Kiln Privacy Policy

Last updated: 2026-04-21 · Version 2.2

Plain-English summary — Kiln is operated by Hadron Labs Inc., a Delaware C corporation headquartered in California. Most of Kiln runs locally on your machine (the CLI, the MCP server, slicing, printer control, fulfillment) — we can't see that data. The web workshop at app.kiln3d.com is a git-style cloud layer for 3D designs — branches, versions, PR-style reviews, orgs, and team collaboration — and that IS stored on our servers. We collect the minimum data needed to run the workshop, never sell it, never hand it to ad networks, and give you meaningful rights to access and delete it. If you prefer to skip the legalese, the table in §3 is the short version.

1. Who we are

One inbox, transparent by design. Kiln is a small team. Every contact channel in this policy — privacy requests, DPA requests, security reports, legal questions, DMCA notices, CCPA opt-outs, arbitration opt-outs, enterprise inquiries — all route to adam@kiln3d.com. Please put the topic in the subject line so the right thing gets prioritized (e.g., [CCPA], [DPA], [Security], [DMCA], [Arbitration Opt-Out]). When the team grows, we'll split these out and update this notice.

Throughout this policy, "Kiln", "we", "us", or "our" means Hadron Labs Inc. "You" means the individual or entity using the Kiln software, web workshop, CLI, MCP server, or paid services.

2. What this policy covers

This policy describes how we collect, use, share, and protect personal information across every surface of the product:

• the open-source Kiln CLI + MCP server you install locally;
• the web workshop at app.kiln3d.com and the marketing site at kiln3d.com;
• the REST API at api.kiln3d.com;
• paid tier accounts (Pro, Business, Enterprise) and the Stripe billing surface;
• fulfillment orders routed through manufacturing partners; and
• any other service we offer under the Kiln brand.

Our open-source repositories on GitHub are governed by GitHub's policies for source code access; this policy covers data collected when you use Kiln, not when you merely read its code.

3. What we collect — at a glance

First and most important: free users never sign up for an account. Kiln's free tier runs entirely on your machine as local software (CLI + MCP server). It talks to your printers directly over your local network, slices your models in-process, and the only thing it sends to our servers is a single anonymous "usage heartbeat" once per UTC day (described in §3.1). The heartbeat is keyed by a random UUID stored at ~/.kiln/installation_id plus a salted one-way hash of your OS-level machine ID — never your name, email, IP, or any user identifier. It is on by default and opt-out with KILN_TELEMETRY=false. Beyond the heartbeat, free users have no account, no OAuth identity, no email on file, no per-person tracking, no cookies — we cannot identify you, contact you, or link your activity to a person.

The table below applies only to users who explicitly chose to create a paid-tier account (Pro / Business / Enterprise) by signing in through Google, Apple, or GitHub OAuth — plus two rows that apply to everyone (local product data, which stays on your machine by design; and support interactions, which exist only if you write to us).

What we deliberately do NOT collect: browsing history outside kiln3d.com, your 3D models (beyond fulfillment pass-through), your CAD prompts, your G-code, file paths or filenames, IP address or hostname (in heartbeats — see §3.2 for marketing-site analytics, which is consent-gated), audience-resale-style cross-site tracking data, biometric data, precise location data, inferences about your personality / political views / religion / orientation, or data on minors.

3.1 Usage heartbeats — what they are and aren't

The Kiln client (free or paid) sends one anonymous heartbeat per install per UTC day to our Supabase backend. This is the only product telemetry that runs by default. We describe it explicitly because it's the kind of thing most products mention only in passing.

Identifiers we send: a random UUID generated locally on first run (stored at ~/.kiln/installation_id with mode 0o600, never derived from your name, email, IP, MAC, hostname, or any user-identifying data) plus an opaque "device fingerprint" — a one-way SHA-256 hash of your operating system's machine identifier (IOPlatformUUID on macOS, /etc/machine-id on Linux, MachineGuid on Windows), salted with a Kiln-specific string and truncated to 32 hex characters. We cannot recover the underlying machine ID from the fingerprint, and a third party using a different salt cannot link our fingerprints to theirs. The fingerprint identifies a device (an OS install on a piece of hardware), not a person — stable across Kiln reinstalls, resets when the OS itself is reinstalled. We use it to count unique devices separately from unique installs (so reinstalls and Docker runs don't inflate user-count estimates).

