Privacy policy

Who we are

IteraMesh (iteramesh.com) is operated by Wolffia Pty Ltd, a company registered in Victoria, Australia, which is responsible for the personal information described here. We serve people worldwide, and this policy applies wherever you are. For any privacy question or request, email [email protected].

What we collect

When you browse and customize without an account

• An anonymous browser session. A random identifier in a cookie, so we can keep your generated file available to you, apply the free generation allowance, and recover downloads without knowing who you are. It never tells us your name, but it does single out this browser, so we treat it as personal information and protect it as this policy describes. This necessary session works even if you refuse optional analytics.
• What you ask us to generate. The measurements and settings you submit, and the model file we generate from them. Drafts you have not generated stay in your browser.
• Usage events. Which pages you open and how long each stayed visible on your screen, when you first change a measurement in an editor, when you press Generate, when you start customizing, and when a generation completes or fails or a file is downloaded, tied to the anonymous session. For visible time we record only how long, and whether you scrolled, pointed, tapped or typed at all, never what or where. In the EU, the EEA and the UK we record nothing until you accept optional analytics; elsewhere we record it unless you refuse. If you arrived through a link carrying campaign tags (such as utm_source or ref), we record those tags on the same basis. We never reconstruct or backfill events from before you accepted.
• How you reached us and what you are using. With each page you open, and on the same basis as usage events, we record the country you are visiting from, whether you are on a phone, a tablet or a computer, the name and version of your browser (for example Chrome 126), the name of your operating system without its version (for example macOS), whether your screen is phone, tablet or desktop width (a band, never its exact size), whether your browser describes itself as a crawler or as driven by automation, whether an AI agent's signed request came from the agent it names, and the page on another website that linked you here, when your browser tells us. We drop everything after a ? in that page's address, so what you searched for or typed there is not kept. We use these to see where visitors come from, which browsers to support, whether the editors work on every size of screen, and which visits were people rather than bots.

Our application does not record your IP address and does not fingerprint your device.

Our web server keeps a record of the requests it answers: the page asked for, when, and how it responded. When a request comes from an automated crawler that gives its own name, such as a search engine's or an AI assistant's, the record also holds that name, so we can see which crawlers read the site. It holds nothing that identifies a person: no IP address, no browser details and no referring page.

When you create an account

• Your email address, to send sign-in links and identify your account.
• If you sign in with Google, your name, email address and Google account identifier. Google may include a profile photo in its sign-in response, but we do not use or store it. We do not receive your password, request access to other Google account data, or keep Google access tokens.
• A sign-in session in a cookie, and what you do with your account: your appearance preference, generation allowance and job history, and the configurations, compatibility profiles and collections you choose to save. Saved records include their visibility and state, parameters, notes and version history.
• Sign-in records. We keep recent sign-in requests, session times, and any external identity connected to your account. Sign-in secrets and session tokens are stored only as one-way hashes.
• A link to your earlier anonymous analytics session in the same browser, on the same basis as usage events above, so your usage is not counted twice. We do not link other devices.

When you contact us

The messages you send us, and your email address.

When you ask us to make something

What you tell us you are trying to fit, and the email address you give us so we can say what became of it, if you give one. We keep a one-way digest of your browser session or account with a request, only to limit how many one browser can send in a day. We do not need an account from you to take a request.

When you report content or appeal a decision

What you tell us, the page it is about, and the email address you give us so we can reply, if you give one. We keep a one-way digest of your browser session or account with a report, only to limit how many reports one browser can send. The people who review reports see your address. We give it to the publisher only if you tick the box that allows it, which the form offers for copyright, license and trademark reports.

How we use it, and why we may

We do not sell personal information, show advertising, build advertising profiles, or make automated decisions with legal or similarly significant effects on you.

Who processes it for us

We use these providers to run IteraMesh. Each handles personal information only to provide its service to us.

