Privacy Policy
Last updated: 16 October 2026
toastmesh (toastmesh.com) makes 3D game assets from text prompts and images. This page tells you what data we collect, why we collect it, who gets it, and how long we keep it. In this page, "we" and "us" means the team that operates toastmesh.
If you have a question, sign in and choose Privacy request in the user menu (the round button at the top right). With a plan, choose Feedback.
The data we collect
- Account data. Your email address and your first and last name. WorkOS runs our sign-in: if you use a password, WorkOS keeps it as a hash, and we never see it.
- Google sign-in. If you sign in with Google, Google sends your Google account ID, your email address and your name to WorkOS, and WorkOS sends your email address and your name to us. Only your basic profile and your email address are asked for. We do not get your Google password, your Gmail, your contacts or your files.
- Payment data. Stripe processes all payments. We do not see or keep your card number. We keep your Stripe customer and subscription IDs, your plan, your billing dates, the amounts you paid, and your credit balance and history.
- Your content. The prompts and edit instructions that you type, the images that you upload, the concept images and 3D models that we make for you, and your project names.
- Technical data. Our servers and our network provider record IP addresses, request times and the pages and files that were requested. We use this data for security and to find faults.
- Feedback and bug reports. When you send feedback, we get your message and your browser name. A bug report also includes the item that was open: its id, name, prompt, status, error and recent log.
We do not use analytics or advertising trackers. We do not sell your data, and we do not share it for advertising. We do not use your content to train AI models.
How we use the data
- To sign you in and keep you signed in.
- To make, show and deliver your concept images and 3D models.
- To process payments and to count your credits.
- To prevent abuse, to keep the service secure, and to find and fix faults.
- To send you messages about your account or your payments.
Who gets the data
We use these service providers. Each one gets only the data that it needs for its task.
| Provider | What it does | Data it gets |
|---|---|---|
| WorkOS | Sign-in: Google, or email and password, email checks and password reset. | Your email address, your name, your password hash, your Google sign-in data, and the IP address and browser of each sign-in. |
| Google sign-in. The Gemini API makes and paints images. | Sign-in data. Prompts, concept images and views of your model. | |
| xAI | The Grok image API makes and edits concept images. | Prompts, edit instructions and images. |
| Runpod | GPU servers that make the 3D model. | Concept images and the 3D files made from them. |
| Stripe | Payments and billing. | Your email address and your payment details. |
| Discord | Sends your feedback and bug reports to a private channel we read. | Your email address, your message, and, for a bug report, the item it is about. |
| DigitalOcean | Hosts our server and our database in the United States. | All the data on this page. |
| Cloudflare | Network security and HTTPS between you and our server. Cloudflare R2 stores your images, 3D models and downloads, in the United States. | All traffic to the site, which includes IP addresses. Your images, 3D models and downloads. |
These providers can process data outside your country. We can also give data to the authorities if the law tells us to.
How long we keep the data
- Prompts, images, 3D models and job records: until you delete them in the studio, or delete your account.
- Project names: until you delete the project or your account.
- Account data: until you delete your account.
- Feedback, bug reports and privacy requests: until you delete your account. The Discord copy stays in our private channel.
- Payment records: Stripe keeps them as long as tax and accounting laws tell us to keep them.
- Credit history: until you delete your account.
- Free welcome credits: a new account gets them once per email address. To know that an address had them, we keep a one-way hash of the address (not the address itself), also after you delete your account. We also keep the domain of the address (the part after "@") for two days, to limit the gifts for one domain.
- Database backups: 14 days.
- Server logs: a short time, for security and to find faults.
Cookies and browser storage
toastmesh_sessionkeeps you signed in for up to 30 days.toastmesh_oauthprotects the sign-in. It expires after 10 minutes.- Your browser's local storage keeps your studio settings, for example your export format.
We do not use advertising or tracking cookies. The WorkOS sign-in page and the Stripe payment page set their own cookies.
Your choices and rights
- You can delete a project or a single result in the studio at any time.
- In Settings (the menu at the top right) you can change your name, log out on all your devices, and delete your account and all your data at once. A deletion also ends your plan. Copies in our database backups are gone after 14 days.
- To see, correct or export your data, send a Privacy request from the user menu (with a plan, send Feedback). We reply by email to the address of your account within 30 days. If you cannot sign in, reset your password on the sign-in page first.
- If you signed in with Google, you can remove toastmesh's access at any time in your Google account.
- The laws where you live (for example the GDPR in the EU and the UK, or the CCPA in California) can give you more rights. Send a Privacy request (with a plan, Feedback) to use them. You can also complain to your local data protection authority.
Google user data
toastmesh's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data only to make and identify your toastmesh account.
Security
All traffic uses HTTPS. WorkOS keeps passwords only as hashes, and we keep session tokens only as hashes. Only the people who operate toastmesh can get access to the server. No system is fully secure, but we work to protect your data.
Children
toastmesh is not for children under 13. We do not knowingly collect data from children. If you think that a child gave us data, tell us with a Privacy request and we will delete it.
Changes to this policy
When we change this policy, we update the date at the top of this page.
Contact
Sign in and choose Privacy request in the user menu (the round button at the top right). With a plan, choose Feedback. Our Terms of Service are on their own page.