What we send each day:

• installation UUID + UTC date
• device fingerprint (or empty string if machine-ID resolution failed)
• Kiln version (e.g. 0.5.0)
• printer model + adapter type (Bambu / Creality / OctoPrint / Moonraker / Serial) + printer count
• daily activity counts: prints, generations, decorations, textures, slices, downloads, print-hours
• pro_installed boolean (is kiln-pro installed alongside?)
• OS platform string (darwin, linux, windows)
• aggregate counts of textures used, decoration types, slicer profiles, marketplace sources, paywall denials — always counts, never user-attributable details

What we never send: email, IP address, MAC address, hostname, username, file paths, design content, G-code, model bytes, prompts, your CAD inputs, anything PII.

What we use it for: understanding which printers and OS platforms our users actually run, prioritizing fixes for breaking changes, answering "is Kiln growing?" without building per-user analytics. We never use it for advertising, profiling, or sharing with third parties.

How to opt out: set the environment variable KILN_TELEMETRY=false (or 0, no, off) before starting Kiln. The heartbeat thread is a no-op when telemetry is disabled.

3.2 Marketing-site analytics

The marketing site (kiln3d.com) uses Vercel Web Analytics — Vercel's first-party privacy-preserving analytics service. We enabled it in May 2026 to answer "is the marketing site getting traffic, where do visitors land, what's the bounce rate" before turning on paid acquisition.

Vercel Web Analytics processes: page URL, referrer, anonymous visitor count via a daily-rotating IP+user-agent hash (NEVER the raw IP), browser/OS family, and country (from IP geolocation performed at the edge before discarding the IP).

Vercel Web Analytics does NOT use: cookies, persistent identifiers, cross-site tracking, fingerprinting beyond the hashed visitor count, or any data that survives the daily salt rotation. There is no consent banner because there's nothing to consent to.

Scope: marketing site (kiln3d.com) only. The web workshop (app.kiln3d.com) is not instrumented with Vercel Web Analytics — its traffic is already captured by Supabase auth events for authenticated users, and we don't want to add a redundant data surface.

Subprocessor: Vercel Inc. (already our hosting subprocessor — see §5). The same SCC posture for international transfers applies; Vercel Web Analytics is not a separate vendor relationship.

Optional: third-party advertising + analytics (consent required)

If we're running paid acquisition campaigns, the marketing site may additionally load Meta Pixel (Facebook + Instagram ad attribution), Google Analytics 4 (aggregate behavior), and Google Ads conversion tracking (signup attribution). These load only when both gates are open: (1) the corresponding integration ID is configured for the deployment, and (2) you have granted explicit consent via the cookie preferences banner — analytics for GA4, advertising for Meta Pixel and Google Ads. With either gate closed, no third-party script loads, no event fires, no cookie is written. The cookie banner is not shown when there is nothing to consent to.

What gets shared (when active):

• Meta Pixel: page views and standard events (e.g. Lead, CompleteRegistration, Subscribe, Purchase). For measurement quality, we send SHA-256-hashed versions of any identifiers you've already provided to us — typically your email if you signed up. Meta receives the hash, not the raw value, and cannot reverse it. Our server-side Conversions API forwarder (api.kiln3d.com) pairs each browser fire with a server fire sharing the same event_id, so Meta dedupes the pair and we don't double-count.
• Google Analytics 4: page views with anonymized IP, browser / OS family, country, referrer, in-session events.
• Google Ads conversion tracking: binary "signup conversion occurred" plus the click identifier (gclid) if you arrived via a Google ad.

Withdrawing consent stops new tracking events. Click "Cookie preferences" in the site footer to re-open the banner and toggle off advertising or analytics. This does not delete data already collected — for that, use the rights process in §9.

Subprocessors: Meta Platforms, Inc. and Google LLC — see §5.

California residents: you may opt out of cross-context behavioral advertising at the cookie banner. We honor this by sending Limited Data Use (LDU) signals to Meta and equivalent flags to Google.

4. How we use it (processing purposes)

Every piece of data above maps to one of these narrow purposes:

