Privacy Policy

When you create an account, we collect:

• Email address: used to identify you and send account emails (confirming your address, password resets)
• Password hash (if using password authentication): stored securely by Supabase; we never see your plaintext password
• Display name: shown to other members of your workspace and on the activity log
• Discord username (optional): only if you enter it in the in-app support form, so we can reply to you on Discord

If you sign in with Google, Google tells us your email address and basic profile details (name and profile picture) and we use only the email address and name. We do not receive your Google password. Google's handling of the sign-in is governed by Google's Privacy Policy.

When you sign in or use the Service, Supabase (our infrastructure provider) automatically logs:

• IP address: captured on authentication events
• Device and browser metadata: included in authentication logs
• Session tokens: stored in a cookie on your device to keep you signed in

We do not directly access or use this data for any purpose other than security and abuse prevention. It is governed by Supabase's Privacy Policy.

The sign-up, sign-in and password reset pages, and the email list form, also run Cloudflare Turnstile, a check that tells people from bots. Turnstile reads your IP address and browser signals (such as your browser's user agent) and may set a cookie that the check needs. Cloudflare's handling of it is governed by the Turnstile Privacy Addendum.

FoxTrack stores the data you create while using the Service:

• Orders, quotes, and invoices
• Customer and contact records (CRM)
• Product and inventory data
• Filament and material records
• Printer configuration and status
• Expenses and financial records
• Workspace and team settings

This data belongs to you. We store it on your behalf and do not use it for any purpose other than providing the Service.

Some of this data is personal data about other people: your customers' names, email addresses, phone numbers and delivery addresses. For that data you are the data controller and we are a processor acting on your instructions. You are responsible for having a lawful basis to hold it and for answering your customers' requests about it. We only ever use it to show it back to you, to put it on the quotes, invoices and packing slips you generate, to send the invoice, quote, credit note and payment reminder emails you ask us to send, and to pass it to the services you connect yourself (see 2.8, 2.9, 2.11 and 2.12).

If you upload files to FoxTrack, we store them in Supabase Storage. Today that means photos on quote and order lines, expense receipts, sliced print files on product variants, your workspace and document logos and, with white labeling, a brand icon. We store file metadata including file name, size, type, and upload timestamp. Logos and brand icons are served from a public bucket so they can appear on your documents: anyone with the link can open them. Line photos, receipts and print files are served through short-lived signed links only to members of your workspace, and print files also to your own FoxTrack Bridge when you press Print.

If you use FoxTrack Bridge (our optional open-source agent that runs on a computer on your shop network, on the Pro and Farm plans), it sends us:

• Printer status: print progress, job state and temperatures (nozzle, bed)
• Print history: file name, start and end time, duration and result
• AMS/material slot data (for compatible printers)
• Camera snapshots: the latest frame from each printer's camera, if it has one

The Bridge sends this from your network to FoxTrack over HTTPS, with no printer maker's cloud in between. When the Bridge runs on the same computer as your browser, the live camera view and the pause, resume, stop and light controls go straight from your browser to the Bridge. Other commands, such as printing a file or setting the filament in an AMS slot, and every command when the Bridge runs on another computer, wait in a queue in your workspace until the Bridge collects them. The status, history and snapshots are stored in your workspace and are used only to show them back to you and keep your printer records up to date. A snapshot shows whatever the camera sees, so point cameras at the printers, not at people.

Payments and subscriptions are processed by Polar.sh, our billing provider. We do not store your payment card details. Polar.sh may collect your name and email address, payment method details, and purchase and subscription history. Billing data is governed by Polar.sh's Privacy Policy.

FoxTrack is hosted on Lovable, which provides basic usage analytics. This may include page views, session counts, and general usage patterns. This data is aggregated and not linked to individual users. We use it solely to understand how FoxTrack is being used and to improve the Service.

If the app crashes in your browser, an error report (the error message and the page you were on) is sent to Lovable's error reporting so we can fix it. It does not include your business data.

We send four kinds of email to you:

• Account emails: confirming your address and password resets. Supabase sends these for as long as you have an account.
• Policy notices: when we make a material change to our Terms of Service or this Privacy Policy, we email every account. Resend sends these.
• Setup emails: in your first two weeks, a few short emails on how to use FoxTrack. Once you save your first order, we skip the ones about making one. Resend sends these.
• Product and business emails: news about FoxTrack features and updates, and guides on running a 3D printing business. We send these only if you ask for them, in one of two ways: you check the box when you sign up (it starts unticked), or you enter your email in the form on our website and press the link in the confirmation email we send you. Resend sends these.

To send these, Resend keeps two lists. The all-accounts list holds the email address of every FoxTrack account, your first name if you gave it, and whether you have saved an order yet, so setup emails fit where you are. The product and business list holds only the people who asked: your email address, your first name if you gave it, when you joined and whether you are subscribed. If you check the box at sign-up, the time you did so is also stored with your account. Neither list is in the FoxTrack database. We do not track whether you open our emails or which links you click. We never sell or share the lists.

