Privacy Policy

Overview

ShapeMason is free to use, from Nearly Done that turns vector art and meshes into CAD files. It comes as a web app at shapemason.com, an app for macOS, iPadOS and iOS, and the shapemason command-line tool. This policy describes what information we process when you use any of them, how we use it, and the choices available to you.

The short version: your files are converted on your device and are never uploaded. There are no accounts. ShapeMason sends anonymous usage and error data to help us improve it, and you can turn that off at any time.

Information we process

When you use ShapeMason, we may process:

• Anonymous usage events — which features are used, so we can learn which pipelines, formats and options matter and where conversions fail: that the app or web app was opened, which command the CLI ran, which kind of conversion ran, the input and output formats, how many files, a rough size range (for example "1–10 MB"), how long it took, the names of the options you changed from their defaults (never their values), whether a saved profile was used, the kind of error when a conversion fails (for example "mesh not watertight", never the error message), and whether a mesh repair was offered and accepted.
• Error reports — when the software crashes or hits an unexpected error, the type of error and a stack trace with messages, file names and paths removed.
• Basic technical details — the platform (web, CLI, macOS, iPadOS or iOS), the ShapeMason version, the operating system family and how it was installed (for example App Store, browser or a download). In the web app, the analytics library also adds the browser, operating system, device type, screen size and the page path, and measures page performance (Web Vitals).

Events from the apps and the CLI carry a random identifier created on your device, so we can tell installs apart; the CLI keeps it in its settings file. It is not linked to your name, email, Apple ID or anything else about you. The web app keeps no identifier at all.

What we do not collect or store

• We do not upload your files. Conversion runs on your device, or in your browser on the web, and works offline.
• We do not collect the contents of your files, their names, folder paths, the text you set, font names, profile names, or the values you type into options.
• We do not keep your IP address. Cloudflare sees it in transit, as every web host does, and our analytics project is set to discard it.
• We do not create accounts or person profiles, and we do not ask for your name or email.
• We do not use cookies for analytics, or store anything in your browser for it.

Third-party services

Nearly Done decides what is collected and why, so it is the controller of this data. Two providers process it for us, as our processors:

• PostHog, Inc. — anonymous product analytics and error reports, stored in the United States (PostHog US Cloud).
• Cloudflare, Inc. — hosting for the web app, and a small forwarder at /ingest that passes the web app's analytics events to PostHog. Cloudflare handles your IP address while it delivers the site and the events. The forwarder removes cookies and passes on only your IP address, which PostHog uses for the daily hash described under Analytics and then discards. Cloudflare never sees your files.

ShapeMason also relies on:

• Apple — distributes the apps through the App Store.
• GitHub — hosts the CLI downloads.

If you are in the European Economic Area, the United Kingdom or Switzerland, this data is transferred to the United States. PostHog and Cloudflare are certified under the EU-US Data Privacy Framework and its UK and Swiss extensions, and both provide the European Commission's Standard Contractual Clauses (with the UK Addendum) as a fallback if that framework stops applying.

Apple and GitHub process data under their own terms and privacy policies. When you download ShapeMason from the App Store or GitHub, or visit the web app, those providers may collect information, such as your IP address, under their own policies.

Analytics

Analytics are on by default, and each platform says so the first time you use it, with a link to this policy and to the setting that turns them off. Turning them off takes effect at once, and nothing is saved to send later.

In the web app, analytics use no cookies and no browser storage. Events go to /ingest on the ShapeMason site, which forwards them to PostHog. To count visits without cookies, PostHog works out a daily, salted hash from your IP address and browser details; the IP address itself is discarded. If your browser sends a Global Privacy Control or Do Not Track signal, the web app sends no analytics at all.

We do not track you across apps or websites owned by other companies, and nothing we collect is linked to your identity. That is why the apps never ask for permission to track you.

We do not sell or share personal information, use it for targeted advertising, or use it to train AI models.

Data stored on your device

ShapeMason keeps a few things on your device so it works the way you left it. They never leave your device, and we cannot see them:

• Web app — your settings, saved profiles, whether you dismissed the usage data notice, your usage data choice, and (in Chrome and Edge on a computer) the folder you chose to save into, all in your browser's storage.
• Apps — your settings, saved profiles, your usage data choice and the folders you allowed ShapeMason to use, in the app's own storage.
• CLI — a telemetry.json settings file in your user configuration folder with your usage data choice, whether the notice was shown, and the random install ID.

Clearing your browser's site data, deleting the app or deleting the settings file removes them.

Data retention

Converted files stay wherever you save them; we never receive them. PostHog keeps analytics events and error reports for at least seven years under our plan, and may delete them after that. We can delete all of them at any time by deleting our analytics project. Data stored on your device stays there until you remove it.

Your choices and rights

You can turn analytics off at any time:

• Web app — Settings › General › "Share anonymous usage data", or turn on Global Privacy Control or Do Not Track in your browser.
• macOS, iPadOS and iOS apps — Settings › General › "Share anonymous usage data".
• CLI — run shapemason telemetry off, or set DO_NOT_TRACK=1 or SHAPEMASON_TELEMETRY=0. It is always off when the CI environment variable is set. shapemason telemetry status shows whether it is on and why.

Depending on where you live, including the European Economic Area, the United Kingdom and California, you may have the right to know what personal information we hold about you and get a copy of it, to correct it, to delete it, to object to its use, and not to be treated differently for using these rights. Where the GDPR or UK GDPR applies, we process analytics on the basis of our legitimate interest in understanding how ShapeMason is used and fixing what fails.

Because what we collect is anonymous, we usually cannot find the events that came from you. If you use the CLI, you can include the install ID from its telemetry.json file in your request and we will delete the events that carry it. We do not sell or share personal information, so there is nothing to opt out of. To make a request, email hello@nearlydone.tech.

Children

ShapeMason is not directed at children under 13, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, email hello@nearlydone.tech and we will delete it.

Contact

For privacy questions, contact Nearly Done at hello@nearlydone.tech.

Changes

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision.