Privacy

A plain-language account of what CosFaro collects, kept on this one page rather than split across a legal document nobody reads. If something here changes, this page changes with it.

Using the tools without an account

Poster Maker, Prop Scaler, Unfolder, and Pattern Editor all run entirely in your browser — your photo or model file, your calibration, your generated output. None of it is uploaded anywhere or seen by our server unless you register and explicitly save a project. Closing the tab without an account leaves nothing behind on our end.

If you create an account

We store your email address and a hashed password (never the password itself), plus your account creation date and any display preferences (language, units) you've set. Your email is used only to verify the account, let you log in, and send a password-reset link if you ask for one — never for marketing, and never shared with or sold to anyone.

Any project you explicitly save is stored tied to your account — the uploaded file, calibration/configuration, and generated output — so you can come back to it later. Deleting a project deletes those files.

Anonymous tool usage telemetry

While logged in, the four tools above report a small number of anonymous usage/error events (e.g. "export succeeded", "upload failed") so we can see whether a tool is actually working — never which project, file, or account it happened on. This never fires for a signed-out visitor.

Site activity (page views)

Every page load reports its path, the referring site's domain (not the full URL), and a coarse device category (desktop/mobile/tablet) — to a page-view counter admins use to see which pages get visited and whether the site is up. This applies to every visitor, including guests, not just account holders.

No cookie is set for this, and nothing about you is stored that lasts beyond a single day: your IP address is never saved — it's combined with your browser's user-agent string and a random value that changes every day and is thrown away immediately after, producing a value that can't be linked back to you or compared across days. We use the same throwaway value only to avoid double-counting a page reload within the same day.

Known search-engine/bot traffic is filtered out of these numbers rather than counted as a real visit. If you use a browser extension that blocks tracking scripts, this page-view beacon may be blocked too — we consider that your call to make, not something to work around.

Bug reports

Anyone can report a bug from any page, logged in or as a guest, via the "Report a bug" link. Everything in it is your choice: a description, your email if you want a reply, a screenshot, and (only inside a tool, and only if you tick the box) an export of your current project - none of it is required, and you can submit with nothing but a description.

Your browser/OS, the page you were on, and (if one just happened) the last in-browser error are always included automatically, so we have enough to debug the report. If you're logged in, we note that silently; we never ask you to identify yourself. Reports are visible only to admins and are kept to help fix the issue.

Cookies

CookiePurposeLifetime
PHPSESSID Keeps you logged in between page loads; also holds one-time confirmation messages. Up to 24 hours idle
REMEMBERME Keeps you logged in across browser restarts — only set if you check "Remember me" at login. 30 days
locale, units Remembers your chosen language and measurement units as a guest, before you've registered. 365 days
A per-submission security cookie Confirms a form submission came from this site, not another one. Set right before you submit a form, removed right after. Seconds

Third parties

Account emails (verification, password reset) are sent through a transactional email provider, which sees the email address and message content needed to deliver that one email — nothing else about your account or activity. There are no ad networks, no third-party analytics trackers, and no content loaded live from a third-party CDN on this site.

Where this is stored

Everything above lives on servers we operate ourselves — not a third-party analytics or hosting platform with its own separate data practices.