Privacy policy
Draft: have a lawyer review this before you launch. Last updated: 24 October 2026.
[your company name] ("we") runs Cookie Shape (cookieshape.com). This explains what we collect, why, and what you can do about it.
What we collect
- Account: your email address, your name (optional) and a scrambled (hashed) version of your password. We cannot read your password.
- Your designs: designs you save, including the outline and settings. Pictures you upload for tracing are processed to make an outline; we keep the outline, not the picture, unless you save it as part of a design.
- Credits and payments: your credit balance and history, and the Stripe customer and subscription numbers. Your card details go straight to Stripe and we never see them.
- Usage: which features you use and when (AI shapes, reviews, downloads), with your IP address, so we can apply fair-use limits and spot abuse.
- Fonts: if you upload a font file, it is stored on our server so your text designs can use it.
- Email: when you sign up or reset your password we send you an email. We do not send marketing email.
Cookies
We use one cookie, to keep you logged in. It is needed for the service to work. We do not use advertising or tracking cookies.
Who else sees your data
- Stripe processes payments.
- OpenAI and Anthropic receive the text you type for an AI shape, and (for a design review) a picture of your outline with its settings, to make the result. We do not send your name, email or account details to them.
- Our email and hosting providers handle email delivery and store our data.
We do not sell your data and we do not share it for advertising.
Why we may use it (legal reasons)
To run your account and give you the service you asked for (contract); to keep the service safe, prevent abuse and keep records of payments (legitimate interest and legal duty).
How long we keep it
Account data and designs stay until you delete your account. Payment records may be kept for as long as tax law requires. Usage logs are deleted after 90 days, and are disconnected from you when you delete your account.
Your rights
You can see and download your data and delete your account yourself in "My account". You can also ask us to correct your data, limit how we use it, or object to a use, and you can complain to your data protection authority. Write to [your contact email].
Where data goes
Some providers (such as Stripe, OpenAI and Anthropic) are based outside the European Economic Area, mainly in the United States. They use standard protections for transfers.
Children
Cookie Shape is not for children under 16. If you think a child has made an account, contact us and we will delete it.
Security
Passwords are hashed, connections use HTTPS, and only people who need access to run the service can reach the data. No system is perfectly secure; if something happens that affects you, we will tell you as the law requires.
Changes
If we change this policy in a way that matters, we will tell you in the app or by email.
Contact
[your company name], [your address]. [your contact email].