Privacy policy

Who we are

Furrow CAM is an open source project run by Federico Vezzoli, who is responsible for the personal data described here. For questions or requests about your data, write to privacy@furrow.cam.

What we store

The only thing we ask you for is your email address. With your account we store:

• Your email address, to sign you in and to send you verification and password reset emails. We don't send newsletters or marketing.
• A hash of your password, never the password itself.
• Your sessions: for each device you sign in on, its IP address and browser user agent, so suspicious sign-ins can be spotted. A session is deleted when you sign out and expires after 7 days without use.
• Your projects, bits and machines: imported drawings and 3D models, operations and settings. Toolpaths and G-code are computed in your browser and never sent to us.
• When you first finished or skipped each guided tour, so it isn't shown to you again on another device.

We don't collect your name, a profile picture or any other personal details, and we don't use tracking cookies. The app sets a cookie for your session and one that remembers the workspace panel sizes, and keeps your light or dark theme choice in your browser's local storage.

Why we process it

• Your account data, sessions and projects: to provide the service you signed up for (performance of a contract).
• Request logs and page-view counts: to keep the service secure and working and to understand how it is used (legitimate interest).

Who processes it for us

• Vercel hosts the app, with its servers in Frankfurt (fra1). Its request logs include your IP address, user agent and the pages you request.
• Neon hosts our database, in Frankfurt (AWS eu-central-1).
• Cloudflare stores the 3D model files you import (Cloudflare R2), in a bucket restricted to the European Union. They are only reachable through short-lived links the app gives you.
• Resend sends our emails, so it sees your email address and the content of those emails.
• GoatCounter (goatcounter.com) counts page views, without cookies. It receives the page's route without any IDs (e.g. /projects/[id]), the website you came from (domain only, on your first page view), your screen size, and, with the request, your IP address and user agent. It uses these for country and browser statistics and doesn't store your IP address. Page views are not linked to your account.
• Have I Been Pwned checks whether a new password appears in known data breaches when you sign up or reset your password. Our server sends it only the first 5 characters of the password's SHA-1 hash, shared by hundreds of other passwords, and does the comparison itself. Neither your password, your email address nor your IP address is sent.

These providers may process data outside the European Union; their privacy policies describe the safeguards they use. We don't sell your data or share it with anyone else.

Exporting your data

You can export each project as a file from the projects page or the editor, and import it again here or elsewhere. For a copy of any other data we hold about you, write to privacy@furrow.cam.

Deleting your account

You can delete your account at any time from the Account menu in the app header, after confirming your password. Deletion is immediate and permanent: your email address, password hash, sessions, projects, bits and machines are removed from our database, and your 3D model files from our file storage. Deleting a project deletes its files too. Copies in our providers' logs and backups are deleted on their own schedules.

Your rights

Under the GDPR you can ask to access, correct, delete or export your personal data, to restrict or object to its processing, and you can complain to your data protection authority. Write to privacy@furrow.cam and we will answer within a month.

Changes

When this policy changes we update the date at the top. Its history is public in the GitHub repository.