Privacy

Last updated 6 September 2026

We collect as little as we can for a marketplace that has accounts and a review process. This page says exactly what, why, and for how long.

What we collect

• Browsing: standard server logs (IP address, user agent, pages requested) held briefly by our hosting providers for security and debugging. We measure traffic ourselves, without cookies and without any third-party analytics service: your browser sends the page path and product events such as downloads and searches to this site only. We never store your IP address; a visitor is counted by a salted hash that changes every day, so two days can never be linked, and we honour Do Not Track and Global Privacy Control by recording nothing at all.
• Accounts: email address, display name, username, optional website and bio, and your API key (stored encrypted). There is no contributor password: signing in uses a short-lived code emailed to you. Your display name and username are public.
• Submissions: the files and metadata you upload, plus the time and IP address at which you accepted the contributor attestation, kept as evidence of the rights confirmation.
• Reports: what you tell us when you report an asset, and your email if you give it.
• Bot protection: forms use Cloudflare Turnstile, which processes connection data to tell people from bots.

Why (lawful basis)

Running the Service you asked for (contract); keeping it secure and handling rights claims (legitimate interests); meeting legal obligations. We do not sell personal data and do not use it for advertising.

Who processes it

Vercel (hosting), Cloudflare (CDN, file storage, email delivery, bot protection) and Supabase (database) act as our processors. Data may be processed in the EU, UK and US under standard contractual safeguards.

How long

Account data for as long as your account exists, then deleted within 30 days of a deletion request. Attestation records for the life of the asset plus six years. Server logs typically under 30 days. Published assets stay published under their licence, but are removed from the Service if you unpublish them.

Your rights

Under UK and EU data-protection law you can ask for access, correction, deletion, restriction or portability, and object to processing. Email [email protected]. You can also complain to your local supervisory authority (in the UK, the ICO).

Analytics

We run our own analytics on this site. There is no third-party analytics provider and no analytics cookie. When you open a page, your browser sends us the page path (never the query string) and, when you act, a named event such as a download, a search or a sign-up step, with a few non-personal details like the asset or the search words, the site or campaign link that brought you here, and page speed timings (Core Web Vitals) so we can keep the site fast. On our side we keep the page, the event, the country, an approximate location rounded to about ten kilometres (never a street or a city name), the device type, the browser family and an anonymous visitor identifier: a hash of your connection and browser mixed with a secret that changes every day, which lets us count visitors for one day, see the order of pages one anonymous visitor opened within that day, and makes it impossible to link two days or recover who you are. Requests from agents and scripts to the download and MCP endpoints are counted the same way. If your browser sends Do Not Track or Global Privacy Control we record nothing at all. Aggregated analytics are kept for up to 400 days.

Cookies

One session cookie after you sign in; a theme preference. No analytics, advertising or cross-site tracking cookies.

Children

The Service is not aimed at children under 16 and we do not knowingly hold their data.

Contact

3dassets.dev · [email protected]