← Back to FigureForge

Privacy Policy

This page describes what data FigureForge (figureforge.io) collects, how it is processed, and what choices you have. The service is operated by Marius Drysch, MD, MHBA. For questions reach info@figureforge.io.

Summary

  • Figure assembly happens locally in your browser. The images you import are not uploaded unless you choose to save a figure to your account.
  • Without an account you can use the full editor in guest mode. No personal data is collected beyond anonymous usage statistics.
  • With an account we store your email address (for sign-in), the figures you choose to save, and usage events linked to your account.
  • We use Vercel for hosting and Supabase for authentication and data storage. We do not use advertising trackers or sell data.

1. Controller

Controller within the meaning of the EU General Data Protection Regulation (GDPR / DSGVO) is Marius Drysch, MD, MHBA, c/o SCHUTZADRESSE.COM #566, Waidmannsluster Damm 1, 13507 Berlin, Deutschland. Email: info@figureforge.io.

2. Data processed in guest mode

When you visit FigureForge without signing in, the editor runs entirely in your browser. Files you drag onto the canvas are decoded and rendered locally; they are not sent to our servers. The only data that leaves your device are standard HTTP request metadata (IP address, user agent, referrer), aggregated, cookie-less Vercel Analytics events, and the usage events described below. Vercel Analytics does not use cookies and does not cross-link visits.

To understand how the editor is used, FigureForge records a small set of usage events: opening the editor, adding images (with the number of images and whether they came from the built-in example), exporting a figure (with the file format and the selected journal), saving a figure, and creating an account. Each event carries a random identifier that exists only while the page is open; it is not stored on your device, and reloading or closing the page discards it. Events contain no file names, image content, IP address, or other information about you. They are stored in our Supabase database in the EU.

3. Data processed with an account

If you create an account we collect:

  • Your email address, processed by Supabase Inc. for authentication (sign-in, magic-link delivery, password reset).
  • The figures and projects you choose to save: layout metadata, per-panel image data, your selected journal preset, label settings, and optional thumbnails. Stored in a Supabase Postgres database located in the EU.
  • The usage events described in section 2, linked to your account while you are signed in, so we can see whether the service is used repeatedly.
  • If you click Notify me on the pricing page or after an export, a note that your account wants one email when the planned Pro or Lab plan launches, with the date of your request.
  • Server logs from Vercel containing request metadata (IP, user agent, route, response time) retained for diagnostic purposes.

4. Legal basis

  • Provision of the service and account management: Art. 6 (1) (b) GDPR (contract).
  • Aggregated analytics, usage events, and server logs: Art. 6 (1) (f) GDPR (legitimate interest in a stable and improving service).
  • Optional features (e.g. saving figures, sharing, the Pro and Lab launch notification): Art. 6 (1) (a) GDPR (consent), revocable at any time.

5. Sub-processors

The following providers act as data processors on our behalf:

  • Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Hosting, edge delivery, server logs, and Vercel Analytics. A Standard Contractual Clauses-backed data processing agreement is in place.
  • Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992. Authentication, Postgres database, and usage events. Data is stored in the EU region.

6. Cookies and local storage

FigureForge uses browser localStorage to remember UI preferences (for example your last-used project and dismissed tips) and a small Supabase authentication cookie if you sign in. No advertising or third-party tracking cookies are set.

7. Retention

Account data is kept until you delete your account. Saved figures are kept until you delete them. Usage events are deleted after 24 months, or earlier together with your account. Launch-notification requests are kept until you remove them on the pricing page, until the launch email has been sent, or until you delete your account. Server logs are retained for up to 30 days for security and diagnostic purposes and then rotated out.

8. Your rights

Under the GDPR you have the right to:

  • request information about the data we hold (Art. 15);
  • request correction of inaccurate data (Art. 16);
  • request deletion (Art. 17);
  • request restriction of processing (Art. 18);
  • data portability (Art. 20);
  • object to processing based on legitimate interests (Art. 21);
  • withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Contact info@figureforge.io to exercise any of these rights. You also have the right to lodge a complaint with a supervisory authority, typically the data protection authority of your country of residence.

9. International transfers

Some of our sub-processors are based outside the EU. Transfers rely on the European Commission's Standard Contractual Clauses and equivalent safeguards as appropriate.

10. Changes to this policy

We may update this page to reflect changes in the service or applicable law. Material changes will be noted at the top of the page. The current version date is the last build date of this site.