Privacy Policy
Effective 22 October 2026
What we collect when you sign in with Google
When you choose "Sign in with Google", Google shares your Google account ID, name, email address and profile picture with us. We ask for nothing else: no access to your Gmail, Drive, contacts or any other Google data. We use these only to identify your account and show who is signed in.
What we store
| Data | Why | Kept |
|---|---|---|
| Google account ID, name, email address, profile picture link | Identify your account and show who is signed in | Until you delete your account |
| Shapes you save: name, shape data, a small preview image, dates | Your My Shapes library on the web and in Blender | Until you delete the shape or your account |
| Sign-in sessions (stored only as one-way hashes) with created / last-used times | Keep you signed in | 30 days in the browser, 1 year for a linked Blender, or until you sign out, revoke the device or delete your account |
| Linked Blender devices: a label such as "Blender 5.1 on MY-PC" | So you can see and revoke linked Blenders | Until you revoke the device or delete your account |
| Pairing codes | Link Blender to your account | 10 minutes |
What stays on your device
- Your current scene, undo history, settings and any shapes you save while signed out are kept in your browser's local storage and never sent to us.
- The live link between the web bench and Blender runs only on your own computer (127.0.0.1); that traffic does not reach our servers.
- Sketch images you open are processed in your browser or in Blender.
Cookies
We set one essential cookie, df_session, only after you sign in. It keeps you signed in, is HttpOnly and Secure, and is removed when you sign out. Google's sign-in button may set its own cookies, governed by Google's policy. We use no analytics, advertising or tracking cookies.
Who processes the data
- Google - Sign in with Google (Google Identity Services) (privacy policy)
- Cloudflare - hosting, database (Cloudflare Pages and D1) and network security; like any web host it processes IP addresses and request logs (privacy policy)
- cdnjs (Cloudflare) - serves the open-source three.js library the page uses for 3D (privacy policy)
- Google Fonts - serves the Inter and JetBrains Mono fonts (privacy policy)
We share your data with no one else, except where the law requires it.
Google user data
Droplet Forge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Deleting your data
Signed in, open the account menu and choose "Delete my account": your account, all your saved shapes and every linked Blender are deleted immediately. Single shapes can be deleted from My Shapes, and linked Blenders revoked from "Link Blender". You can also email 4edesigner@gmail.com and we will delete your account and data within 30 days. You can remove Droplet Forge's access to your Google account at any time at myaccount.google.com/connections.
Security
All traffic to the website is encrypted (HTTPS). Session and device tokens are stored only as SHA-256 hashes. Blender devices get their own revocable tokens; your Google password is never seen by us or by Blender.
Children
Droplet Forge is not directed at children under 13, and we do not knowingly collect their data.
Changes
If we change this policy we will update the date above, and for significant changes show a notice in the app.
Contact
4E Virtual Design - 4edesigner@gmail.com