobody anything: reading it needs a signature we only issue after asking Polar whether the checkout that paid for it was paid.

A one-way name for your world

A purchase is recorded against a world key, which is a digest of three things that do not move: the world seed, what its owner called it, and where it spawns. It cannot be turned back into a world, it does not name you, and two people who generated a world on the same seed and left the name alone would produce the same one. It exists to answer a single question, which is whether the file being handed over is the one that was paid for.

Your email address

Polar is the merchant of record. It is the legal seller, it charges the card, it collects your email address and it remits the tax. We never see your card details, and there is no card number anywhere in this system to lose.

The address is also how an account finds what you bought. We ask Polar for the orders belonging to the address you signed in with, every time, rather than keeping a receipt of our own.

If you sign in

Signing in is optional and exists for one thing: so a purchase outlives the tab you paid in and reaches you on any computer. No link carries a purchase, and an account is the only way back to one. Clerk holds your email address and your session. We hold, against the id Clerk gives us, the crops you asked us to remember.

A saved crop is the world key described above, which dimension it is in, the corner and size of the box in blocks, the print width, the finish, the angle you were looking from, the date it was saved, an id this browser made up for the row, and the name of one of our example worlds where it is a crop of one. That is all of it. There is no name for a world of your own in it. Coordinates beside a name nobody can read are a point in a place nobody can find, which is what makes keeping them defensible at all. Fifty at most, and the account screen deletes any of them.

The account never holds your world. A world pass buys every crop of one world, and making the next one means opening your own save again, on your own device.

That list has no expiry, because it is a bookmark rather than a file and a bookmark that vanished on a schedule would be a worse thing than one that stayed. It is kept until you empty it, or until you delete your Clerk account, which takes it with it.

If you tell us how it went

There is a box at the bottom of the shop. What it sends is what you put in it: what you wrote, a name if you chose to give one, and a photo of your print if you attached one. Nothing else goes with it. Not your email address, not your account if you have one, not a word about your world, not the address of the page you were on, and nothing about the visit. We do not keep the address your browser came from against it. There is no sign-in in front of it, on purpose, because the people most worth hearing from are the ones who took a file and left.

A photo never reaches us as the file your camera made. Your browser opens it, draws it again, and encodes what it drew. Only that goes. A photograph records where it was taken, which for a picture of a print on your kitchen table is your home, and a drawing of a picture has nowhere to keep that: the camera's information is not stripped out of the file, it is simply not in the new one. The box says so under the picker, and there is no path through it that sends the file you chose.

We may put it on the shop window. Nothing gets there by itself: one person reads these, looks at the photo if there is one, and publishes one at a time. What appears is what you wrote, with the name you gave, the photo if you sent one, and nothing else. If you left the name blank it appears unsigned. What we hold is never edited, so a quote on that page is the sentence that arrived. A published photo sits at a plain address anybody can open, which is what publishing it means, and taking the quote down removes it from there.

It is kept until it is deleted, with no expiry, because it is not a file and a date would be arbitrary. And here is the honest consequence of the paragraph above: because there is nothing in it that says who you are, there is nothing to look you up by either, so we cannot find yours later and take it down for you. That is the cost of holding less about you rather than an excuse, the box says so before you press the button, and it is why the box also says to send nothing you would want back.

Who else is involved

• Vercel hosts this site and holds the private store the paid files sit in. Like every web host, its servers log the requests they answer. It also counts visits for us, which What we count below describes in full.
• Polar takes the payment as the seller of record. It holds your email address, the receipt, and against each order the world key, the revision that order paid for and the crop it was bought at: the corner, the size in blocks, the dimension, the print width and the finish. That is the same record described above, kept beside the order it belongs to, so a question about an order can be answered from it. Its checkout runs on its own page, on its own domain.
• Clerk holds your email address and your sign-in session, and only if you sign in. Its code loads on arrival on a browser that has signed in here before, so Clerk sees that request as it would any other, whether or not the session is still good.
• Meta, and only if you have said yes to it. They are told that a page here opened, and that a purchase happened for a given amount, so that we can tell which advert brought somebody in. They are never told which world you opened, which crop you took, what you called it, or anything that names you. Their code sets a cookie to do it, which is why it is the one thing on this site you are asked about rather than told about.

