Privacy Policy
Last updated: 21 August 2026
The short version. You can use every generator without an account and without giving any personal data. Nothing you type is sold, shared or used for advertising.
Analytics runs only if you accept the cookie banner. Uploaded photos and SVG files are deleted automatically within a few hours. An account is optional and exists for one purpose: saving your configurations.
1. Who is responsible
alpaco.it is an independent, non-commercial project run by a private individual based in Poland (the "operator"). The operator is the data controller within the meaning of the GDPR.
Contact for anything in this document, including data requests: privacy@alpaco.it
2. What is collected, and why
2.1 Using the generators (no account)
The dimensions and options you type are sent to the server that builds your model, used to generate the geometry, and returned to you as STL/3MF files. They are not stored in any database and are not linked to your identity.
2.2 Server logs
Like every web server, the infrastructure records technical request data: IP address, timestamp, requested path, HTTP status, and browser user-agent. These logs are used to keep the service running and to detect abuse. Log files rotate automatically (5 files of up to 50 MiB each), so old entries are overwritten as new traffic arrives.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR): operating and securing the service.
2.3 Rate limiting
To stop one visitor from monopolising the machines, each generator counts requests per client. Your IP address is turned into a SHA-256 hash and only the hash is kept: in memory, for the length of the counting window. The raw address is never written to the counters.
2.4 Uploaded files (photos, SVG)
Some generators accept an upload: a photo for a lithophane, an SVG for a keychain, a logo for a box lid. Uploads land in a temporary working directory on the operator's own machine, are used to build your model, and are deleted automatically when the session expires (3 hours) or on restart. They are never published, shared or used for anything else.
2.5 Analytics (only with your consent)
The site uses Google Analytics 4 to count how many people use which generator. It is off by default: Google Consent Mode is set to "denied" until you press "OK" in the cookie banner. If you decline (or ignore the banner) no analytics cookies are set and no analytics events are sent. Your choice is remembered in your browser under alpaco-consent and you can change it by clearing your browser storage for this site.
Legal basis: consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.
2.6 Bug reports
If you use "Report an issue", the following is sent and stored on the operator's own server: your description, the optional contact you type, the exact configuration of the model you were working on, your browser user-agent, window size and the page URL. This is used solely to reproduce and fix the problem.
Legal basis: legitimate interest in fixing defects; the contact field is entirely optional and only used to reply to you.
2.7 Optional account and saved projects
Signing in is optional. It uses Google Sign-In through Firebase Authentication (Google Ireland Ltd. / Google LLC). If you sign in, the following is stored:
- from Google: your account identifier (UID), e-mail address, display name and avatar URL;
- from you: the configurations you choose to save, which generator, the name you gave it, the parameters and a timestamp.
Saved projects live in Google Firestore. Security rules restrict every document to its owner: no one else (signed in or not) can read or modify your data. You can delete individual projects, all projects at once, or the whole account together with its data, from the account panel and from alpaco.it/account/.
Legal basis: performance of the service you requested (Art. 6(1)(b) GDPR).
2.8 Supporting the project
The "Buy me a coffee" links lead to buymeacoffee.com, an independent service with its own privacy policy. Payments are handled entirely there; the operator never receives your card or address data.
3. Cookies and local storage
| Name | Type | Purpose |
|---|---|---|
alpaco-consent | localStorage | Remembers your cookie choice. Always present once you answer the banner. |
_ga, _ga_* | Cookie | Google Analytics. Set only after you accept. |
alpaco-acct | localStorage | Marks that you signed in before, so the account button loads your session. Only if you use an account. |
| Firebase session | IndexedDB | Keeps you signed in between visits. Only if you use an account. |
No advertising cookies, no cross-site tracking, no fingerprinting.
4. Who else processes the data
- Cloudflare: hosting of the static site, CDN, and the tunnel that carries requests to the operator's machines.
- Google: Analytics (only with consent), Firebase Authentication and Firestore (only if you sign in).
- Buy Me a Coffee: only if you follow that link and support the project.
Model generation itself runs on hardware operated by the operator in Poland: your dimensions are not sent to any third-party cloud.
5. Transfers outside the EEA
Cloudflare and Google may process data outside the European Economic Area, on the basis of the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
6. How long data is kept
- Server logs: until rotated out by newer traffic (see 2.2).
- Rate-limit hashes: minutes; they live in memory only.
- Uploads and generated files: up to 3 hours, then deleted automatically.
- Bug reports: until the issue is resolved and no longer useful as a reference.
- Account and saved projects: until you delete them; deletion is immediate and in your hands.
- Analytics: according to Google Analytics retention settings (14 months by default).
7. Your rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and to data portability. For the account, most of this is available directly in the panel; for anything else write to privacy@alpaco.it.
You also have the right to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
8. Children
The service is not directed at children under 16. No account should be created by a child without the consent of a parent or guardian.
9. Changes
This policy may be updated as the project grows. The date at the top always reflects the current version; material changes will be announced on the site.