Privacy Policy - STL Diff

STL Diff Online has three workflows, and they handle your data differently:

The free in-browser diff - the tool on the Free Diff Tool page. Your model files never leave your browser: the whole comparison runs in JavaScript and a Web Worker on your own machine. We never receive your geometry, filenames, or model contents. Comparing two models needs no account and uploads nothing.
Comparing a third model in the same tab asks you to sign in with a free account - the files still stay in your browser, and the section below says exactly what that sign-in involves.
Projects and revisions - the signed-in Project workspace. To give you revision history and instant diffs, the model files you upload to a project are stored on our servers. This part is account-based and opt-in - it only applies once you sign in and create a project.
Share for review - turning a comparison into a link someone else can open. This is the one place where a comparison you started in the browser is uploaded to our servers, because the person you send it to has to be able to open it on their own machine. It is opt-in and per-comparison: nothing leaves your browser unless you press Share for review and confirm, and the link expires on its own.

The free tool: what we don't collect

Model file contents or geometry (parsed and diffed locally in your browser).
Model filenames.
Content hashes of your files. We compute a SHA-256 of each file in your browser to detect when the two sides are byte-for-byte identical, but the hash itself is never transmitted or stored.
Your IP address (beyond transient use for spam protection - see below).
Cookies for tracking, advertising, or third-party analytics.

The free tool: anonymous telemetry we do collect

To understand whether the tool is useful and to keep it running, we record a small amount of anonymous, non-identifying telemetry:

Two anonymous ids - a persistent device id (a random UUID in localStorage) and an ephemeral session id (a random UUID in sessionStorage that resets when you close the tab). Together they let us tell "one person did five diffs" from "five people each did one" and estimate how many people use the tool day to day - without knowing who you are. Clearing your browser storage resets the device id.
Diff metrics - for each comparison (whether it succeeds or fails) we log a small set of anonymous, non-identifying numbers: the byte sizes of the two files, how long the compare took, the triangle counts, which format each file was (binary or ASCII STL, OBJ or 3MF), the volumetric percentage that changed and the added/removed volumes, the voxel resolution and alignment mode, a success/failure flag with a coarse error category, a "files are byte-for-byte identical" flag, the source (your upload vs the built-in example), your timezone offset and the app version - plus a timestamp. Never the contents, the geometry, or the filenames.
Site navigation events - the page category, named section or named control that was viewed or clicked, the interface language, the source and destination paths without query strings, whether the session was signed in, a tab-scoped random session id and a timestamp. Event names come from a fixed allowlist. We do not store arbitrary page text, referrers, review tokens, user ids, email addresses or IP addresses in these rows.
Optional satisfaction rating - if you rate a comparison via the popover, we save the 1-5 star value, the optional pre-defined complaint reasons, and your optional "Tell us more" free-text note.
Feedback messages - anything you type into the /feedback form on this site. If you provided an email, it is stored alongside the message so we can reply.

The free tool: the third model and the sign-in it asks for

The Free Diff Tool can compare three models at once - A → B, B → C and C → A. That one feature asks you to sign in with a free account. Nothing else about it changes: the third comparison is computed and drawn in your browser exactly like the first two, and none of the three files is ever uploaded, signed in or not.

Signing in reloads the page, which would otherwise lose the two models you already had open. So when you press Sign in, a copy of them is put aside in this browser, on this computer - never on a server, not even in passing. What is put aside is the two files, the colour scheme you were using and the fact that you asked for a third model, and nothing else: no comparison result is stored, and no other part of the page is either. If this browser will not hold them - a private window, no room left - we say so and let you choose whether to sign in anyway; nothing is uploaded either way.

That copy is used once. When you come back signed in, it goes straight into the page and is deleted in the same move, so it can never be restored a second time or in a second tab. If the sign-in does not finish - you change your mind, or we cannot tell whether it worked - the copy is deliberately left where it is, so your work is still there when you try again.

How the half hour actually works. The copy is stamped with a time thirty minutes ahead. That stamp is checked when the copy is read and again the next time this site is opened in that browser; anything past it is refused and deleted at that moment. Nothing of ours runs while the browser is closed, so the copy does not disappear by itself thirty minutes later - if you close the tab in the middle of signing in, it sits in that browser's storage until something opens this site again and the check runs. On a shared or public computer that is the part worth knowing: finish the sign-in, or clear this site's storage before you walk away.

What the sign-in itself counts. Four numbers on our side, and each row we store is a day, a name and a count: the third-model offer was shown, someone pressed Sign in, a sign-in came back finished, and an account was created along the way. There is no identifier of any kind in those rows - not yours, not your browser's - and no time finer than the date, so nobody can be picked back out of them. The request your browser sends to raise one carries a single word, the name of the counter. So that the last two can be counted at all, the sign-in link says which button started it - that one word, and nothing about you or your files.

Projects: what we store when you sign in

The Project workspace is account-based, so this part is not anonymous. When you sign in and use projects we store:

Your account - you sign in through a third-party identity provider. We receive the identifier and basic profile the provider returns (such as your name or handle and email) and use it to identify your account. We never see your password.
Your uploaded models - the model files you upload to a project, their geometry, revision numbers, names and any comments you write. These are stored server-side so we can show revision history and cache diffs between revisions.
Collaborators - if you invite someone to a project, we store that grant (who has viewer or editor access) so they can open it.
Invitations to people without an account - if the address you invite has never signed in, there is no account to grant access to yet, so we store the invitation itself: the email address, the role you chose, who invited it, when it expires, and the message we send. That address is also passed to our email provider to deliver the invitation. The invitation is tied to the address and grants access only when someone signs in with it - forwarding the message hands over nothing. It expires by itself after 7 days, you can revoke it at any time, and the stored message is discarded as soon as the invitation is claimed or revoked. Deleting the project deletes its invitations with it.