Nobody else, and there is no fifth party. Vercel serves this page, so it sees the request that fetched it. Polar is reached when you pay and not before. Clerk is reached when you open the account screen, or on arrival if you have signed in here before, which is the one exception and the next section says why. Meta is reached only if you have agreed to it, and The one thing we ask below is what agreeing means.

What we count

We count visits. When a page here opens, Vercel records that it opened, which screen it was, roughly where in the world the request came from, and whether it arrived on a phone or a computer. That is the whole of it, and it exists for one reason: this shop now pays to be advertised, and without a count there is no way to know whether anybody actually arrives.

It sets no cookie. Nothing is stored on your device for this, so there is nothing here to turn off. You are a number worked out from the request itself, thrown away after a day, and never joined up with the same number tomorrow, or on any other site, or with anything you bought.

The screen is counted and the settings on it are not. Your world key, the corner you cropped to, the size, the dimension and the finish all ride in the address bar so that a link can carry them, and every one of them is stripped off before the count leaves your browser. What is sent is that somebody opened the studio, or the crop sheet, or the file screen — and nothing about what they were looking at there.

One exception, and it runs the other way. If you opened one of our example worlds, the count says which: they ship with the site, their names are already in the links we invite you to share, and knowing whether people open the castle or the harbour is most of what tells us the shop window is working. A world of your own is never named. It has no name we could send: it was read on your device, we have never had a copy, and the only thing this site could say about it is that somebody opened a studio.

The one thing we ask

This shop pays to advertise itself, and the adverts are worth buying only if we can tell which of them worked. The count above cannot answer that, because it cannot see that the person who arrived came from a particular advert. Meta can, and the way they do it is a cookie in your browser.

So we ask, before anything of theirs runs. The banner on the shop window has a yes and a no, both of them one press, and neither is dressed up as the sensible answer. Until one of them is pressed nothing of Meta's is fetched, and scrolling past the question without answering it counts as a no for as long as you leave it that way.

If you say yes: Meta's code is loaded, it stores a cookie called _fbp in this browser, and it tells them that a page here opened and, if you buy a file, what it cost in pounds. That is the whole of what goes. Not the world, not the crop, not the size or the finish, not your email address, and no identifier of you that we hold — we deliberately switch off the part of their tag that would go looking for one.

If you say no: nothing of Meta's is fetched at all. Not loaded and silent — absent. And if you said yes before and have changed your mind, Marketing cookies at the foot of any page puts the question back and deletes the cookie on the way.

What we do not do

No profile of you is built here. Nothing on this site is sold, and nothing is handed to anyone for a mailing list. Nobody is told anything about you for marketing unless you have agreed to it, and what they are told then is the paragraph above and nothing more. The visit count described earlier cannot be turned back into a person either: it says a visit happened, not who made it, and there is no key anywhere that would join it to your email address, your order or your world.

Three pieces of code here are not ours, and only one of them waits to be asked. Vercel's counter is served from this site's own address and sends what the section above describes. Meta's is fetched from Meta and only after a yes. Clerk's loads only where accounts are switched on: on a browser that has never signed in here it is fetched when you open the account screen, and on a browser that has it is fetched on arrival, so the shop already knows what you own before you ask. That is what the sign-in hint kept in your browser is for, and Cookies and browser storage names it. Clerk's code collects usage telemetry of its own unless it is told not to, and we tell it not to. Polar's code arrives only when you pay.

What you can do about it

If you have not bought anything, have not signed in and have not sent us feedback, we hold nothing that is about you. Your visit was counted, and that count is described above: it cannot be turned back into a person, so there is nothing in it to ask for, correct or delete. Feedback holds nothing identifying you either, which is why it is the one thing here we cannot pick out on request even when asked.

• Change your mind about Meta with Marketing cookies, at the foot of every page. It asks again and clears _fbp whichever way you then answer, so a yes you have withdrawn stops being true on this device straight away. What Meta already received before you withdrew is theirs, and their own settings are where that is dealt with.
• Delete a saved crop from the account screen. It goes immediately.
• Clear the world, the remembered names and the sign-in hint with Forget the world kept on your device, on the same screen. A file you paid for is not in that list, because no copy of it is kept in your browser at all. Cookies and browser storage lists every entry and says which ones that button reaches.
• Delete your Clerk account. That removes your address and your session from Clerk, and Clerk tells us, so the crops saved against you go here too. You do not have to empty them first.
• A paid file goes on its own after ninety days, whether or not anybody asks. Polar keeps the receipt, because a seller has to.