Privacy Policy

TL;DR user-friendly

• A MyFabmesh account is required the first time you use the installed Desktop app on a PC (2 PCs maximum per account, see 2.7). After that, generation in Local mode runs 100% on your machine and works offline (the app re-checks your activation online at least every 7 days).
• Generated meshes and images are stored locally only, never uploaded.
• Anonymous usage statistics (on by default, one click to turn off) and optional prompt sharing (off by default): section 2.6.
• We collect anonymous crash reports via Sentry to fix bugs (no IP, no username, no machine name).
• The first launch downloads ~15 GB of AI models from Hugging Face — that's a direct connection between your machine and Hugging Face, we don't proxy it.
• The Cloud version (when available) requires a Microsoft / email login and stores your project history server-side — explained in detail below.

1. Who we are

MyFabmesh.AI is published by Ayros Studio, a French sole proprietorship operated by Fabien Lacaze. Contact: myfabmesh.contact@gmail.com.

2. Desktop application

The desktop app runs in one of two modes, and what leaves your computer depends entirely on which one is active. The app tells you which mode it is in, on the setup screen and next to the Generate button.

2.1 Local mode needs an NVIDIA GPU

Everything happens on your machine. In this mode:

• An account is needed once, to activate the PC (section 2.7); after that Local mode works offline and sends your content nowhere (only a small activation check, at least every 7 days).
• No reference image, prompt, mask or generated mesh leaves your computer — generation runs on your own GPU. Only exception: the text of your prompts, if you turn on prompt sharing yourself (see 2.6).
• No analytics SDK and no advertising identifier. The only usage measurement is the anonymous usage statistics described in 2.6 (on by default, you can turn them off in one click).
• No collection of your MAC address, serial number or hardware IDs. The only persistent identifiers are the crash-report installation ID (2.3) and the random PC identifier used for activation (2.7).

2.2 Cloud mode used automatically when no NVIDIA GPU is present

On a computer without a supported NVIDIA GPU, local generation is impossible, so the app uses our cloud service instead. This requires an account, and your content is sent to our servers. Concretely, in cloud mode:

• You create an account (e-mail address and password) or sign in, from inside the app. Credentials are handled by Supabase Auth, hosted in the EU (Frankfurt).
• Your prompts and reference images are uploaded to our worker and processed on rented GPUs; results are stored in Cloudflare R2 and downloaded back to your PC.
• Your credit balance, payment history and generation history are stored against your account.
• We never use your content to train models.
• Section 3 below describes the cloud service in full — it applies to cloud mode of the desktop app too.

If you would rather not use the cloud, do not sign in: the app remains usable for importing, editing and exporting meshes you already have.

2.3 What we collect in both modes

• Anonymous crash reports via Sentry. When the app crashes or hits an unexpected error, a report is sent to our Sentry account containing: the error stack trace, the app version, the OS version (e.g. "Windows 11 26200"), and a randomly generated installation ID (UUID). We explicitly strip your Windows username and machine name before sending (see main.js / beforeSend in the open source code). Sentry stores reports for 90 days. You can switch this off in Settings → Privacy → Crash reports. Unticking it stops reports immediately; ticking it back on takes effect at the next launch, because when the option is off the reporting SDK is not started at all.
• Update check. The app checks GitHub Releases on launch to see if a newer version is available. The request is a standard HTTPS GET to api.github.com. GitHub may log the request IP per their privacy policy — we don't see it.

2.4 Third-party services the app talks to

• Hugging Face Hub (huggingface.co): downloads ~15 GB of AI models on first run. Subject to Hugging Face's own privacy policy. We bundle a read-only public token so no personal account is needed on your side.
• Sentry (sentry.io): receives the anonymous crash reports described above. Subject to Sentry's privacy policy.
• GitHub Releases (api.github.com): version check + installer download. Subject to GitHub's privacy policy.

2.5 What's stored on your computer

• App files in %LOCALAPPDATA%\Programs\MyFabmesh.AI\ (about 200 MB).
• AI models cache in %USERPROFILE%\.cache\huggingface\hub\ (about 15-22 GB depending on install mode).
• Your projects, meshes, and image versions in %USERPROFILE%\Documents\MyFabmesh.AI\ (controlled by you).
• App settings in %APPDATA%\fabmesh\ (preferences, logs, setup state).

2.6 Anonymous usage statistics and optional prompt sharing

Two settings (Settings > Help improve MyFabmesh). Anonymous usage statistics are on by default: a one-time notice tells you so when you first open the app, before anything is sent, and lets you turn them off in one click. Legal basis: our legitimate interest in measuring how our own software is used (GDPR art. 6.1.f); this strictly anonymous audience measurement falls under the trackers exempted from consent by the French data protection authority (CNIL), provided you are informed and can object. Prompt sharing is off by default and is only sent if you answer "yes" to the question asked the first time you open the app, or turn it on in Settings (legal basis: your consent, GDPR art. 6.1.a); it is only possible when usage statistics are on. Turning a setting off stops sending at once and deletes the local counters, the local queue and the installation number.