Our servers and database are in Australia. Cloudflare serves the site from locations around the world, usually one near you, and Resend and Google process information in the United States. So your information may be handled outside the country you are in. For restricted transfers from the EEA or UK, our hosting and email providers rely on the EU-US Data Privacy Framework and its UK Extension where available, and on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum as applicable. Email [email protected] to ask for information or a copy of the relevant safeguards. IteraMesh is operated from Australia and has no establishment in the EU, the EEA or the UK. Where EU or UK data protection law applies to our processing, we comply with the requirements that apply to organisations established outside those jurisdictions. If we are required to appoint a representative there, we will publish their contact details here. When you choose Google sign-in, you direct Google to send us the identity details listed above under Google's own privacy terms. We would also disclose information if the law required it.

Cookies and browser storage

The anonymous session is needed for generation and downloads to work, but it is used for analytics only with your consent in the EU, the EEA and the UK, and elsewhere until you refuse. You can accept, refuse, or withdraw optional analytics in our Privacy settings. We keep only daily, unlinked totals of accepted and refused choices. We use no advertising or analytics cookies from other companies. Cloudflare may set strictly necessary cookies, or use similar technologies, to protect the site from abuse and keep it secure.

How long we keep it

• A sign-in link expires after 15 minutes and works once. The record of the request, including your email address, is deleted within 30 days after it expires.
• Without an account, a generated file stays available to you for 24 hours. After that, generated files are a shared cache identified by their settings, not by you, and we can remove them at any time.
• Usage events, anonymous sessions, generation jobs and their direct link to you are deleted 24 months after they are recorded. The normalized settings and generated file may remain separately as a shared, de-linked recipe and cache entry so an identical request does not have to be computed again. These shared records are not tied to your session or account and remain until cache eviction.
• When optional analytics are allowed, an explicitly submitted catalogue search may be recorded as a redacted phrase and pseudonymous result interaction. Search phrases are deleted after 90 days; we do not keep the unredacted text.
• Account information and saved work are kept while your account exists. A deletion request disables the account immediately, and account-linked records are deleted within 30 days. For Presets you published, we keep only the public attribution and the immutable licence and provenance needed to preserve grants others already have, plus restricted moderation records needed for an active safety, legal, policy, or appeal obligation. Email addresses, sign-in identities, private saved work, and account-linked analytics are not retained for those purposes.
• Messages you send us are kept as long as we need them to deal with your request.
• The email address on a report or appeal is erased 90 days after we close it, or when your account is deleted. The report or appeal itself stays as the record the decision rests on.
• The email address on a model request is erased 90 days after we decide it, or when your account is deleted. What you asked for stays as evidence of what people need, without your address on it.
• Encrypted database backups are kept for up to 29 days, so deleted information can remain in a backup for that long.

Your choices and rights

Wherever you live, you can ask us to:

• give you a copy of your personal information;
• send it to you in a common, machine-readable format;
• correct it;
• delete it, including your account;
• stop or limit a use of it, including using your usage events to understand how IteraMesh is used.

If you have an account, you can download its data or request deletion directly in Privacy settings. You can also change or withdraw your analytics choice there at any time. Withdrawal stops new analytics collection and identity linking; necessary generation, recovery, and downloads continue to work.

For another privacy request or complaint, email [email protected] with the subject “Privacy request” or “Privacy complaint” and describe the issue and the outcome you want. We may need to confirm the request comes from you. We will acknowledge it, investigate it, and give you a written response or an update within 30 days. Without an account, we may be unable to find information linked to your anonymous session. You can also use IteraMesh without an account, and use the controls above to object to analytics or erase this browser's anonymous session data before starting a new session.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the privacy or data protection authority where you live.

Security

Connections are encrypted. Generated files are stored privately and reached only through short-lived links for the session that asked for them. Sign-in links and sessions are stored only as one-way hashes, and database backups are encrypted.

Children

IteraMesh is designed for adults and is not directed or marketed to children. If you are under 16, do not create an account or submit personal information without a parent or guardian's involvement. Anonymous browsing remains technically accessible, and we do not ask visitors for their age. If you believe a child has given us personal information, email [email protected] so we can investigate and delete it where appropriate.

Changes to this policy

When this policy changes, we update the date at the top. If a change materially affects how we use your information, we will say so on the site before it takes effect.