Security and your pictures

Where your picture goes

1. You upload a screenshot. We keep a copy in a private storage bucket (Supabase, EU region Frankfurt, Germany).
2. To make a render, we send the picture, your look settings and your notes to fal.ai, which runs the image models. Some of those models are made by other companies, for example Google's image model behind the Standard and HD renders.
3. To read a note such as "make the wall white" and find the part to change, a Google language model sees your picture and note. That call goes through fal.ai and its router, OpenRouter.
4. The finished render comes back and we copy it into the same private bucket. It shows in your renders.

Who can see your pictures

• You. Your pictures are in your account and in no public list.
• Anyone who holds a link. A stored picture is served through the app at an address that contains a long random code. We do not list it, index it or link to it. Someone who has the address can open it, so share the address only with people who may see the picture.
• People you choose. A picture is shared only when you press Share or make a review link. Both can be switched off later.
• Our team. Our admin tools can show your renders, for example to look into a problem or to check render quality. A picture you attach to a feedback note is sent to us on purpose.
• Our suppliers, as listed in the privacy policy, while they process it.

What we do not do

• We do not publish your pictures, and we do not use them on this site, in examples or in our ads. Our examples are our own pictures.
• We do not train any model of our own on your pictures. We do not make models.
• We do not sell your pictures or your data.

What our suppliers say, and what we cannot promise

We cannot honestly say that no one ever trains on your pictures, because part of the work is done by other companies. This is what we found when we read their published terms on 7 November 2026. Their terms can change; read the originals.

• fal.ai, our rendering supplier. Its API terms say it will not use customer content to create, train or develop its own products or services. They make an exception for models it labels "Pending Enterprise Ready". Its general terms also let it use anonymized or aggregated usage data, which may be derived from inputs, to develop its products and models. (fal.ai API terms, fal.ai terms)
• Models made by other companies. fal.ai says that when you use a third-party model through its platform, the content is passed to that company. How that company treats it is set by its own terms. We have not checked those terms for every model, so we make no promise about them.
• How long fal.ai keeps files. Its documentation says generated and uploaded files stay on its file servers for at least 7 days by default, that request history can also be stored, and that a customer can shorten or switch off these per request. We have not changed those settings yet.

If a contract with your client forbids sending pictures to outside AI suppliers, do not upload them. Write to hello@3dstudio.co first and ask what we can do.

How long we keep pictures, and how to delete them

• Pictures stay until you delete them. A deleted render goes to Trash for 30 days, and you can restore it. Its share link stops working at once. After 30 days, or when you choose Delete for good, its stored files are removed.
• Deleting your account removes your files, renders, review links and login at once.
• Copies at our suppliers and in backups can last a little longer. The full list is in the privacy policy.

Passwords, payments, keys

• You sign in with Google or with a link sent to your email.
• We never see your card number. Payments are handled by Stripe.
• API keys and connector tokens are stored only as hashes.

Report a problem

If you find a security problem, write to hello@3dstudio.co. The contact is also published in security.txt.