Privacy policy
In effect from 24 October 2026.
In short
- The parts you design, their sizes, your jobs and the files you export are worked out in your browser and stay on your device. They are not sent to us.
- Every module works without an account. If you create one, we keep your email address and, through Supabase, a protected form of your password.
- We count visits with Cloudflare Web Analytics, which sets no cookies, and we count how the site is used (which modules are opened, which file formats are exported) without linking those counts to you or your account.
- We use no advertising and no tracking across sites, and we do not sell or rent personal data.
- You can ask to see, correct or delete your account data at any time.
1. Who we are
SheetMorph is a web application for developing flat patterns of sheet-metal parts. It is run by Sai Kumar, an individual based in India ("we", "us"). We decide how the personal data described here is used, which makes us its Data Fiduciary under the Digital Personal Data Protection Act, 2023 of India, and its controller under the GDPR and the UK GDPR for visitors in Europe and the United Kingdom.
You can reach us about anything in this policy at the contact address for privacy requests, which will be published in this section (it has not been set up yet).
This policy covers the SheetMorph website and application. It does not cover the websites of other services we link to, such as GitHub, which have policies of their own.
2. What we collect
We collect only what is needed to serve the site, to give you an account if you want one, and to understand how the site is used.
| What | When | Where it is kept |
|---|---|---|
| Your email address | When you create an account, ask for a sign-in link or ask to set a new password | Supabase, our account service |
| Your password, in a protected (hashed) form | When you create an account or set a new password. We never see the password itself | Supabase |
| Your name, email address and profile picture link from Google | Only if you choose "Continue with Google", where it is offered | Supabase |
| When your account was created and when you last signed in | As you use your account | Supabase |
| Technical records of requests to Supabase, such as the time, your IP address and your browser | When you sign in, sign out or use an account email link, and when a count of use is sent | The logs of Supabase |
| Counts of visits: the page visited, the page you came from, your country, the type of browser and device, and how quickly the page loaded | When you visit the published site | Cloudflare Web Analytics. It uses no cookies and keeps nothing in your browser |
| Counts of use: that a module was opened, that a pattern of your own was made in it, which file format was exported, that an account was asked for, and the message of any fault in the page, each with the version of the site. They hold no account, no IP address and none of the sizes you type | As you use the published site | Supabase, our account service |
| Technical records of visits, such as your IP address, the page asked for, your browser and the time | Whenever your browser loads the site | The logs of Netlify, which hosts the site |
We do not collect:
- The parts you design, their dimensions, materials, allowances, jobs, drawings or exported files. These are calculated in your browser and kept on your device (see "Storage on your device").
- Payment details. SheetMorph does not take payments.
- Information from advertising, tracking pixels, fingerprinting, cross-site tracking or similar tools. We do not use any.
- Sensitive information such as health, finances or government identifiers. Please do not send us any.
If you copy a link to a part from the workspace, the sizes of that part are written into the link itself. The link goes only where you send it.
3. How we use it
- To create your account, sign you in, keep you signed in and sign you out.
- To send the emails you ask for: confirming a new account, a sign-in link, or a link to set a new password. We do not send newsletters or marketing email.
- To keep the service safe: to stop misuse, such as automated sign-ups, and to look into problems with signing in.
- To serve the pages and files of the site to your browser.
- To understand which parts of SheetMorph are used, which files people need and what goes wrong, so that we can fix faults and decide what to build next. We look only at totals.
- To meet a legal obligation, if one applies.
We do not use your data for advertising, we do not build profiles of you, and no decision about you is made by automated means.
4. Why we may use it
Under the Digital Personal Data Protection Act, 2023, we process your account data on the basis of your consent, which you give when you create an account or sign in, and which you can withdraw at any time (see "Your rights"). Withdrawing consent does not affect what was done before. Every module can still be used without an account.
For visitors in Europe and the United Kingdom, the legal bases under the GDPR and the UK GDPR are:
- performance of a contract (Article 6(1)(b)): to provide the account you asked for and the emails it needs;
- legitimate interests (Article 6(1)(f)): to serve the site, to keep it secure and to count how it is used, an interest we balance against your rights by keeping only technical records and totals that are not linked to you, and only for as long as set out below;
- legal obligation (Article 6(1)(c)): where the law requires us to keep or disclose information.
5. Storage on your device and cookies
SheetMorph does not set cookies of its own. It keeps what it needs in the storage of your browser (local storage and session storage), on your device. This storage is not read by us and is not sent to us, except for the sign-in session, which your browser shows to Supabase to prove that you are signed in.
| What is kept | Why | How long |
|---|---|---|
| Your sign-in session with Supabase (access and refresh tokens and your basic account details), and a one-time code while a sign-in link is on its way | To keep you signed in, and to finish signing in from a link | Until you sign out, or until it expires |
| Your work: the inputs of each module and the last of them that gave a pattern, the presets you save, your jobs and pieces, your fabrication settings | So that your work is there when you come back | Until you clear it or clear the storage of your browser |
| Your choices: light or dark theme, the arrangement of the workspace (the views shown and the width of the inputs), the state of the module list, the sections of the inputs folded or left open, and the modules you pinned and opened last | To remember how you like the application, and to show your modules first | Until you clear the storage of your browser |
| Notes already seen: the tour of the workspace, the note about keyboard shortcuts, the last release you read about, and the offer to install SheetMorph, with the dates of your last two days on the site so that the offer waits for a second visit | So that they are not shown again, or too soon | Until you clear the storage of your browser |
| Where to go after signing in, a short note when a link could not be used, and a mark while a new password is being set | To finish signing in, and to ask for the new password before anything else | Until signing in or setting the password is done; the first two are in session storage and also go when the tab is closed |
| A copy of the files of the site (service worker cache) | So that the application opens without a connection once it has been opened | Until a newer version replaces it, or you clear the site data |
You can remove all of this at any time in the settings of your browser (clearing the site data for SheetMorph). Doing so signs you out and removes your work from that device, so export anything you want to keep first.
