Privacy Policy

1. Who we are and how to contact us

JD's Garage LLC operates GarageCAM. Our public business address is 1203 43rd Ave N, Fargo, ND 58102, United States. Email jdstrem@gmail.com for privacy questions or requests.

This notice concerns personal information we handle for GarageCAM. Paddle acts as merchant of record for Paddle purchases and separately describes its handling of payment and customer information in its Privacy Policy. Its notice does not replace this notice for GarageCAM's processing.

2. Information we handle

• Account information: email address, account identifier, verification status, password hash, session/token hashes, account dates and preferences. We do not store plaintext passwords in the account database. Where we collect Terms acceptance and an 18-or-older declaration, we record the version, account, declaration and time; this is not independent age verification or ID collection.
• Access and billing information: qualifying trial/order identifiers and claims, entitlement dates, Paddle customer/subscription/transaction identifiers, plan, billing status, payment totals, refunds, disputes and event-processing records.
• Calculation information: geometry and settings you send for cloud calculations, generated output, and account-linked statistics such as operation type, geometry counts, machine profile, timings, CPU measurements, pierces and cut length where recorded by the operation.
• Machine-access coordination: job/document identifiers, program fingerprint, line count, state and timestamps used to coordinate access and safety grace. These status reports do not upload the streamed G-code program. A separate requested cloud calculation or support attachment may contain geometry/output.
• Security and technical information: sign-in/logout/session-replacement events, security review flags, derived throttling identifiers, request timings and operational/error information. Hosting providers process network requests and may hold IP addresses, browser/request metadata and logs.
• Communications: information you send to support, account/security messages, delivery/bounce/suppression status and optional-email preferences.

You provide account details, calculation inputs and support material. We create service/security records and receive relevant billing or trial information from Paddle and qualifying-order verification. Payment providers collect the payment details they need. GarageCAM's application database does not store full card numbers or card security codes. Do not send passwords, payment credentials or unnecessary confidential information in support messages.

3. Purposes and bases

We use information to provide and secure accounts, verify email and qualifying trials, process requested calculations and return results, establish access, manage billing/refunds, coordinate access deadlines, handle support, investigate errors and understand service performance and operating costs.

Where a legal basis is required, requested account/calculation/access services are handled to perform or enter our service contract; proportionate security, troubleshooting and cost/performance analysis serve our legitimate interests in operating and protecting GarageCAM; required records are handled to meet legal obligations; and optional marketing uses consent where required. The basis and available rights depend on the particular processing and applicable law.

Providing an email address and required verification information is necessary to establish an account. Geometry/settings are necessary for a requested cloud calculation. Without relevant billing/order information we cannot verify the corresponding entitlement. Optional marketing preferences are separate from those service requirements.

Automated checks verify sign-in and entitlements and apply technical admission limits. Failed payment does not create paid access. Security/account-sharing flags support human review rather than automatically suspending an account. Contact support to question an access or security decision.

4. Drawings and output

Cloud calculations send required geometry/settings through our hosting infrastructure to the calculation server. They are not entirely local to your computer. Short-job processing temporarily stores encrypted results and related job metadata; it is not a permanent drawing library.

Temporary job records normally expire after approximately two minutes. Result bytes are cleared on acknowledgement or cancellation; periodic cleanup removes expired records when the service and storage are available. This does not mean all infrastructure logs or backups disappear after two minutes. Account-linked statistics and billing records have separate retention. Keep your own copies of designs and generated output.

5. Cookies, browser storage and checkout

GarageCAM uses an authentication cookie for sign-in. The current default session lifetime is fourteen days, subject to logout, replacement and other revocation. Browser storage remembers selected language, appearance/editing preferences, saved cutting profiles, controller connection settings and limited job/access coordination state. Default language and connection-mode preferences may be initialized even before you change them. Some saved preferences have no automatic expiry and remain until changed or removed, subject to your browser. An open page's offline-access permission is held in memory, not a permanently cached offline website.

Paddle checkout loads Paddle and payment-provider resources. These can use cookies, local/session storage, network requests and fraud/security or diagnostic technologies. The sandbox observation included Paddle, Stripe and checkout support resources; providers' handling is described in their own notices, including Paddle and Stripe. A sandbox observation does not establish every technology used in a live checkout or every browser.

Your browser provides storage/cookie controls, but restricting storage can affect sign-in, checkout and saved preferences. Do not clear storage, reload or change permissions during a machine job to troubleshoot the website. Privacy questions about GarageCAM's use may be sent to our contact above; provider processing and choices are also subject to the provider notices. This notice does not claim that every third-party technology is essential or that GarageCAM is cookie-free.

6. Providers and disclosures

Our current service uses Netlify for website hosting/request proxying; Railway for server/database hosting and backups; Resend for account/service email; Paddle for purchases and subscriptions; Big Cartel order verification for qualifying trials; and Better Stack for uptime/status monitoring and alerts. Messages to our Gmail support address are processed through that email service. Providers receive information relevant to their role; uptime monitoring does not mean the monitor receives your drawings or account list. Some providers also process information independently for their own legal/transaction duties.

