Privacy Policy

Effective 2026-10-14 · version 1.5

Changed 2026-10-14: when a conversion fails, we now keep a short description of the file's format for 30 days — the program and version that wrote it and its size, never its geometry or anything naming a person, company, part or folder — so a file we could not read can be fixed after the file itself is deleted.

Changed 2026-10-07: In your browser now also reads STEP and BREP files and writes STEP from a mesh, on your own device. The first time, your browser downloads the CAD reader that does this (a program, the same for everyone, not your file). Your file is still never uploaded.

Changed 2026-10-06: the converter can now run in your browser. Choose In your browser above the drop zone and a mesh file (STL, OBJ, 3MF, PLY, glTF) is read and converted on your own device: it is never uploaded, and neither its name nor its contents reach us. Everything below about uploaded files applies when you choose On our servers.

Changed 2026-09-30: to offer a SolidWorks part for an older SolidWorks release, we read which releases saved it. That check uploads the file a second time when you ask for it, and does not keep it.

Changed 2026-09-28: when you are signed in, the files you convert — the one you upload and the one we make from it — are now kept in your account until you delete them, so you can use them again. A file you delete leaves our servers within 24 hours. Conversions made without an account are deleted within 24 hours, as before. Our servers are now hosted by netcup GmbH in Germany.

The short version

Your files are uploaded for one purpose: to run the conversion or generation you asked for. Every conversion runs on our own servers — your files are never sent to any third party. Processing is fully automated — no person looks at your files. Without an account, a file you convert and its result are deleted automatically within 24 hours (in practice about an hour after the conversion). With an account, the file you convert and the converted file are kept in your files so you can download them, convert them again or open them in a project — until you delete them. A file you delete is removed from our servers within 24 hours. Work you save into a project also stays until you delete it. We run no analytics, no advertising trackers, and no third-party scripts; the only cookie is the one that keeps you signed in. We never sell personal data.

1. Who we are

This service is operated by MeshWeave (“we”). We are the data controller for the personal data described in this policy. Contact: privacy@meshweave.app.

2. What we collect

Files you upload — the 3D geometry and any metadata embedded in the file, plus its name, size and format. For a SolidWorks part, that metadata includes its save history — which SolidWorks releases saved it — which we read to tell you its release and which older releases it can be saved for. Files are content, not profile data: we process them only to produce your requested output.
Account data — name, email address, and your password stored only as a bcrypt hash, never in plaintext. Sign-in tokens are stored only as cryptographic hashes. If your account began with an invitation, we also keep a record of that invitation — the address it was sent to, when, and whether it was used — and if you asked for access to the engineering tools, the request and what was decided.
Your files — when you are signed in, each file you convert or upload to your files, and each file converted from it, is stored in your account with its name, size, format, the date, a content fingerprint (a SHA-256 hash, used so the same file is never stored twice) and which of your projects you opened it in. Your files are private to your account.
Saved projects — when you are signed in, generation runs are saved to your project history so work is never silently lost. Projects are private to your account and you can delete any of them at any time: a deleted project waits in your Trash for 30 days, where you can restore it or delete it permanently at once.
Credits and purchases — a ledger of credit grants and spends tied to your account, and a record of any extra storage you bought with credits: how much, what it cost and when it runs out. Payments are handled entirely by Paddle, our merchant of record; we never receive or store card numbers.
Server logs — IP address, request path, timestamp and browser user-agent, used for abuse prevention, rate limiting and debugging. Retained no longer than 30 days.
Support — when you write to us, we keep the message, your reply thread, the page you were on and the release you were running, so we can answer you and so the next person with the same problem gets a better answer. Notes our staff write internally on a ticket are ours, not part of your data, and are never sent to you or included in a copy of your data. We keep a thread for as long as your account exists.
A record of changes to your account — when something is changed on your account, we keep an entry saying what changed, when, and the reason: a credit added or removed, a plan set, sign-in allowed or blocked, your address verified, or your account closed. It is how we can tell you what happened to your account and why, and how we can find a mistake we made. We keep these for as long as your account exists; when an account is closed the entries are rewritten so they no longer name anybody.
A failed conversion's file format — when a conversion fails, we keep a short description of the file's format, read from its header: the program and version that wrote it, its format or schema version and its size. Never its geometry, and never the header fields that name a person, a company, a part or a folder. It is how we fix a file we could not read after the file itself is gone. Retained no longer than 30 days.

3. Your files

Machine-only processing. All conversion and generation is performed by software. No human reads, views, or opens your files, except with your explicit consent in a support case you initiate.
No mining, no training. We do not analyze, mine, or train machine-learning models on the content of your files, and we make no copies beyond what is technically required to serve your request.
In your browser, nothing is uploaded. When you choose In your browser, the file is read, converted and saved by code running on your own device. We receive no copy of it, its name or its size, and no record that the conversion happened. The first conversion that reads or writes STEP downloads the CAD reader from this site once; that download is the program, not your file. You can confirm all of this in your browser's network tab: no request carries your file, and once the reader is loaded no request is made while it converts.
Everything on our own servers. Every conversion and generation is performed by our own software on our own infrastructure. Your file content is never transmitted to any third-party conversion service, API, or partner.
Retention — conversions without an account. A file you convert without signing in is scratch: it and its output are stored in isolated temporary storage and deleted automatically within 24 hours — in practice about an hour after the conversion. Nothing about it is kept in any account.
Retention — your files, when signed in. The file you convert and the converted file are kept in your files until you delete them. Deleting moves a file to Recently deleted for 12 hours, so a mistake can be undone; it is then removed from our servers — the live copy and our backup copies — no later than 24 hours after you deleted it. Delete now removes the live copy at once and the backup copies within two hours. The file's name and size (never its contents) can remain in our rolling database backups until they are replaced — see section 7. Your plan sets how much you can keep, as one allowance covering your files and your projects together (2 GB on Free, 25 GB on Maker, 100 GB on Studio); when your storage is full a conversion still downloads, is not kept, and you are told so.
Retention — your projects. Work you do in the editor is not scratch and is never deleted on a timer. Projects — and the lattice, lightweighting, structural (FEA) and slicing results saved into them — stay until you delete them from your projects list, however long a job or a piece of work takes. A deleted project waits in your Trash for 30 days so it can be restored, then it is removed; deleting it permanently from the Trash removes it at once. A finished generation is written into your project before you collect it, so closing the tab or leaving a long run overnight does not lose it. When a project's part is replaced by a different part, the project as it was is kept beside it — the last 5 per project — so the replaced part can be restored; these copies are part of the project and are removed with it. Projects stored by the app in your own browser (IndexedDB) never leave your device.