1. Running your account — authenticating you via OAuth, resolving your tier, binding your OAuth identity to your paid entitlement.
2. Cloud storage + version control for your designs — the web workshop is a git-style layer for 3D designs. To make that work we store the designs you push, the branches you create, every version in your commit history, the comments on your PRs, the releases you tag, and the access log that tells collaborators who did what and when. We auto-generate thumbnail previews so you can browse your library visually.
3. Collaboration — when you invite someone to an org, we store the pending invite (their email + your org + the role you granted) so we can authenticate them when they accept; we enforce permissions on every cloud endpoint so only people in your org can see your org's designs.
4. Billing — processing subscription payments, handling upgrades/downgrades, issuing refunds, mailing invoices.
5. Rate limits + paywall enforcement — the usage_heartbeats table lets us count per-tier usage (how many fulfillment orders, how many cloud writes, etc.) so we can enforce plan limits without reading your content.
6. Fulfillment — routing your print order to the manufacturer you selected; tracking status until delivery.
7. Support — responding to issues you open with us and troubleshooting bugs.
8. Abuse and fraud prevention — detecting credential stuffing, license-key sharing, payment chargebacks, unauthorized access, and abuse of the collaboration features (spam invites, bulk scraping) — via the minimal security telemetry described above.
9. Legal compliance — retaining billing records for tax and accounting purposes (typically 7 years); responding to lawful legal requests (see §10).
10. Product improvement — anonymous, aggregated, install-scoped usage heartbeats (one row per install per UTC day, keyed by a random UUID + a salted machine-ID hash; see §3.1). On by default; opt-out via KILN_TELEMETRY=false. The marketing site (kiln3d.com) additionally uses Vercel's first-party privacy-preserving Web Analytics — no cookies, no PII, no cross-site tracking; see §3.2. We never sell or share either dataset.

We do not use your data for advertising, profiling for commercial purposes, or cross-context behavioral advertising. We do not sell or "share" (as defined under CCPA §1798.140) personal information.

5. Who we share it with (subprocessors)

We keep the list of processors intentionally short and publish it here. Each subprocessor is bound by a data-processing agreement that limits their use of data to the purposes we've asked them to perform.

We will publish any changes to this list with at least 30 days' notice before a new subprocessor begins processing your data.

We do not sell data, share data with data brokers, or use cookie-consent platforms or marketing automation tools whose business model depends on reselling user data.

The advertising and analytics services listed above (Meta, Google) are bound subprocessors under data-processing agreements; they receive only what's described in §3.2 and only with your explicit consent.

6. International data transfers

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is transferred to the United States for processing. We rely on Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) as the transfer mechanism for every subprocessor listed above. Supplementary measures (encryption in transit + at rest, minimum necessary data, audit logging) are applied per the EDPB's recommendations following Schrems II.

You can request a copy of the SCCs we use with any subprocessor by emailing adam@kiln3d.com.

7. Data retention

If you delete your account via /app/settings/account → Delete account, we begin the 90-day deletion window immediately and cancel any recurring subscriptions at the next billing cycle.

8. Cookies and local storage

The marketing site (kiln3d.com) uses Vercel Web Analytics (see §3.2) — cookieless by design, no consent required. If we're running paid acquisition campaigns, the site additionally shows a cookie preferences banner offering optional analytics + advertising cookies (Google Analytics 4, Meta Pixel, Google Ads — see §3.2 for the full list). Strictly necessary cookies are not used on the marketing site; the only cookie ever written is your consent record (kiln_consent) when you save a preference. If no banner appears on your visit, no third-party tracking is active for that visit.

The web workshop (app.kiln3d.com) uses:

• A Supabase authentication cookie (sb-access-token, sb-refresh-token) to keep you signed in. This is an essential cookie — without it the product can't work.
• A CSRF protection token for form submissions.
• localStorage for UI preferences (collapsed sidebars, recently-opened designs) — not transmitted to us.

We do not use Segment, Mixpanel, Amplitude, or any cross-site tracking platform whose business model is audience resale. The only third-party analytics that may run on kiln3d.com are Google Analytics 4 and Meta Pixel — and only with your explicit consent (see §3.2). Neither is loaded on the web workshop (app.kiln3d.com) at all. Vercel Web Analytics is first-party, cookieless, and the only analytics that runs without consent.

9. Your rights

We respect the rights granted by the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and similar US state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas DPSA, etc.).

For all users, regardless of location:

• Right to access — get a copy of the personal data we hold about you.
• Right to correct / rectify — fix inaccurate or incomplete data.
• Right to delete / erase — ask us to delete your personal data (subject to legal retention requirements above).
• Right to portability — receive your data in a machine-readable format (JSON / CSV).
• Right to restrict processing — pause certain processing while we investigate a dispute.
• Right to object — object to processing based on our legitimate interests (§4 point 5).
• Right to withdraw consent — for any processing you consented to, you can withdraw consent at any time without affecting processing that already occurred.