We may disclose information where necessary and lawful to professional advisers, authorities, or parties handling a business transfer, with appropriate protection and notice as required.

JD's Garage LLC does not sell customers' personal information, share it for advertising, or use customer designs to train AI. Necessary disclosed processing by hosting, email, payment and other providers remains part of providing and securing GarageCAM. These commitments describe our practices, not every unrelated activity of a provider.

7. Retention

We keep ordinary account and entitlement records while needed to provide the account/service, resolve requests, prevent misuse and meet applicable obligations. An expired trial or canceled renewal is not by itself an account-deletion request. For records without a fixed period, we consider the purpose, whether the account or issue remains open, applicable recordkeeping duties, actual legal/dispute/safety holds and whether less identifiable information would meet the need.

Current application retention includes:

• Temporary calculation results: the short-lived handling in Section 4.
• Routine account-linked usage/performance history: a ninety-day retention target from the event date. This concerns statistics and timings, not ninety-day storage of source drawings or G-code. Cleanup depends on functioning storage.
• Detailed security events: thirty days; security-flag summaries: ninety days, measured from creation, with cleanup dependent on service availability.
• Expired account-email payloads are redacted by cleanup. Email status/event metadata is generally retained for thirty days after message expiry or event receipt respectively. Email-provider retention is separate.
• Browser preferences: until changed/removed or cleared by browser behavior. In-memory offline permission ends when the page closes or permission expires.

Support correspondence is retained to resolve the issue and necessary follow-up, disputes, legal or safety matters. The relevant criteria include whether the request remains open, whether follow-up or an actual claim/hold is outstanding, and whether the content remains necessary for that purpose. This is not a promise of automatic deletion on a fixed anniversary.

Payment/refund/dispute and related evidence may be retained as necessary for accounting, applicable legal obligations or an actual justified claim, with restricted use/access. No universal seven-year period or automatic financial deletion deadline is promised. A minimum protected trial-claim record may remain where justified to prevent repeat redemption; hashing does not automatically make account-linked information anonymous. Paddle separately controls retention of its own transaction records.

Backups/provider logs can outlast active application records. Deleting active records does not instantly edit every backup or provider system. A request may require restricting use while backup copies age out and honoring restrictions after restoration. Contact us about the records and retention relevant to your request; we will explain any records that must be retained.

8. Communications and choices

Verification, password/security and necessary service messages are separate from optional product/news email. Optional updates are off by default; Account → Email preferences and the confirmation-based unsubscribe process provide choices. Choosing optional marketing is not required to hold an account. Agreeing to the Terms or reading this policy does not enroll you in marketing.

9. Requests, objections and complaints

Depending on applicable law and the processing, you may have rights to access, correct, delete, restrict or obtain a portable copy of information, withdraw consent or complain to a regulator. Withdrawal does not undo lawful earlier processing. Legal/security/accounting requirements can affect deletion.

Where applicable, you may object to processing based on legitimate interests and to direct marketing. Contact us to exercise that right. Where marketing relies on consent, you can withdraw it through the email-preference controls.

Email jdstrem@gmail.com for privacy requests, including closure/deletion requests. Other legally valid request routes remain available. We use proportionate ownership/identity checks; a sender address alone is not proof of ownership. Do not email passwords or identity documents without an agreed secure process. The current process includes intake, mailbox confirmation and manual review. It does not offer a self-service or automatic erasure feature.

We aim to respond without undue delay, normally within one calendar month of receipt, meeting shorter applicable deadlines and explaining lawful extensions or retained records. Cancellation of billing, closure of an account and deletion of personal data are separate actions and must be coordinated. A closure request is not itself a refund. Machine safety must be handled without sending controller commands, automatically resuming a job or abruptly closing a connection during uncertain motion; safety coordination is not a reason to ignore a valid request indefinitely.

You may complain to your applicable data-protection/privacy regulator. Examples include the UK ICO, your EU/EEA supervisory authority, the Office of the Privacy Commissioner of Canada, or the Australian OAIC. These examples do not determine which law or regulator applies to your case.

10. Location, security, age and changes

We operate in the United States. Our providers may process information in the United States and other countries, whose laws can differ from your home country. Contact us for information about the recipients, locations and applicable transfer arrangements relevant to your data.

We use controls including password hashing, protected sessions, restricted administrative access and encryption for particular stored email/result payloads. This does not mean every field is encrypted or that a system is perfectly secure. Report suspected problems to our support contact.

GarageCAM accounts are for people eighteen or older with legal capacity. An age declaration is not independent age verification. If you believe a child has provided personal information, contact us so we can assess and address it.

This policy's version and effective date are identified with the document. Material changes receive the notice and, where required, choice/consent appropriate to the change. Publishing revised words does not authorize a new data practice.