4. Service providers

Provider	Location	Purpose	Receives
netcup GmbH	Germany	Server hosting	Infrastructure only — processing happens on our servers hosted here; no file content is shared with any conversion service
Contabo GmbH	France (EU)	Backup storage	Encrypted backup copies of our database, recent job results and your stored files. They are encrypted on our own server before they leave it, so the host cannot read them. A file you delete leaves this copy on the same 24-hour schedule as the live one
Google LLC (SMTP relay)	USA/EU	Transactional email (invitations, password resets)	Your email address and the message — never your files
Paddle.com Market Ltd (merchant of record)	UK	Payment processing, invoicing, sales tax	Name, email, billing country and payment details (never stored by us); your Paddle receipt names Paddle as the seller

5. Legal bases (GDPR)

Performance of a contract (Art. 6(1)(b)) for conversions, accounts, credits and saved projects; legitimate interests (Art. 6(1)(f)) for server logs, abuse prevention and service security; consent (Art. 6(1)(a)) where we ask for it explicitly. We collect nothing beyond what these purposes need.

6. International transfers

All file processing takes place on our servers in Germany, and encrypted backup copies are kept on our backup server in France — both in the EU. File content is never transferred out of our infrastructure. Transactional email (never containing your files) transits Google’s global infrastructure.

7. How long we keep things

Data	Retention
Files converted without an account, and their outputs	Deleted within 24 hours; in practice about an hour
Your files, when signed in — the file you convert and the converted file	Until you delete them. A deleted file can be restored for 12 hours and leaves our servers within 24 hours
Measurements derived from a part (hole positions and sizes)	Held in server memory for the most recent few parts only; never written to disk
A SolidWorks part checked for its release — a second upload when you choose Older SLDPRT or drop a part on a SolidWorks version page	Read for the check and discarded when it finishes; never kept, even when you are signed in
Saved projects, and the generation, structural and slicing results in them	Until you delete them or your account — never on a timer. A deleted project waits 30 days in your Trash
Database backups — account, project and file-list records (not the contents of your files) — and backups of recent job results	The 14 most recent snapshots taken before each update to the service, kept on the same server so a fault can be undone, and one encrypted nightly snapshot for each of the last 14 days on our backup server. Something you delete leaves them as newer snapshots replace them — from the nightly ones within 14 days
Server logs	30 days
Support threads you start, and our replies	For as long as your account exists. Closing your account removes them
The record of changes to your account (what changed, when, and why)	For as long as your account exists. When an account closes, these entries are rewritten so they no longer name anybody
The format description of a failed conversion (writer, version, size — not the file)	30 days
Account data when you close your account yourself	Removed at once — account details, every saved project and every stored file. Payment and credit records are kept under a name that identifies nobody
Account data when you ask us to close it for you	Within 72 hours, and the same records are kept

8. Your rights

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing (Arts. 15–21), and lodge a complaint with a supervisory authority (Art. 77).

Two of those you can exercise yourself, at once, without asking us. Signed in, open Account → Your data & account:

Download your data — access and portability, Arts. 15 and 20. Everything we hold about you in one machine-readable file: your account details, your saved projects, your runs, your credits and payments, your support threads and your sign-in history. The file also lists what is not in it and why — your password never leaves in any form, and your files' contents are in your Files tab, where you can download each one.
Close your account — erasure, Art. 17. Removes your account details, every saved project and every file you have stored, at once rather than on a timer. If you have a subscription, cancel it first: we will not close an account that Paddle is still going to charge, because a cancelled subscription cannot be restarted and you would be paying for something you no longer have.

Closing your account keeps one thing, and we would rather tell you here than have you discover it: your payment and credit records remain, under a name that identifies nobody. We are required to keep the transaction record (Art. 17(3)(b) and (e), and tax law), and once your account is closed it is no longer connected to you, to your name or to your address.

For anything else — rectification, restriction, objection, or erasure if you cannot sign in — write to privacy@meshweave.app and we respond within 30 days.

9. Cookies

One strictly necessary cookie keeps you signed in and is deleted on sign-out. No analytics cookies, no advertising cookies, no third-party trackers of any kind — which is why this site shows no cookie banner: strictly necessary cookies are exempt from consent under §25(2) TDDDG and the ePrivacy Directive.

10. California residents

We do not sell or share personal information as defined by the CCPA/CPRA, and we do not use personal information for cross-context behavioral advertising.

11. Security

TLS-encrypted transport for all traffic; bcrypt password hashing; authentication tokens stored only as hashes; per-job isolated temporary directories; server access restricted to the operator. No security is absolute — report concerns to hello@meshweave.app.

12. Children

This service is not directed at children under 16 and we do not knowingly collect their data.

13. Changes

We will post any changes here with a new effective date, and flag material changes on the site itself.