• Usage statistics: once a day, the app version, your operating system, the interface language, Local or Cloud mode, how many times each tool was used, and whether prompt sharing is on. We also record the country of the request (as given by Cloudflare). A random installation number is sent so that one computer is counted once; it is created while statistics are on, renewed at least every 13 months and deleted when you turn them off. Our servers never store it as is: only a cryptographic fingerprint mixed with a value that changes every day, which counts today's active installations but cannot link one day to the next. Kept 390 days (less than 13 months), then deleted automatically.
• Prompt sharing (Local mode only): the text of your prompts (up to 500 characters), the tool, the object type, success or failure and duration. Emails, links, keys, file paths and phone numbers are removed before sending and again on receipt; a prompt rejected by our content filter is not kept. No image, no mesh, no account, no installation number. Kept 90 days, then deleted automatically. Received prompts are linked to no one, so they cannot be found individually; they are never used for advertising and never sold.
• IP address: not stored with the statistics or the prompts. To limit abuse, a fingerprint of the IP address, computed with a value that changes every day, is kept for at most 2 days in rate-limit counters, then deleted.

2.7 Account and PC identifier installed app

The installed desktop app asks you to sign in or create a MyFabmesh account the first time you use it on a PC, even if you then generate in Local mode (Local generation stays free and works offline afterwards). Development builds require nothing.

• What we store when a PC is activated: a random identifier created when the app is first installed (not derived from your hardware), the name of the PC as you chose it in Windows, the app version and the activation date, linked to your account. We never collect the serial number, the MAC address or any other hardware identifier.
• Limit: a maximum of 2 PCs per account. You can free a PC at any time from your account page on the website or from the app (Settings, “My PCs”), which deletes its entry.
• Offline use and periodic check: once a PC is activated, the app works offline for up to 7 days. As soon as the PC is online, the app silently contacts our server (at launch, then every few hours) to renew this period; the request contains only the random PC identifier, the app version and the account session, and lets us stop a suspended or deleted account or a PC you have freed. After 7 days without any connection, the app asks you to connect once. The activation key received is stored on your PC using the protection provided by Windows (DPAPI), tied to your Windows profile. This makes simply copying the app folder to another PC harder; it is a deterrent, not an absolute guarantee.
• Purpose and legal basis: enforcing the 2-PC limit of your account and protecting the application against copying (legitimate interest, GDPR Art. 6(1)(f)). Retention: until you free the PC or delete your account.

3. Cloud service live

The cloud service is in operation. It is reached either from the web app or from cloud mode of the desktop application (section 2.2). It requires an e-mail based account. When you use it:

• We store your email, hashed password (handled by Supabase Auth), credit balance, payment history, and generation job history in a Supabase Postgres database hosted in the EU (Frankfurt).
• Reference images you upload are sent to Replicate (GPU provider) for processing and to Cloudflare R2 for the resulting GLB storage. We never use them for training.
• Payments are processed by Stripe; we never see your full card number.
• You can request deletion of your Cloud account at any time by emailing the address below — we delete everything within 30 days.
• Country and app type. For each generation we keep the country the request came from (as reported to us by our host, Cloudflare) and whether it came from the desktop app or a browser. This is used only to see which markets use the service and to spot an outage affecting one country or one platform. We keep no city, no region and no IP address alongside these statistics, and they are never used for advertising. Legal basis: legitimate interest (GDPR art. 6(1)(f)) in understanding and maintaining our own service.
• Diagnostic logs — off unless you turn them on. The web app keeps a rolling copy of your browser console in memory, which never leaves the tab. If support asks you to reproduce a problem, you can tick Settings → Diagnostic logs; from then on that log — which includes your prompts, your project names, the page address and your browser's user-agent — is uploaded after each generation. Passwords, access tokens and e-mail addresses are removed before it is sent. Logs are deleted after 30 days. Unticking the box stops it at once, and the same panel offers “Save a copy instead”, which writes the log to a file on your computer and uploads nothing.

4. Your rights (GDPR / RGPD)

You can, at any time, by emailing myfabmesh.contact@gmail.com:

• Ask what personal data we hold about you (typically: your account, the list of your activated computers and, for Cloud, your history).
• Request correction or deletion of that data.
• Request that we stop sending crash reports from your installation.
• File a complaint with the CNIL (French data protection authority) if you believe we've mishandled your data.

5. Children

MyFabmesh.AI is not directed at children under 13. We don't knowingly collect data from children. If you believe a child has provided us with personal information, contact us and we'll delete it.

6. Changes to this policy

We'll update this page when the app's data practices change (new feature, new service, etc.). The "Last updated" date at the top reflects the current revision. Significant changes will be announced on the app's update notes.

7. Contact

For any question: myfabmesh.contact@gmail.com
Ayros Studio · [À_COMPLÉTER: nom du directeur de la publication] · [À_COMPLÉTER: adresse postale complète du siège — valeur unique, identique aux Mentions légales]