Privacy Policy

For information received through a merchant's Shopify store, the merchant is also responsible for its own collection and use of buyer information. Please read that merchant's privacy notice as well.

Account, profile, and authentication

We collect your email address, username, optional display name, photo and bio, account identifiers, authentication events, and settings. Passwords are hashed by our authentication provider; we do not store your readable password. If you use Apple or Google sign-in, we receive the identifiers and profile information that provider makes available under your settings.

Content, projects, community, and communications

We process designs, project files and versions, images, videos, mockups, prompts and AI outputs, posts, comments, likes, follows, bookmarks, reports, messages, reviews, and related metadata. Public profiles, marketplace listings, posts, comments, and reviews may be visible to anyone. Messages and support submissions may include information you choose to provide.

Purchases, subscriptions, marketplace, and fulfillment

We collect order and cart details, product and size selections, coupons, prices, payment and subscription identifiers, transaction status, buyer and recipient names, email, phone number, shipping address, tracking information, refund or dispute information, and communications about an order. Payment card numbers are collected by Stripe, Apple, or Google and are not stored in full by us.

Sellers also provide shop information, listings and designs, earnings and payout data, Stripe Connect account status, and optional advertising configuration. Stripe collects identity, bank, and tax information needed for seller verification and payouts.

Creator Rewards, email, and support

We process invitation and eligibility records, submitted post links, social platform, agreement version and acceptance time, reward or refund status, email preferences, unsubscribe records, support messages and attachments, and information needed to prevent fraud or duplicate rewards.

Device, activity, and diagnostics

We may collect IP address, browser and device type, operating system, app version, language, time zone, pages or screens used, event timestamps, referral information, approximate location inferred from IP, push notification token, crash information, and security logs. The editor also uses local storage and IndexedDB on your device to keep projects and preferences available.

Optional analytics and advertising data

If you consent where required, we and participating marketplace sellers may collect analytics and advertising events, page URLs, campaign information, browser identifiers, and Meta cookies such as _fbp or _fbc. Purchase events may include order value and a pseudonymous or hashed identifier. We do not send card numbers or the contents of your private projects to advertising platforms.

In the mobile apps, product analytics and attribution may also include a device or installation identifier, account identifier, email address, subscription status, app interactions, campaign attribution, and purchase events. Mobile product analytics does not record screen replays. On iOS, we do not link the AppsFlyer identifier to RevenueCat or product analytics unless the device reports that tracking permission is authorized.

Shopify integration

From merchants, we receive shop domain, authorized scopes and encrypted OAuth tokens, product, inventory, publication, fulfillment, and installation status. For relevant orders, Shopify may send buyer contact and shipping information, line items, totals, order identifiers, and fulfillment status.

• Directly from you when you create an account, design, post, buy, sell, or contact us.
• Automatically from your browser, device, and use of the Services.
• From Apple, Google, Stripe, RevenueCat, Shopify, and other services you connect.
• From marketplace sellers, fulfillment and shipping providers, or public posts you submit for a reward.

• Provide the Services and perform our contract: authenticate users, save projects, operate community and AI tools, process subscriptions and orders, fulfill products, support sellers, and issue rewards or refunds.
• Legitimate interests: secure the Services, prevent fraud and abuse, troubleshoot, measure non-advertising service performance, enforce our terms, and protect users and our legal rights.
• Consent: optional analytics, advertising technologies, and marketing where consent is required. You may withdraw consent at any time.
• Legal obligations: accounting, tax, sanctions, payment, consumer protection, privacy requests, law-enforcement requests, and dispute records.
• Protect vital interests and safety: investigate threats, exploitation, nonconsensual intimate imagery, and emergencies where permitted by law.

We disclose only the information reasonably needed for the following purposes:

• Infrastructure: Supabase, Vercel, Cloudflare R2, and Cloudinary provide authentication, database, hosting, storage, and media delivery.
• Payments and subscriptions: Stripe and Stripe Connect, RevenueCat, Apple, and Google process payments, subscriptions, seller verification, fraud checks, and payouts.
• Production and delivery: Printful, Shopify, shipment-tracking providers, carriers, and address-validation services receive the order information required to produce, route, and deliver an order.
• AI features and support tools: depending on the feature, prompts, uploads, outputs, or support context may be processed by OpenAI, Google Gemini, Runware, WaveSpeed, or Anthropic. Do not submit sensitive third-party information unless you have authority to do so.
• Communications: Resend, Gmail APIs, and Expo push services deliver transactional email, support messages, and notifications.
• Analytics, diagnostics, and attribution: with the required choice, permission, or consent, PostHog, Mixpanel, Google Analytics, Meta, AppsFlyer, and AppStack may receive the optional analytics and attribution data described above. Sentry receives limited crash and performance diagnostics. A marketplace seller's configured Meta tools receive optional advertising events only when the required website consent evidence exists.
• Legal and safety: we may disclose information to comply with law, protect rights and safety, investigate fraud, or establish and defend legal claims.
• Business transfers: information may transfer as part of a financing, merger, acquisition, reorganization, or sale, subject to applicable law.

