Privacy policy

• What you type into a form. The contact form takes your name, email address and message. The mailing list form takes an email address. Nothing else on this site asks you for personal information.
• Payment details. Card data is entered on Polar's checkout page and never touches our servers. Polar is the merchant of record — the charge on your statement is theirs. What comes back to us is the name, email address and billing address you bought under, the amount, the order status and Polar's identifiers for the checkout and the order. The billing address is collected because Polar needs it to work out the tax on your purchase. The licence record we keep is built from the name, the email and the order identifiers.
• Usage data. Pages you visit, referring page, approximate location from your IP address, browser and device type — collected by Google's tag, described in section 3.
• Server logs. The site is hosted on Vercel, which logs requests including IP address and user agent as part of running the service.

There are no user accounts on this site. There is nothing to log into, so there is no password of yours for us to hold.

• Polar — runs the checkout and processes the payment as merchant of record. Card details are entered on Polar's pages and held by Polar, never by us. Polar sets its own cookies on its checkout pages for fraud prevention.
• Supabase — hosts the licence registry, a database we operate. A paid order writes one row: the name and email you bought under, your licence key, whether it is active, and Polar's order identifiers. That row is what the software checks at activation and what the licence pickup page reads.
• Resend — delivers email. Contact form messages are emailed to us through Resend, mailing list signups are stored as a contact in a Resend audience, and the licence key email after a purchase is sent through it.
• Cloudflare Turnstile — the bot check on our forms. Submitting a form sends a verification token and your IP address to Cloudflare so it can confirm you are a person.
• Google — analytics and advertising tags, described next.
• Vercel — hosting.

We do not sell your personal information and we do not trade it for anything. We hand it to the services above because the site cannot take a payment or send an email without them.

Nothing Google-related loads until you accept it. The first time you visit, a bar at the foot of the page asks. Until you answer — and for as long as you decline — no request is made to Google, and no analytics or advertising cookie is set. Nothing on this site sits behind that answer: declining costs you no functionality.

If you accept, Google's gtag.js script loads. It is configured with a Google Ads tag, which is what lets us tell whether an ad we paid for actually brought anyone here. When a Google Analytics 4 property is configured, that runs through the same script and records page views and basic interaction events.

Those tags set cookies in your browser — typically _ga and a matching _ga_<id> for analytics, and a _gcl_* cookie for ad attribution — and they send Google the page you are on along with your IP address and user agent. Browser settings, tracker blockers and ad blockers all stop them as well, and the site works normally without them.

Your answer is remembered in your browser's local storage, under apex-cookie-consent. It stays on your machine and is never sent to us. Clearing this site's data makes the bar ask again.

The Fusion 360 add-in runs on your machine. Your designs, your customers' STEP files and your saved revisions are files on your own disk. They are not uploaded to us, and we cannot see them unless you deliberately send them to us — for example, attaching a design file to a support email so we can reproduce a problem. If you do that, we use it to answer your question and nothing else.

The shipped build makes exactly one outbound network call, and this is it: at startup it asks our licence registry, hosted on Supabase, whether your licence is still good. That request carries your licence email and your licence key over HTTPS and nothing else — not your designs, not your file names, not your computer's name, not a usage report. The answer is one word: valid, revoked or unknown. It times out after three seconds, the result is cached on your own disk, and a check that cannot reach the network is ignored rather than treated as a licence problem, because a shop with dead Wi-Fi is normal rather than suspicious.

There is no update check, no crash reporting, no telemetry and no analytics in the add-in. That one licence call is the whole list.

• Order and licence records: to know who paid, which key is theirs and whether it is active, and because tax records have to exist. The key is bound to the purchase email, so the record has to hold that email for the licence to keep working.
• Email address: to reply to you, to deliver the licence and re-send it when asked, and to send the mailing list if you asked for it.
• Usage data: to see which pages people read and whether our advertising is worth the money.

Contact form messages are deleted a year after the conversation ends. Mailing list entries are deleted a year after you unsubscribe — unsubscribing takes you off the list straight away; the year is only how long the record of having been on it survives.

Order, payment and licence records are the exception and are kept longer. Tax records have to exist, and a perpetual licence has to go on working, which means the registry has to go on holding the email the key is bound to.

• Email kelly@apexdesign.store to ask what we hold about you, to correct it, or to have it deleted. We will do it. Payment records we are required to keep for tax are the one exception, and we will tell you if that applies.
• Every mailing list email has an unsubscribe link. Unsubscribing does not affect an order.
• Block the Google tags with your browser settings or an extension if you would rather not be counted.

The site is served over HTTPS. Card numbers go straight to Polar and are never stored by us. Access to the licence registry and the email tooling is limited to Apex Design. We are one person and a small stack, not a bank — we are telling you what is true rather than describing security we do not have.

Privacy questions go to kelly@apexdesign.store or through the contact form.

The business responsible for the data described here is Trinity Carbon Works LLC, a Virginia limited liability company doing business as Apex Design. On paper: