Privacy Policy

Last updated: 11 November 2026

This policy explains what information Shapesoda (“we”, “us”) collects when you use the Shapesoda website, API and MCP server, including the Shapesoda app in AI chats such as ChatGPT, Claude and Cursor (together, the “Service”), why we collect it, and what you can do about it. The Service is operated by Individual Entrepreneur Ali Mameday, 15 Pavstos Buzand St, Kentron district, Yerevan 0018, Armenia, which is the data controller for the personal data described here.

The short version: we collect as little as we can. We need your email address to run your account. We keep the images you send only when you ask for it — encrypted, for 24 hours by default and never longer than 30 days — and we never use them to train models.

1. What we collect

• Account data. Your email address, and the date your account was created. If you sign in with Google, we receive your email address and the fact that Google has verified it. We do not receive or store your Google password, contacts or profile photo.
• Sign-in codes. When you sign in by email we send you a one-time code. We store only a keyed hash of the code, valid for at most 10 minutes, together with your email address and the time of the last request (to limit how often codes can be sent) for up to 24 hours.
• Credits and payments. Your credit balance, purchases and spending limit. Payments are processed by Paddle.com, our online reseller and Merchant of Record, which acts as an independent controller for the payment data you give it. We receive the payment status (for example, “paid”, amount, date) but never your full card details.
• API keys. If you create API keys, we store only a keyed hash and a short prefix so you can recognise the key.
• Connected apps. If you connect your account to an AI app (for example ChatGPT, Claude, Cursor or Claude Code) by signing in and pressing Allow, we store which app it is (its address or host name, and the name it registered with), when you connected it and last used it, and keyed hashes of the access and refresh tokens we issued to it — never the tokens themselves. Access tokens last 1 hour and refresh tokens 60 days. You can see and disconnect these apps in your account settings; disconnecting revokes the tokens at once.
• Where you came from. When an account or subscription is created, we record a short source tag such as “chatgpt”, “claude”, “cursor” or “web” (from the app you connected, or from a ?ref= link to our pricing page), so we know which channels bring people to Shapesoda. It is set once and does not track you afterwards.
• Use without an account in AI chats. Without an account, the MCP server allows a few free images a month. To count them we use the anonymous user identifier ChatGPT sends for rate limiting, the session identifier of the MCP connection, or your IP address, and we store only a keyed hash of it with the usage record, for 30 days.
• Usage metrics. For each processed image: time, processing duration, file size in bytes, pixel count, the number of credits charged, and a cryptographic hash (SHA-256) of the image, which lets us avoid charging you twice for the same picture. These records do not contain the image itself.
• Feedback. If you rate a result (👍/👎) or leave a comment, we store the rating, your comment, the editor settings and the image dimensions and shape count — not the image. If you are signed in, it is linked to your account. We keep feedback for up to 24 months.
• Technical data. IP address and request metadata (such as time and user agent), used for security, rate limiting and abuse prevention. Our servers keep operational logs for a limited time.

2. Your images

• Images you open in the editor are processed in memory on our servers for the duration of your editing session and are discarded when the session ends.
• An API request for a single output format is processed in memory and nothing is kept: the image and the result are discarded as soon as the response is sent.
• When you ask the API for several formats at once, request a free preview (mode=preview), pass retain=true or retention_days, or use the MCP server, the source image and the results are stored on our servers so you can download them (and other formats) later. They are stored for 24 hours by default, for the number of days you set with retention_days (up to 30 days), and for 1 hour in test mode. They are encrypted with a key derived from a secret token that only you receive; we keep only a hash of that token. They are deleted automatically when that period ends, when you delete them, or when you delete your account. Anyone who has the result link with its token can download the result, so share it only as you would share the file itself.
• Files uploaded to the MCP server before processing are held in memory for up to 10 minutes.
• If you send an image by URL (where available), we download it from that address through an isolated proxy and then treat it like an uploaded file.
• When you attach an image to a message in ChatGPT and let it share the file with Shapesoda, ChatGPT gives us a one-time download link. We download the file once, only from OpenAI’s file servers, through the same isolated downloader, and then treat it like any other MCP input: the source and the results are stored for 24 hours as described above. In Claude you pick the file yourself in the Shapesoda window, and it is uploaded straight to us like an MCP upload.
• When the Shapesoda window lets you change the settings of an image, it vectorizes the same stored source again; no new copy is kept beyond the 24 hours.
• We do not look at your images or results, do not store them in a database, and do not use them to train machine-learning models.
• “Recent images” in the web app are kept only in your own browser (its storage, IndexedDB), not on our servers. You can clear them in your browser at any time.

Using Shapesoda in AI chats

• We do not collect your conversations. The AI app decides when to call Shapesoda and sends us only the tool call: the image (or a link to it) and the settings. We do not receive, store or read your messages, the chat history or the rest of the conversation, and we do not ask for them.
• What the AI app’s provider (for example OpenAI or Anthropic) does with your conversation is governed by that provider’s own privacy policy; they are not our processors.
• The text a chat shows about a result (size, number of colors, download links) is what we return to the app; result links contain a secret token, so treat them like the result itself.

3. Why we use your data

• To provide the Service: create and secure your account, sign you in, process images, track credits and subscriptions, connect the AI apps you authorise (performance of a contract).
• To keep the Service safe: prevent fraud, bots and abuse, enforce rate limits and free limits (including for use without an account), and keep a hash of deleted mailboxes so the free credit is not claimed twice (legitimate interests in security and preventing abuse).
• To keep backups so that data is not lost after a failure (legitimate interests).
• To improve the Service: feedback you choose to give and the short source tag of new accounts (legitimate interests in understanding what works and which channels bring people to us).
• To send you service emails, such as sign-in codes and important account notices (performance of a contract). We do not send marketing email without your consent.
• To keep payment and accounting records, for example for tax: legal obligations under applicable (including Armenian) tax law and our legitimate interest in keeping accurate accounting records.

4. Cookies

We use a single first-party session cookie (ss_session) to keep you signed in. It is HttpOnly and is not used for tracking. During Google sign-in we set a short-lived cookie (up to 10 minutes) that protects the sign-in flow against forgery. When you arrive from an AI app or a ?ref= link, we set an HttpOnly cookie ss_ref with the source tag (for example “chatgpt”) for up to 30 days, used only to count which channel brought a new account (aggregate statistics, never combined with data from other sites). You can block or delete it in your browser without affecting the Service. We do not use advertising or analytics cookies. To see how the Service is used, we keep daily totals only: how many times each page was opened and from which referring site or ?ref= tag, and how many images were uploaded, reached sign-in or were downloaded in the editor. These totals contain no cookies, IP addresses or other identifiers and cannot be linked to you. If bot protection is enabled, Cloudflare Turnstile may use its own technical signals to tell humans from bots, as described in Cloudflare’s privacy policy. Your theme and language choices and your “Recent images” are stored locally in your browser and never sent to us.

5. Third parties we rely on

We do not sell your personal data and do not share it for cross-context behavioural advertising. Our servers, database and stored results are hosted by Railway in the Netherlands (EU). Database backups are stored in Cloudflare R2, and Cloudflare, Resend, Google, Paddle and Telegram may process data outside your country, including in the United States. The Service is operated from Armenia. Where personal data is transferred from the EEA or the UK to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) included in our providers’ data processing agreements.

6. How long we keep data

• Images and results: see section 2 — not kept for editor sessions and single-format API requests; stored results 24 hours by default and up to 30 days with retention_days; MCP uploads up to 10 minutes.
• Sign-in codes: valid for up to 10 minutes; the email address and request time used to limit sending: up to 24 hours (also for addresses that never created an account). Session cookies: up to 30 days, or until you sign out.
• Connected apps: token hashes until the token expires (access 1 hour, refresh 60 days) or until you disconnect the app or delete your account; pending connection requests and one-time codes for at most 10 minutes. Files downloaded from ChatGPT: 24 hours, like other MCP inputs.
• Account data and usage metrics: while your account is active. When you delete your account, they are deleted together with any stored results, except a one-way hash of your mailbox that we keep so the free credit cannot be claimed again, and payment and subscription records (see below). Feedback you left stays, without the link to your account, for up to 24 months from when you left it. Deleting your account also cancels your subscriptions with Paddle immediately.
• Backups: the database is backed up hourly; hourly copies are kept for 48 hours and daily copies for 35 days, so data you deleted disappears from backups within 35 days. Backups are used only to restore the Service after a failure.
• Usage records for MCP use without an account: 30 days.
• Payment and subscription records (Paddle transaction and subscription IDs, amount, currency, plan, status and dates), linked only to an internal account ID: as long as tax and accounting law requires, also after you delete your account.
• Server logs: up to 30 days.

7. Your rights

Depending on where you live (for example under the GDPR or UK GDPR), you may have the right to access your data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent. You can download a copy of your account data and delete your account yourself in your account settings. To exercise any other right, email us at [email protected] from the address linked to your account. We reply within one month. You can also complain to your local data protection authority.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated limits (such as rate limits and free daily limits) only control access to the Service and can be discussed with us by email.

Where a US state consumer privacy law (for example California’s) applies to us, you have the right to know what personal information we collect, to access and delete it, to correct it, and not to be discriminated against for using these rights. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information. Use the email above to make a request; we will verify it through your account email.

8. Security

We use encryption in transit (HTTPS), store only hashes of sign-in codes, session tokens, API keys and tokens of connected apps, encrypt stored results with a key only you hold, isolate image processing in separate processes, and limit access to production systems. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires it.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

10. Changes

We may update this policy. If the changes are significant, we will notify you by email or in the Service before they take effect.

11. Contact

Individual Entrepreneur Ali Mameday, 15 Pavstos Buzand St, Kentron district, Yerevan 0018, Armenia — [email protected]