Your projects are private by default - visible only to you and the collaborators you explicitly invite. We do not make them public, index them, or share them with anyone else.

Share for review: what a link holds

A review is the one thing here that is deliberately readable by someone who has no account. When you share a comparison we store both models, their filenames and sizes, the settings the comparison was computed with, and the decision that comes back - an approve or a request for changes, plus whatever name and comment the reviewer typed about themselves. We do not verify that name, ask the reviewer to sign in, or record their IP address or device: a review decision is a message from a person you already know, not an electronic signature.

The link itself is the access. Anyone who has it can open the review and answer once, so treat it the way you would treat a link to a private file - send it to the person who needs it and no further. We keep review links out of search engines. You can revoke a link at any moment, which stops it opening for everyone immediately. We count how many times a review has been opened, roughly and without identifying anyone, so you can tell whether it has been looked at yet.

A review created while signed out lives in the browser that made it: the key that revokes it is stored only there, and we cannot recover it for you. Signing in offers to move those reviews into your account, which is what makes them survive a cleared browser.

If you choose Send email, we store the recipient address, invitation text and sending result with the review to handle retries without duplicate invitations. Resend processes that address and the public review link to deliver the email. The private manage token and model attachments are never included. These records stay with the review; you can request their removal through our feedback form. Addresses that bounce or report spam are retained separately to prevent further invitations, and can also be removed on request. They are not used for marketing or analytics.

If a project owner enables Notifications, we send project updates through Resend to the owner and all participants with an email address, including the person making the change. Emails contain the project and revision names and a link, never model files. A project that also reviews new revisions sends the same kind of update when one is proposed, approved, rejected or sent back for changes. Queued updates recheck project access before sending; a project-deletion notice goes to its final participants. The owner can switch Notifications off in the project's three-dot menu. Notification records, including snapshots needed after a project is deleted, are removed after 14 days while the service is running.

Language preferences

Your selected interface language is stored in this browser. When you are signed in, we also save your choice in your account. The language saved with a queued notification or invitation stays fixed for retries; changing your account language affects future messages. We include the interface language in allowlisted site navigation events, but do not send your browser's full language list.

Spam protection

We use your IP address transiently to prevent spam and abuse - rate-limiting public forms, site-event batches and the creation and upload of reviews, and review invitation emails. Your IP address is never stored alongside your submission, and any short-lived value we keep for abuse prevention is one-way and deleted within about a day.

How long we keep things

Anonymous diff events: kept indefinitely in aggregate form.
Allowlisted site navigation events: kept for aggregate product analysis.
The copy of A and B set aside for a sign-in: half an hour, checked when it is read and when the site is next opened in that browser, and removed the moment the two models go back on your screen. It never reaches us, so there is nothing on our side to keep or to delete.
Feedback messages with an email attached: kept until we reply, or for at most 90 days, whichever comes first.
Anonymous feedback (no email): kept indefinitely as product feedback.
Premium waitlist emails: kept until Premium billing opens and we send the launch email, then deleted.
Premium account data and uploaded models: kept until you delete them - remove a revision or a project, or ask us to close your account, and they're deleted from active storage.
Review links: seven days on the free plan, thirty on Pro, extendable on a paid plan, and revocable by you at any time. Shortly after a link expires the models are deleted; the record of what was decided and when stays, because "expired" should not mean "never happened".
Billing records: invoices and payment records are held by Stripe for as long as tax and accounting law requires. What we keep is a small copy of your subscription's current state - listed under Payments below - which is replaced each time Stripe tells us it changed and is deleted with your account.
Abuse-prevention values: short-lived and one-way, deleted within about a day, and not linked to anything you submitted.

Payments

Subscriptions are processed by Stripe. Card details are entered on Stripe's own pages and never reach our servers - we never see or store a card number, and the billing address you give at checkout is held by Stripe, which uses it to work out the tax due in your country. What we store is a copy of your subscription as Stripe describes it - your Stripe customer and subscription ids, the price id, whether it is monthly or yearly, the amount and currency of that price, whether a promotion code applies, the status, whether it is set to cancel, and the date the current period ends. That copy is what lets the app know which plan you are on without asking Stripe on every page, and it is replaced whenever Stripe tells us the subscription changed. Your email and name are shared with Stripe so your invoices carry them. Invoices themselves are served by Stripe, and each one names the seller for that sale.

Third parties

We do not sell or rent your data. The application and its database run on a third-party cloud hosting provider, Premium sign-in uses a third-party identity provider, and payments are handled by Stripe; each sees standard request, identity or billing metadata (timestamps, IPs, response codes, your sign-in identifier, your payment details) the way any web host, login provider or payment processor would, governed by their own privacy policies. We never share your projects or their contents with anyone except the collaborators you invite.

Your choices

Free tool: to reset your anonymous device id, clear this site's localStorage in your browser settings; the per-visit session id clears on its own when you close the tab.
Third model: clearing this site's storage in your browser settings also removes a copy of A and B left behind by a sign-in you did not finish. Finishing the sign-in removes it too - it goes back into the page and is deleted as it does.
Premium: delete any revision or project at any time to remove those models from our servers. To close your account and remove all of your data, ask us via the feedback form.
Reviews: revoke a link at any time to stop it opening for anyone, from the Reviews section of your account or from the browser that created it. Revoking is immediate and cannot be undone.
To remove a feedback message or waitlist email you previously sent, write to us via the feedback form and we'll delete it.

Changes

If we ever change what we collect, we'll update the "Last updated" date at the top of this page and call out the change in the footer's version badge.