Cloudflare Web Analytics, which counts visits, sets no cookies and keeps nothing in your browser. Services of other companies may set cookies of their own when you use them: Google, on its own pages, if you choose "Continue with Google"; and Cloudflare, if the check described below is switched on. Those cookies are governed by the policies of those companies.
6. Services we use
We use a small number of service providers to run SheetMorph. They process personal data on our behalf and only for the purposes described here.
| Service | What it does for SheetMorph | What it receives | Its policy |
|---|---|---|---|
| Supabase | Keeps accounts, signs people in, and keeps the counts of use. Our project is hosted in an Asian region of Supabase | Account data, sign-in records and the counts of use, as above | supabase.com/privacy |
| Google (Gmail) | Sends the account emails you ask for | Your email address and the content of the email | policies.google.com/privacy |
| Netlify | Hosts the site and delivers its files | Technical records of each visit, as above | netlify.com/privacy |
| Google Sign-In | Lets you sign in with your Google account, where it is offered | Only if you use it: your Google sign-in, and Google tells us your name, email address and profile picture link | policies.google.com/privacy |
| Cloudflare Web Analytics | Counts visits to the published site, without cookies | The page visited, the page you came from, your browser and device, and your IP address, which Cloudflare uses to tell your country. Cloudflare states that it does not use this to track you or build a profile of you | cloudflare.com/privacypolicy |
| Cloudflare Turnstile | Checks that a sign-in or sign-up comes from a person and not a script. It is not switched on at present; if it is, it runs on the sign-in page only | Technical information about your browser and device that Cloudflare uses for the check | cloudflare.com/privacypolicy |
The links to "Report a problem" open GitHub, where any report you write is public and is governed by the GitHub General Privacy Statement.
7. Sharing
We do not sell, rent or trade personal data, and we do not share it for advertising. We share it only:
- with the service providers above, to run SheetMorph;
- where the law requires it, for example in answer to a lawful request from a court or a public authority;
- to protect the rights, safety or security of our users, of the public or of SheetMorph, where the law allows it.
8. Where your data is processed
Our Supabase project is hosted in Asia. Netlify, Cloudflare and Google run services in many countries, and may process data outside India and outside the country you are in, including in the United States. Each provider explains in its own policy, linked above, how it protects data it moves between countries. Under the Digital Personal Data Protection Act, 2023, transfers are made only to countries the Government of India has not restricted.
9. How long we keep it
- Account data is kept for as long as your account exists. When you ask us to delete your account, we delete it from Supabase.
- Technical records in the logs of Supabase and Netlify are kept for the periods those providers set, which we do not control, and are then deleted by them.
- Counts of use are kept for up to 13 months and then deleted. Cloudflare keeps its counts of visits for the period it sets.
- Account emails stay in your own mailbox, and in the sent mail of the account that sends them, until deleted.
- What is stored on your device stays there until you clear it (see "Storage on your device").
Under the Digital Personal Data Protection Act, 2023, we also erase account data once it is no longer needed for the purpose it was collected for, unless the law requires us to keep it.
10. How it is protected
- The site and the account service are reached over encrypted connections (HTTPS).
- Passwords are kept by Supabase in a hashed form, not as written, and are never visible to us.
- Signing in from an email link or with Google uses a one-time code that is bound to the browser it was asked for in (the PKCE method), so a link opened elsewhere cannot be used.
- Your designs and jobs are never sent over the network, so they are not exposed by it.
No method of sending or storing data is completely secure, and we cannot promise that data will never be lost or misused. If a breach of personal data occurs, we will inform the Data Protection Board of India and the people affected as the law requires, and the competent authorities in Europe or the United Kingdom where their law applies.
11. Your rights
Under the Digital Personal Data Protection Act, 2023, you have the right to:
- get a summary of the personal data we hold about you and of what we do with it, and to know who we have shared it with;
- have it corrected, completed or brought up to date;
- have it erased, which closes your account;
- withdraw your consent at any time, as easily as you gave it;
- have a grievance about how we handle your data dealt with by us;
- nominate someone to exercise these rights for you if you die or become unable to.
If you are in Europe or the United Kingdom, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection under the GDPR and the UK GDPR.
To use any of these rights, contact us at the contact address for privacy requests, which will be published in this section (it has not been set up yet), from the email address of your account if you can, so that we can confirm the request is yours. We answer without undue delay, and within one month where the GDPR applies. Using your rights is free.
You can also act on your own data straight away: sign out from the account menu, set a new password from the sign-in page, and clear the storage of your browser to remove everything kept on your device.
If we do not resolve your grievance, you may complain to the Data Protection Board of India, or, in Europe or the United Kingdom, to your local data protection authority.
12. Children
SheetMorph is a tool for adults working in fabrication and is not meant for children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18; if you believe a child has created an account, contact us and we will delete it.
13. Changes to this policy
We will update this policy when what we collect, or how we use it, changes. The date it took effect is shown at the top. If a change affects how your account data is used, we will say so on the site before it applies.
14. Contact and grievances
Questions, requests and complaints about privacy go to Sai Kumar, at the contact address for privacy requests, which will be published in this section (it has not been set up yet).
Problems with the application itself, which are not about personal data, can be reported on GitHub from the link at the foot of each page.