What OwlCAD collects, why, and which providers process it, plus your choices. We never sell personal information or use your models or prompts to train AI.
Last updated October 4, 2026. This policy explains what information OwlCAD collects, how it's used, and the choices you have. OwlCAD is operated by Spare Matter Corp (Ontario, Canada). We aim to collect as little as possible, and we never sell your personal information or use your content — or your child's — to train AI models.
Spare Matter Corp, 75 Bayly St W, Ste 15 #844, Ajax, ON L1S 7K7, Canada, is the company responsible for the personal information described in this policy. Our Privacy Officer is accountable for our compliance with it.
For a privacy question or request — access, correction, deletion, a copy of your data, or a question from a parent, guardian, or school — use our Contact page and choose "Privacy request", or write to privacy@owlcad.com. Both reach the same place.
Account information: when you create an account, we store the email address and authentication details provided by your sign-in method (email/password, or a connected Google or GitHub account, which also provides your display name and profile photo). You can start modeling without an account, in which case we create a temporary anonymous session. Work you save is stored against that session, and a session left unused for 30 days is deleted together with everything saved in it.
Project data: the 3D models you create, their metadata (names, timestamps), thumbnails, and — if you use collaboration — comments you post. These are stored so you can return to your work across sessions.
AI data: when you use AI generation, the text prompt you enter (and a reference image, if you provide one) is sent to our generation provider to produce a model, and the prompt and result are stored in your generation history so you can reuse them. Our other AI features work the same way, and each sends the context it needs to answer: a question you type into the "Ask OwlCAD" help assistant is sent with your last few questions in that conversation and which part of the app you have open; a request to "Modify with AI" is sent with a summary of the objects in your model — their names, types, parameters and positions — and your earlier instructions in that conversation; and a request to the Customizer AI is sent with a summary of the adjustable parameters in the model you have open. No AI feature is ever available to student accounts (see "Children's and student privacy").
Provider API keys you choose to connect: if you bring your own AI provider key so that generation runs on your own provider account, we store that key encrypted with Google Cloud KMS and never return it to you or anyone else — the settings page shows only its last four characters. We use it for nothing but the requests you ask for. Removing it from Account settings deletes it.
Access tokens you create: if you mint a personal access token so an AI agent or script can drive OwlCAD through our MCP server, we store only a one-way hash of the token — never the token itself — alongside the name, permissions, and expiry you chose. Revoking a token disables it immediately; we keep the record of it (never the token) until you delete your account, so a question such as "was this token used after it leaked?" can still be answered.
Classroom and student data: when OwlCAD is used in a classroom, a teacher creates a class and students join with a class code from their teacher. A managed student account is deliberately pseudonymous: the only personal information we collect from a student is a display name they choose — no email address, no real name, and no date of birth. For a student we also store their CAD work, the assignments their teacher sets and the work they submit, and their membership in the class.
Billing information: if you subscribe to OwlCAD Pro, buy additional AI credits, fund a school credit pool, or make a donation, your payment is processed by Stripe, our payment processor. Stripe collects your payment details directly — we do not receive or store your full card number. We store your subscription status, your credit balance, and the customer and subscription identifiers Stripe assigns to us, so we can provide and manage your plan.
IP address: when your browser contacts our servers we receive its IP address. We use it to stop abuse (short-lived rate limits, deleted within 7 days), to let Cloudflare Turnstile check that a request comes from a real browser, and — only if you accept analytics — to estimate your approximate location (country or city) in our product analytics. We do not use it to identify you. Our hosting provider also records it in server logs as part of running and securing the service.
When you contact us: a message you send through our Contact page — your name, email address, and message — is checked by Cloudflare Turnstile, passed to our email system, and deleted from our database after 30 days. The email it produces stays in our support mailbox so we can follow up. Feedback and bug reports you send from inside the app, with any screenshot you choose to attach, are kept with your account and deleted when you delete it.
Local data: while you model, your work is also cached in your browser (IndexedDB) so a refresh never loses progress. This stays on your device.
