Privacy Notice

Pixelyte, a trading name of Marlsoft is the controller of the personal data described here. That means we decide what is collected and why, and we are the people to contact about it.

This notice covers the Space Forger planner. It does not cover sites you reach by following a link out of the app.

Guest mode is local-only. The projects you create — room dimensions, items, zones, titles, units and budgets — are written to this browser's local storage on your device. They are not sent to us and we cannot see them.

Because nothing is stored on our side, clearing your browser's site data, using private browsing or moving to another device means those plans no longer exist and we cannot recover them.

Sign-in is handled by this application itself. We store the email address you sign up with and a salted, deliberately slow hash of your password — never the password itself. A session cookie identifies your browser until you sign out or the session expires; no third-party sign-in provider receives your credentials.

When you save a project while signed in, we store it against that identifier: the project title, the space type, the complete plan (room shell, items, zones, openings, units and budget), the timestamps it was created and changed, and a marker if you delete it. Plans made in the browser before you signed in are uploaded to the account once, on that first sign-in, so they are not lost.

To provide the service you asked for: saving projects to your account and syncing them to your other devices, which is performance of our contract with you.

To keep the service secure and working: restricting each project to its owner, preventing one account from reading another's data, and diagnosing failures. This is our legitimate interest in running a safe service.

To answer your requests and meet legal obligations, for example responding to a deletion request or a lawful demand for information.

We do not use your plans for advertising, we do not sell personal data, and we do not use your plans to train models.

Out of the box the app stores accounts and projects itself, in a file on the server that runs it, so no outside provider handles your data. If the operator configures a PostgreSQL database, that database provider processes account projects on our instructions and is bound to protect them. If the operator configures an email provider, it processes your address in order to deliver confirmation and password-reset messages. The provider that hosts the application also processes requests in the course of serving it.

Some providers process data outside your country. Where that happens, transfers rely on the safeguards those providers have in place, such as standard contractual clauses.

We may also disclose data where the law requires it, or to establish or defend legal claims. We do not share your plans with advertisers or data brokers.

Signed-in sessions rely on a single httpOnly cookie set by this app, which keeps you signed in and lets the server recognise your requests. Blocking it means you cannot stay signed in, though guest mode still works.

Local storage holds guest projects and a cached copy of the projects fetched for the signed-in account, so the editor opens instantly and keeps working if the network drops.

There are no advertising cookies and no third-party analytics or tracking scripts in the planner today. If that changes, this notice will say so first.

Cloud projects are kept until you delete them. A deleted project is marked as deleted rather than left visible, so that other devices signed in to your account remove their copies instead of restoring it; that marker is kept while the account exists.

Account details are kept while your account exists. Server and provider logs, which record requests but not the contents of your plans, are kept for a short period for security and troubleshooting.

If you ask us to remove your account, we delete the account identifier and its projects, except where we must keep something to meet a legal obligation.

You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or object to how it is used, and ask for it in a portable format. Where we rely on consent you can withdraw it at any time.

You do not have to ask us for a copy: Export all on the projects page downloads every plan as a single JSON file, including guest plans that were never uploaded.

We email you only about your account: a confirmation link when you sign up, and a reset link when you ask for one. Those messages are the reason we need an address at all.

To make a request, write to privacy@pixelyte.example from the address associated with your account. We may need to confirm you control that account before acting.

If you are unhappy with how we have handled your data you can complain to your local data protection authority. We would appreciate the chance to put it right first.

You do not need to ask us to delete a single plan: use the delete action on the projects page. That removes it from this browser and, when you are signed in, from your cloud account, and the deletion propagates to your other devices.

To stop syncing, sign out. Plans already cached in that browser stay there until you delete them, so delete them first if the device is not yours.

To remove your account and everything stored with it, use Delete account at the bottom of the projects page. It erases every cloud project, closes the sign-in account and clears the copy cached in this browser. If you can no longer sign in, write to the address above and we will remove it for you.

Passwords are stored only as salted scrypt hashes, sessions are opaque random tokens in httpOnly cookies, and account projects are fetched and written only for the account proven by the current session — never for an identifier supplied by the browser. Plan payloads arriving from a device are validated and size-limited before they are stored. Serve the app over HTTPS so traffic is encrypted in transit.

No service can promise perfect security. If you believe an account has been compromised, change your credentials with the sign-in provider and tell us.

Space Forger is a planning tool for people arranging real spaces. It is not directed at children under 16, and we do not knowingly create accounts for them.

If what we collect or why changes, this notice is updated and the date at the top changes with it. Significant changes will be flagged in the app before they apply.

Space Forger is created by Pixelyte, a trading name of Marlsoft. Privacy questions and requests go to privacy@pixelyte.example.