CutRun

Privacy Policy

Last updated: 5 October 2026 · Deutsch · Français

This Privacy Policy explains what personal data CutRun (cutrun.app) collects, why, and what rights you have. The data controller is NightCat Works OÜ (registry code 17612606), Anne 77, 50704 Tartu, Estonia ([email protected]). We process personal data in line with the EU General Data Protection Regulation (GDPR).

1. Data we collect

• Account data: your email address, and if you sign in with Google, your name and profile picture as provided by Google. Passwords are stored only in hashed form by our authentication provider.
• Your projects: parts lists, sheet settings and projects you choose to save in your account.
• Usage data: events such as calculations run, PDFs exported and plans opened, used to enforce the free limit and to improve the Service.
• Photos you import: when you use "Import parts from a photo", the picture you choose (reduced in size in your browser) is sent to our server and to Anthropic to read the parts list. We do not store the photo; we keep only a count of scans for the monthly limit. Don't photograph anything other than your cut list.
• Feedback: messages you send us through the feedback form.
• Subscription data: your plan, its status and end date, and payment references from Paddle. We never receive or store your full card details.
• Visit statistics: a cookieless counter of page visits. It does not store your IP address; it uses a one-way code that changes every day, so visits cannot be linked across days.
• Analytics (only if you accept cookies): Google Analytics collects information about how the site is used (pages, device, approximate location, referring site) using cookies.

2. Why we use it (legal basis)

• To provide the Service, your account and your purchases — performance of a contract (GDPR Art. 6(1)(b)).
• To keep the Service secure, prevent abuse and enforce usage limits — legitimate interest (Art. 6(1)(f)).
• To understand how the Service is used and improve it — the cookieless visit counter on legitimate interest (Art. 6(1)(f)); Google Analytics only with your consent (Art. 6(1)(a)).
• To keep accounting and tax records — legal obligation (Art. 6(1)(c)).

We do not sell your personal data and do not use it for advertising profiles.

3. Who processes data for us

• Supabase — database and authentication (accounts, projects, usage, feedback, subscription status).
• Cloudflare — website hosting, the cookieless visit counter and bot protection (Turnstile).
• Paddle — our Merchant of Record: processes payments, invoices, taxes and refunds. Paddle acts as an independent controller for payment data; see the Paddle Privacy Policy.
• Google Play — payments for purchases made in the CutRun Android app (we receive the purchase token, product, order number and status, never card details); see the Google Privacy Policy.
• Anthropic — reads photos of cut lists when you use photo import (Claude AI). Anthropic does not use this data to train its models and deletes it after a short retention period; see the Anthropic Privacy Policy.
• Google — Google Analytics, and Google sign-in if you choose it.

Some of these providers may process data outside the European Economic Area. In that case the transfer is protected by the EU Standard Contractual Clauses or an adequacy decision such as the EU–US Data Privacy Framework.

4. Cookies and local storage

• Necessary: your login session and app settings (language, units, theme, current project) are kept in your browser's local storage so the app works.
• Analytics: Google Analytics sets cookies (such as _ga) to count visits and measure usage. They are set only after you click Accept in the cookie banner. If you click Reject, Google Analytics is not loaded at all. You can change your choice at any time with Cookie settings at the bottom of the CutRun page; declining does not limit any features.

5. How long we keep data

• Account data and saved projects: while your account exists. You can delete your account yourself at any time (Projects menu → Delete account, in the app too); it is deleted immediately. On request by e-mail we delete it within 30 days. Details: Delete your account.
• Usage events, photo scan counts and visit statistics: up to 24 months. Imported photos are not stored by CutRun.
• Payment and invoice records: as long as accounting law requires (in Estonia, 7 years). These are held mainly by Paddle.

6. Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To use these rights, email [email protected]. We answer within one month.

You can also complain to a data protection authority. In Estonia this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

7. Security

Data is sent over encrypted connections (HTTPS). Access to the database is restricted, and each user can read only their own projects and subscription.

8. Children

CutRun is not intended for children under 16, and we do not knowingly collect their data.

9. Changes

We may update this policy. If a change is significant, we will notify you in the Service or by email. The date at the top shows the latest version.