Some recipients, including payment platforms, app stores, connected sellers, and social platforms, may act as independent controllers under their own privacy notices.

On the website, essential storage is used for authentication, security, cart state, editor projects, and your privacy choice. Optional website analytics and advertising tools are disabled until the required consent is present. You can accept, reject, or later reopen the persistent “Cookie preferences” control. The mobile apps also use product analytics, crash diagnostics, and attribution SDKs as described above and request device-level tracking permission where required. Rejecting optional tracking does not prevent purchases, payouts, project editing, or other core features.

We do not sell personal information for money. Some advertising disclosures may be considered a “sale,” “sharing,” or targeted advertising under certain U.S. state laws. You may opt out by rejecting advertising in Privacy choices or emailing us. Where legally required and technically supported, we also treat a Global Privacy Control signal as an opt-out for that browser.

See our Cookie & Tracking Notice for the categories and controls used on the website.

Public profiles, listings, posts, comments, reviews, follower relationships, and content you intentionally publish can be viewed, copied, or reshared by others. Do not post personal or confidential information that you do not want made public.

Marketplace sellers may receive the order details needed to support a sale. Sellers must use buyer information only for the transaction, support, legal compliance, and other uses disclosed with a valid legal basis. Their independent conduct is also governed by our Marketplace & Seller Terms.

We retain information only for as long as reasonably necessary for the purposes described here. Account and project data generally remains while your account is active. Security, consent, support, and diagnostic records are kept for a limited period based on risk and operational need. Unsubscribe and suppression records may be retained so we do not contact you again.

Order, payment, payout, tax, licensing, fraud, safety, and dispute records may be retained after account deletion for the period required by law or reasonably needed to complete an order, honor a license already granted, prevent abuse, or establish and defend legal claims. We minimize or de-identify those records when the identifying data is no longer needed.

You can request deletion in the mobile app's account settings or at Account Deletion. After verifying the request, we delete the account and associated information that we are not required to keep and remove or de-identify public profile associations. Copies may persist temporarily in protected backups until their normal rotation.

Deleting your 3DMockups account does not cancel a subscription billed by Apple or Google; manage that subscription with the store that billed you. Deletion also does not cancel an order already in production or shipment, but we retain only the information needed to complete or resolve it.

Depending on where you live, you may have rights to access, know, correct, delete, or obtain a portable copy of personal information; object to or restrict processing; withdraw consent; opt out of sale, sharing, or targeted advertising; appeal a denied request; and receive equal service for exercising a privacy right. Authorized agents may submit requests where applicable.

Use the in-product controls or email support@3dmockups.app. We may verify your identity and authority before fulfilling a request. You may also complain to your local data protection authority.

The Services are not directed to children under 13, and we do not knowingly collect their personal information. Users from 13 to 17 may use general features only with permission of a parent or legal guardian where required. Selling, receiving payouts, and participating in Creator Rewards are limited to users who are at least 18. We do not knowingly use personal information of users under 16 for targeted advertising.

Contact us if you believe a child provided information without the required permission.

We are based in the United States and our providers operate in multiple countries. Where required, we use recognized transfer safeguards or another lawful transfer mechanism.

We use reasonable safeguards appropriate to the nature of the information, including TLS in transit, password hashing, encryption for selected credentials, access controls, signed webhooks, and authentication. No service can guarantee absolute security. Please protect your credentials and tell us promptly about suspected unauthorized access.

We verify Shopify compliance webhooks before processing them. A Shopify buyer data request is placed into a restricted review workflow so responsive records can be returned through the merchant. A valid customer or shop redaction request deletes, minimizes, or irreversibly de-identifies local buyer or installation data, except transaction or legal records that may lawfully be retained. We do not enroll Shopify buyers in 3DMockups marketing merely because their order was fulfilled through the integration.

We may update this policy as the Services or law changes. We will change the effective date and provide additional notice or request consent when legally required.

Privacy questions or requests: support@3dmockups.app, 3DMOCKUPS LLC, 3a Stony Hill Ln, West Nyack, New York 10994, United States.