For California residents (CCPA / CPRA):

• Right to know — what categories of personal information we've collected, sold (we don't), or shared for cross-context behavioral advertising (we don't).
• Right to delete — subject to the exceptions in §1798.105(d).
• Right to correct — fix inaccurate personal information.
• Right to opt out of sale or sharing — we don't sell or share personal information within the meaning of CCPA §1798.140. Do Not Sell or Share My Personal Information link is here for completeness even though it's a no-op for us.
• Right to limit use of sensitive personal information — we don't collect sensitive PI (as defined by §1798.140(ae)) that would require this right.
• Right to non-discrimination — exercising your rights will never result in worse service, higher fees, or reduced features.

To exercise any right, email adam@kiln3d.com from the email address on your Kiln account. We will respond within 30 days (or 45 days for CCPA requests, as permitted). We verify identity by confirming the request came from the account email; for sensitive requests (deletion, large exports) we may ask you to confirm via a magic link to your account email.

Right to lodge a complaint: you can lodge a complaint with your supervisory authority at any time:

• EU/EEA residents — your national data protection authority (e.g., CNIL in France, BfDI in Germany, AEPD in Spain).
• UK residents — the Information Commissioner's Office (ICO) at https://ico.org.uk.
• California residents — the California Attorney General (https://oag.ca.gov/privacy) or California Privacy Protection Agency (https://cppa.ca.gov).

10. Responding to legal requests

We will disclose your data in response to a valid legal process (subpoena, court order, search warrant) when we have a good-faith belief that the law requires it. Where legally permitted, we will notify you before disclosure so you have the opportunity to challenge the request.

We publish an annual transparency report enumerating the legal requests we received and how we responded. The first report will cover the 2026 calendar year.

11. Children

Kiln is not directed to individuals under 16 years of age (EU/UK) or under 13 (US/COPPA jurisdictions). We do not knowingly collect personal data from children. If you believe a child has provided us personal information, contact adam@kiln3d.com and we will delete it promptly.

12. Data security

We apply industry-standard security controls:

• Encryption in transit — TLS 1.2+ on every connection.
• Encryption at rest — Supabase + Stripe + Fly.io all use AES-256 at-rest encryption for databases and storage.
• Access controls — Supabase Row-Level Security (RLS) on every sensitive table; service-role keys restricted to server-side environments and never shipped client-side. RLS policies audited publicly at https://github.com/codeofaxel/Kiln-pro/tree/main/scripts/audit_rls.py.
• Secret management — secrets stored in Fly.io's managed secrets, never committed to source control.
• Least privilege — internal admin access is granted per-task, logged, and expires after 24 hours.
• Dependency scanning — automated vulnerability scanning on every merged commit.
• Device security — local database files created with owner-only read/write permissions (0600 on Unix-like systems).

No security measure is absolute. If you discover a vulnerability, please report it to adam@kiln3d.com. We follow coordinated disclosure and will acknowledge within 3 business days.

13. Data breach notification

In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify affected users without undue delay and within 72 hours of discovery (per GDPR Art. 33 + CCPA §1798.82);
• Notify relevant supervisory authorities where required;
• Document the breach, its effects, and our remediation actions in a permanent record.

Notifications are sent to the email address on your account. Keep it current via /app/settings/account.

14. Automated decision-making

We do not make decisions that produce legal effects or significantly affect you solely through automated means. Tier resolution, billing, and entitlement checks are automated but deterministic (not profile-based) and subject to human review on dispute.

15. Enterprise customers — Data Processing Addendum

If you are using Kiln Business or Enterprise tier on behalf of an organization, a Data Processing Addendum (DPA) incorporating Standard Contractual Clauses and Article 28 GDPR terms is available on request. Email adam@kiln3d.com.

16. Changes to this policy

We will update this policy from time to time. For material changes (new categories of data collected, new subprocessors, new purposes), we will:

• Email you at least 30 days before the change takes effect;
• Update the "Last updated" date and increment the version number at the top of this document;
• Preserve prior versions in the public Git history at https://github.com/codeofaxel/Kiln/blob/main/PRIVACY.md.

Non-material changes (typos, reorganization) are pushed immediately and noted in Git history.

17. Contact

• Privacy questions — adam@kiln3d.com
• Legal / DPA requests — adam@kiln3d.com
• Security issues — adam@kiln3d.com
• General contact — adam@kiln3d.com
• Postal mail — Hadron Labs Inc., c/o Harvard Business Services, Inc. (Registered Agent), 16192 Coastal Hwy, Lewes, DE 19958, USA

We respond to privacy requests within 30 days (EU/UK) or 45 days (CCPA) from receipt.