Technical and usage data collected in your browser: limited product analytics — the pages you visit and when you leave them, where you came from (the referring site and any campaign tag in the link), the features you use (for example, which export formats), page-speed and responsiveness measurements — plus a report when something fails unexpectedly, containing the error message, the technical trace of where it happened, the address of the page (with class, sign-in, and invitation codes, tokens, and email addresses removed from it, as on every analytics event), and details of your browser and graphics hardware. This path does not use cookies: after you accept, it stores a random analytics identifier in your browser's local storage. It is not tied to your name or email, but it is not anonymous either — some events carry the identifier of the project they are about, and when you buy a plan, credits, or make a donation the browser identifier is passed along so the purchase can be matched to the visit that led to it. It honors your browser's Do Not Track and Global Privacy Control signals, and it loads only after you accept analytics in our consent banner. Decline, and nothing is loaded and nothing is sent. You can change your mind at any time from "Privacy choices" at the foot of our pages or in Account settings: withdrawing stops analytics immediately and removes the analytics identifier from your browser.
Technical and usage data recorded by our servers: separately, our backend records a small, fixed set of operational events covering things a browser cannot reliably report — an account being created (with the sign-in method used and your language, never your email); an AI generation being created, succeeding, or failing; a project being created, or made public; a checkout starting, and a payment, credit purchase, school credit purchase, or donation completing or failing; and requests made by an AI agent through our MCP server (which tool was called, how long it took, and why a request was refused) — along with server-side error reports. Because their purpose is to tell us whether the service is actually working for a particular account, and to bill it correctly, these events carry your account identifier and are not governed by the analytics consent banner. They are a record of the event, not of your content: they never include your models, your prompts, or your generated results. Student sessions are excluded from both paths: a student session loads no browser analytics at all, and our servers drop any event about a student account through a check that is deliberately fail-closed, discarding the event if it cannot confirm the account is not a student's. If an operation on a student account fails, we still record the error so we can fix it, but without the account's identifier.
Security and anti-abuse checks: to confirm that requests come from a real browser rather than an automated script, we run Cloudflare Turnstile — an invisible challenge that requires no interaction from you. It processes limited technical signals about your browser and session for this purpose only. We chose Turnstile deliberately over alternatives that profile visitors across the web: it sets no tracking cookies and is not used to build an advertising or behavioral profile of you. See "Bot and abuse prevention" below.
We use your information only to provide the editor, save and sync your projects, run the AI features you invoke, generate the share links you create, serve requests made by agents you have authorized, take payment for the plan or credits you buy, operate and secure the service, and respond to support requests.
We do not sell your personal information. We do not serve targeted advertising. We do not build advertising or non-educational profiles of you, and we do not use your content, prompts, or generated models to train or fine-tune artificial-intelligence models — ours or our providers'. The one case where that is not ours to promise is when you connect your own provider key: the request then runs under your agreement with that provider, and a few of the providers you can reach that way do permit training on what is submitted. We name which before you add a key, and we never route our own traffic to them (see "Connecting your own AI provider key").
For student data, we act only as a service provider to the school: we use it solely to provide the educational service the school has engaged us for, and never for advertising, never to build a profile, and never to train AI. Product analytics are turned off entirely for student sessions — a student account loads no analytics at all.
We use a small number of third-party "subprocessors" to run the service. They process data on our behalf, under contracts that restrict their use of it to providing their service to us: Google Firebase (authentication, database, file storage, compute, and hosting — its sign-in service loads Google scripts on the pages that use your account, as part of signing you in); our AI providers (below); Google Workspace (to send transactional email — sign-up and email verification, password resets, collaboration and class invitations, billing notices, and the outcome of a moderation review — and to process delivery failures: when an email to you bounces, we record the address for up to 180 days so we stop sending to it); Stripe (to process subscriptions, credit purchases, school credit packs, and donations); Cloudflare (bot and abuse prevention — see "Bot and abuse prevention" below); and PostHog (product analytics and error reporting, as described above).