Every policy notice, setup, product and business email has an unsubscribe link, or you can email us and we will remove you. Unsubscribing does not affect your account or your account emails. The legal basis for product and business emails is your consent, which you can withdraw at any time. For setup emails it is our legitimate interest in helping you use the service you signed up for. For policy notices it is our agreement with you: the Terms say we will tell you about material changes.

When you choose to email an invoice, a quote or a credit note to a customer from within FoxTrack, we send that email through Resend, from our own address, to the email address stored on that customer's record. The document's PDF, your workspace name, and the subject and message you wrote are passed to Resend for delivery.

Payment reminders are off until a workspace owner or admin turns them on in Settings. Once on, FoxTrack emails a reminder about an unpaid invoice to the same customer address on the schedule you set, through Resend in the same way: the invoice PDF, your workspace name and your reminder wording are passed to Resend for delivery.

FoxTrack includes an optional AI assistant on the Pro and Farm plans. It is off by default. To use it, a workspace owner or admin has to configure their own AI provider and API key: OpenAI, Google Gemini, Anthropic, a custom OpenAI-compatible endpoint, or a local model running on their own machine.

When you use the assistant, the following is sent to the provider you configured, at your direction:

• Your chat messages
• Files and images you attach, such as receipt photos
• Workspace data returned by the assistant's read-only tools, such as order, customer, product, expense, or inventory records, depending on which data-sharing toggles are turned on
• The workspace notes an owner or admin writes in the AI settings, which go with every request

The assistant can only read and draft. It never writes to your workspace: a draft order or expense is saved only when you save it. It only sees what a tool returned for that request.

Processing by that provider is governed by the provider's own terms and privacy policy. FoxTrack has no relationship with your provider: the account and the agreement are yours, and we cannot control what the provider does with the data you send it. Please read your provider's policy before turning the assistant on.

If you choose a local provider such as LM Studio or Ollama, your browser calls the model server directly and that data never passes through FoxTrack's servers.

API keys are stored server-side and are never sent to the browser or shown to other members. We only ever display a masked hint of the last few characters.

Chat history is stored per member, so each member sees their own conversations. Workspace owners and admins can also view other members' chat history for the workspace. We say this in the chat panel too, before you type. Images you attach are analyzed for that request and are not kept in chat history. If you save a receipt as an expense, the file is stored as a normal upload as described in section 2.4.

The in-app support button lets you send us a bug report or an idea. We save the full submission privately (your message, your email, your workspace, the page you were on, and an optional screenshot and browser details if you check the diagnostics box). A copy is also posted to the public FoxTrack Discord so we can discuss it in the open. That public copy contains your message, the screenshot if you attached one, the browser and page details, and your Discord username if you gave one. It never contains your email address. Do not put customer details in a support message.

Some features send data to, or receive data from, services you connect yourself. None of these are on unless you set them up.

• CloudSlicer3D (Pro and Farm): if you connect a CloudSlicer store, CloudSlicer sends us its order events (customer details, items and totals) and we create matching FoxTrack orders. If you also save a CloudSlicer API token, we send CloudSlicer the new status of those orders when it changes in FoxTrack.
• Shopify, Etsy and WooCommerce (Farm, in beta): if you connect a store, it sends us its orders, including what it shares about the buyer (such as name, email address, phone and delivery address), the items, SKUs and totals. We create matching FoxTrack orders and customers. Shopify and WooCommerce send orders as they happen; for Etsy, FoxTrack checks the shop on a schedule. When you mark an imported order Shipped with a tracking number, we send the tracking number to that store, and the store emails your customer. We keep the keys, secrets or sign-in tokens you give us for a store so our servers can talk to it.
• Phone alerts: if you link a Telegram chat or add a WhatsApp number to get printer alerts, we store that chat ID or phone number and send the alert text (for example, which printer needs you and why) to Telegram or WhatsApp, which deliver it. You can remove the channel in Settings at any time.
• Webhooks (Farm): if you add a webhook endpoint, we send order and customer events to the URL you entered. What the receiving service does with them is between you and that service.
• API keys (Farm): anything a key reads or writes through the FoxTrack API is done on your behalf. We store only a hash of each key, so we cannot show it to you again after creation.

Invoice PDFs are rendered by a third-party service, Invoice-Generator.com. When you download or email an invoice, the invoice content (your business details and logo, the customer's name and address, the line items, amounts, and payment terms) is sent to that service to produce the PDF. Their handling of it is governed by their privacy policy. Quotes, packing slips and labels are rendered in your browser and are not sent anywhere.

Ideas you post on the public roadmap (the title and description) and vote counts can be seen by anyone, including people who are not signed in. Your name and email are not shown with them. We keep which items you voted for so you can remove your vote.

Under Singapore's Personal Data Protection Act, you have the right to access personal data we hold about you, correct inaccurate personal data, withdraw consent to processing (where consent is the basis), and request deletion of your personal data.

If you are located in the EU or EEA, you also have the right to data portability (receive your data in a machine-readable format), object to or restrict processing, and lodge a complaint with your local supervisory authority.

If you are a California resident, you have the right to know what personal information we collect about you, request deletion of your personal information, and opt out of the sale of personal information (we do not sell personal information).