What is stored, and what never leaves.

Last updated 12 September 2026. This describes this MATERIALHAUS installation as it is built today, not an intention.

The short version

Everything is on the server that serves this page. There is no analytics script, no advertising pixel, no third-party tracker and no cookie banner, because there is nothing to consent to. One cookie exists and it is the one that keeps you signed in.

What is stored

What	Where	Why
Email address	accounts.db	Identifies the account and is how you sign in.
Password	accounts.db	Never stored. What is kept is a PBKDF2-HMAC-SHA256 hash with a salt of its own, which cannot be turned back into the password.
Name and profile	accounts.db	Display name, practice, discipline and receipt addresses — all optional and all yours to clear.
Sessions	accounts.db	Only the SHA-256 of each session token, so a copy of the database cannot be used to sign in as you.
Assets and recipes	the assets folder	The materials and cutouts you generate, and the specification that produced each one.
Uploaded images	the assets folder	Kept with the asset they produced, so it can be reopened and re-exported.
Usage count	usage.db	How many creations your workspace has spent, so the free allowance can be counted.
Theme choice	your browser	Light or dark, in localStorage. It never reaches the server.
Collections and favourites	your browser	Also localStorage, which is why they do not follow you to another machine.

The one cookie

Signing in sets a single cookie holding a random session token. It is marked http-only, so page scripts cannot read it and a cross-site scripting bug cannot carry it off, and it lasts 30 days. Signing out deletes it on the server as well as in your browser, so a copy of it is worth nothing afterwards.

There are no other cookies. Nothing here profiles you, and nothing follows you to another site.

What leaves the server

Your photographs do not. Background removal for cutouts runs on this machine with a local model. An uploaded image is not sent anywhere to be processed.

Two outbound requests exist, and neither carries anything about you:

Poly Haven is asked for a scanned surface when you pick one from the catalogue. The request names the texture, nothing else.
An image provider is contacted only if AI generation has been switched on with an API key, in which case your prompt reaches that provider under their terms. It is off by default and this build renders locally without it.

Fonts are served from this site rather than from a font CDN, so loading a page does not tell anybody else that you did.

Getting your data out, or removing it

Every asset is downloadable as a ZIP from your downloads , with the recipe that produced it in the package — so your work is portable without asking anyone.

There is no self-service delete yet. Until there is, whoever runs this server can remove an account and its assets on request; the data is a row in a SQLite file and a folder on disk, nothing more.

Security, stated plainly

Passwords are hashed with 600,000 rounds of PBKDF2-HMAC-SHA256 and a per-password salt. Session tokens are random and stored only as hashes. Sign-in attempts are rate limited.

What is missing, and should be before this is public: email verification, password reset, and two-factor authentication. There is also no encryption at rest beyond whatever the disk provides, and the cookie is only marked secure when the server is told it is behind HTTPS.

Contact

For anything about what is held, or to have it removed, contact whoever runs this installation.