Which AI provider receives a request depends on the model you choose. Requests run by us reach the model's provider directly: Google (Gemini), OpenAI, and Anthropic (Claude) for generation, Google (Gemini) for our assistants, and Tripo for 3D-mesh generation from text or an image (our requests do not reach Meshy: it receives a request only when you connect your own Meshy key, as described below). Where we do not hold a direct connection to a model's provider, we route the request through OpenRouter, a service that forwards it to the model's provider or to an authorized host of that model (such as a major cloud provider); where we do, we instruct it to route only to hosts that do not retain or train on the submitted prompt. We send the text prompt and, for the image-capable models, a reference image you supply — never your name, email, or account identifier. This list is complete for the requests we run, and we update this policy when it changes. If you connect your own key, the request goes to the provider that key belongs to instead (see "Connecting your own AI provider key").
We instruct our providers not to use submitted content to train their models, and we do not enable any training-on-customer-data feature. Where a provider's own terms permit training on submitted content, we do not fund that model at all — it is available only if you connect your own key, and we warn you before you do (see "Connecting your own AI provider key").
AI in classrooms is teacher-only: students never invoke an AI model, and no student prompt, image, or content is ever sent to an AI provider. Because of this, there are no AI subprocessors for student data — an adult teacher is the only person who can run a generation, and they do so under their own account.
If you hold an account with an AI provider, you can connect your own API key so that AI features run on your account instead of ours. This changes who the provider is dealing with: your prompt is sent under your own account and your own agreement with that provider, and how they handle it — including whether they train on it — is governed by the plan you hold with them, not by our arrangements. Some providers we make available this way do permit training on submitted content; we tell you which before you add a key.
Connecting a key can also shorten the chain. Where the provider you bring a key for can be reached directly, we send your request straight to them — including for models our own requests would otherwise route through a service like OpenRouter, so the router is not involved in your request at all and one company fewer sees your prompt. If the key you connect is itself for a routing service, your requests go through it, on your account.
We store your key encrypted with Google Cloud KMS, decrypt it only inside our backend to make a request you asked for, and never expose it to the client, to other users, or in any export. We never send your name, email, or account identifier alongside it. You can replace or delete the key at any time from Account settings, and deleting your account deletes it.
This feature is not available to student accounts, and no student content is ever sent to a provider under any key.
You can let an AI agent or a script work on your projects on your behalf through our hosted MCP server at mcp.owlcad.com. There are two ways to do this: connect an AI assistant, such as ChatGPT or Claude, by signing in to OwlCAD in your browser and approving the permissions it asks for; or mint a personal access token in Account settings and give it to the agent.
When you connect an assistant, it sends us requests on your behalf, and whatever it reads back (your models, project names, and the results of checks and exports) passes to that assistant's provider. How that provider handles it is governed by your agreement with them, not by ours. A connected assistant holds the same powers as a token with the permissions you approved, and everything below about what a token can do applies to it. You can see every connected assistant, and disconnect it, under Account settings → Access tokens; disconnecting takes effect immediately.
A token acts as you, limited to the permissions and expiry you choose when you create it. Whatever tool you give it to can read, and — if you granted write permission — create, change, export, and share the projects in your account, and can spend AI credits from your balance. We cannot tell whether a given request came from you or from a tool you authorized, and we have no control over what a third-party agent does with the data it reads. Treat a token like a password: give it only to software you trust, grant the narrowest permission that works, and revoke it in Account settings when you are done. Revocation takes effect immediately.
We store only a one-way hash of each token, so a token cannot be recovered from our systems — if you lose it, mint a new one. We log the requests an agent makes for security, abuse prevention, and rate limiting, and cap the number of calls a token may make per day. Agent access requires a Pro plan and is not available to student accounts: a student account cannot create an access token or connect an app.
To protect the service from automated abuse — scripted account creation, scraping, and attacks that would degrade it for everyone — we use Cloudflare Turnstile to verify that a request comes from a genuine browser. Turnstile runs invisibly: there is nothing to click, and in almost all cases you will never notice it.
Turnstile processes limited technical information about your browser and session to make that determination. Cloudflare acts as our service provider for this purpose and does not use the information to build an advertising profile or track you across unrelated websites. Cloudflare describes its handling of this data in the Cloudflare Turnstile Privacy Addendum, available at https://www.cloudflare.com/en-gb/turnstile-privacy-policy/ — please review it alongside this policy.
This check is a security measure, not analytics: it runs so the service stays available and safe, and it is independent of the analytics consent choice you make in our banner. We selected Turnstile specifically because the common alternatives rely on cross-site behavioral profiling, which we were not willing to apply to our users — including students.
OwlCAD supports classroom use by K-12 students, including students under 13, through a school-consent model. We design the classroom experience to be safe by default, with the aim of meeting our obligations under applicable children's and student-privacy laws, such as the U.S. Children's Online Privacy Protection Act (COPPA) and FERPA, U.S. state student-privacy laws, the UK Age Appropriate Design Code and UK GDPR, the EU GDPR (including the Article 8 age of digital consent), and Canadian law including PIPEDA and Quebec's Law 25.
Pseudonymous, data-minimized student accounts: a student account is managed by the school and is pseudonymous by design. We collect only a display name from a student — no email, no real name, no date of birth — and we treat every student account as a minor by default. The only other data tied to a student is the CAD work they make and the class and assignments they are part of.
No student data goes to AI providers: AI generation is teacher-only. Students never invoke an AI model, and no student content is ever sent to a third-party AI provider — the single most important protection in our design, and the reason there are no AI subprocessors for student data.
Other safe-by-default protections for students: product analytics are switched off for student sessions; no student image is ever sent to an AI provider; and student work is private to the class — it can never be made public, published to a share link, or surfaced in our public gallery, and that protection cannot be overridden by the student. Sharing among classmates is class-scoped and moderated by the teacher.
School and district consent: persistent classroom use, especially by students under 13, is authorized at the school or district level — by an administrator who accepts these terms on the school's behalf — not by an individual teacher's checkbox. In that model the school may provide consent on behalf of parents for student information used solely for the educational purpose and for no commercial purpose; we act as a service provider / processor to the school, use student data only to provide the service, and delete it on the school's instruction.
School control and rights: a school administrator can review and export the student data we hold for their school in the app, and can ask us to delete it at any time, which we do promptly. Removing a student or deleting a class permanently deletes the corresponding student accounts and their projects, and archived classes are purged automatically 12 months after they are archived (see "Data retention and deletion"). A parent or guardian may exercise these rights through their school, or by contacting us through our Contact page.
Direct sign-up by a minor outside a classroom: OwlCAD's general (non-classroom) editor is not directed at children under 13. If you are below the age of digital consent in your country, you must have a parent, guardian, or school agree to these policies on your behalf before creating a general account. We do not knowingly collect personal information from a child under 13 outside the school-consent model; if we learn we have, we will delete it.
Projects are private by default, and become visible to someone else only through a step you take. There are several, and they differ in reach. A share link makes that one project viewable by anyone holding the link, and it may be embedded; you can stop sharing at any time, which makes it private again. Inviting a collaborator, a team, or a folder member gives named people continuing access to the projects you shared with them — adding someone by email tells us that address. The owner of a team or folder (and a team's admins) can see the email addresses of its members; other members see their display names, so they know who they are working with. A folder can also be made publicly listable, which exposes the names and thumbnails of the projects in it to anyone with its link.
Publishing to our public gallery is a separate, deliberate act — it is not a side effect of creating a share link. When you publish, the model, the name and description you write, and its thumbnail (and, for a community part, the display name it is credited to) are submitted to a moderated queue, and once approved they are public: anyone can view the model, like it, comment on it, and remix it into their own editable copy, and search engines may index the page. We email you the outcome of the review. You can unpublish a model, which removes it from the gallery — copies other people already remixed remain theirs. Unpublishing does not turn off the model's share link: anyone who has the link can still open it until you stop sharing it. Contributing a part to our community parts catalogue works the same way, including the review email.
Student work is never public. Work a student creates in a class is shared only within that class and is moderated by the teacher; a student account cannot publish a share link, post public comments, or have their work appear in our public gallery. Our public gallery never surfaces work owned by a student.
Please do not include personal information (such as a full name) in project names, descriptions, or comments you make public — and students should choose a display name that does not reveal their identity. You can report content you believe is unsafe or inappropriate using the in-product report control, and we will review it.
We retain your account and project data while your account is active. Successful AI generations stay in your history until you delete them; the record of a generation that failed is deleted after 30 days. We do not retain personal information indefinitely when it is no longer needed to provide the service. The other periods we apply are:
An anonymous session: 30 days after it was last used. Contact-form messages in our database: 30 days. Rate-limit records keyed by IP address: 7 days. A record that an email to your address bounced: 180 days after the last bounce. Ratings and comments you leave on AI results: 12 months after you last changed them. An archived class and the student data in it: 12 months after it was archived. Our server logs: 30 days.
You can delete individual projects at any time. You can delete your entire account from Account settings, which permanently removes your projects and their files, your AI generation history, comments you have posted, your team memberships, any connected provider key, any access tokens you minted, feedback and AI ratings you sent us, your consent record, and your profile, and then deletes your sign-in. Community parts you contributed stay in the library, credited to "OwlCAD user" and no longer linked to you, and reports you filed about other people's content are kept for moderation without your identity. This cannot be undone.
Deletion removes your data from our live systems immediately. Copies in our backups expire on their own within about 14 days. We keep billing records (such as invoices, credit purchases, and payment-failure notices) as required for financial and legal recordkeeping, and security logs for their 30-day retention. Emails you exchanged with us remain in our support mailbox. The operational events recorded with your account identifier (see "Technical and usage data recorded by our servers") are deleted from our analytics processor too, which carries out the deletion in the background shortly afterwards. Browser analytics is not tied to your account, with one exception: if a purchase of a plan or credits, or a donation, carried your browser analytics identifier (see "Technical and usage data collected in your browser"), the analytics recorded under that identifier is deleted as well — including anything else recorded under it in that browser.
If you subscribe to Pro or give a recurring donation, deleting your account also cancels it and stops future charges; you can also cancel at any time from the billing portal without deleting your account. Stripe and we may retain limited billing records (such as invoices) as required for financial, tax, and legal recordkeeping.
Classrooms and students: a teacher or school administrator can remove a student, or archive or delete a class. Deleting a class permanently removes its student accounts and every project owned by those students. Archived classes — and the pseudonymous student data within them — are purged automatically 12 months after they are archived. Schools may request review, export, or deletion of student data at any time, and we delete student data on the school's instruction. For any deletion or data request you cannot complete in the app, contact us through our Contact page.
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. You can exercise the most common of these directly in the app: edit your profile, delete individual projects, delete your account, and — from Account settings — download a copy of the personal data we hold for you as a JSON file, covering your profile and preferences, plan, credit purchases and billing notices, project list and projects shared with you, AI prompt history, comments, likes, gallery listings, part submissions, team, folder, and class memberships, invitations, feedback and AI ratings you sent, reports you filed, connected provider keys (the last four characters only), access tokens and connected apps (never the secrets), and consent record. The models themselves are exportable per project from the editor in STL, 3MF, or STEP.
To make any other request, or to ask a question about this policy, contact us through our Contact page (choose "Privacy request") or write to privacy@owlcad.com. We will respond as required by applicable law. You also have the right to lodge a complaint with your local data protection authority.
We and our service providers may process and store data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for these transfers.
We protect your information with encryption in transit and at rest, access controls, and least-privilege rules enforced by our backend. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you and the relevant authorities of a breach as required by law.
We may update this policy as the product evolves. When changes are material, we will update the version date above and tell account holders by email or in the app before they take effect, and ask you to review the updated policy where the law requires it.
Questions about privacy, or requests from parents, guardians, or schools, can be sent through our Contact page (choose "Privacy request") or to privacy@owlcad.com, and reach our Privacy Officer.