Privacy Policy — foil.tools

Effective date: August 18, 2026 (previous version: June 16, 2026) Operator: FOIL.TOOLS LLC ("we," "us," "our") Mailing address: PO Box 119, Husum, WA 98623 Contact: [email protected]

This Privacy Policy explains what personal data foil.tools (the "Service") collects, why, and your choices.

1. Data we collect

You provide:

• Account data — email, name, and authentication identifiers, via our auth provider (Clerk).
• User Content — airfoil and wing designs, presets, and submitted issues/feature requests you create, and — if you use the community area — your published designs, comments, profile details, and the designs you like.
• Payment data — when you buy credits, our processor (Stripe) collects your payment details. We do not receive or store your full card number. We store a payment-customer identifier and a transaction history (amounts, credit balances, timestamps).

Collected automatically:

• IP address — we log IP addresses for security, abuse prevention, sanctions/export compliance, and rate-limiting (for example, to detect and block prohibited or abusive traffic). This processing is necessary for the security and lawful operation of the Service.
• Usage data — aggregate counters of feature use (e.g., number of analyses/optimizations), request metadata, and approximate country (from network information) for the above purposes. We collect this through both our own first-party analytics and a third-party analytics provider (Umami).
• Cookies/local storage — strictly necessary cookies for authentication and session, and local storage for app preferences.

2. Why we use it (lawful bases)

• To provide the Service and process payments — performance of our contract with you.
• Security, anti-abuse, and legal/sanctions compliance — our legitimate interests and legal obligations (including blocking sanctioned jurisdictions and preventing prohibited uses).
• To communicate about your account, purchases, or material changes.

3. Sharing & sub-processors

We do not sell your personal data. We share data with service providers who process it on our behalf, including:

Each processes data under its own terms and our data-processing agreements. We may also disclose data to comply with law or to protect rights, safety, and the integrity of the Service.

3.1 Information you publish

Publishing to the community area makes information public. A published design, its title and write-up, its measured properties and analysis, and your display name, handle, avatar, profile bio, and the month you joined are visible to anyone — including people without an account — and can be indexed by search engines and shown in link previews on other sites.

This is not something we can fully undo. Unpublishing removes the design from the Service, but content that was public may already have been copied, cached, or archived by third parties beyond our control, and — for designs published as open — others may legitimately hold copies and derivative designs (see Terms §5.1).

Publishing is always your choice. Saved designs are private by default and stay that way unless you publish them.

3.2 Automated screening of comments and support email

Comments you post in the community area are checked by an automated classifier — a quick check when you post, and a fuller one within a few hours — and email you send to our support address may be processed by automated tooling to draft a reply. The Acceptable Use Policy §3b explains what the screening looks for, what it can do, and how to appeal a decision you think is wrong.

Two things we want to be plain about:

• This processing runs on hardware we operate. The text is not sent to a third-party AI provider. If that ever changes, we will update this policy and the sub-processor table above before the change takes effect.
• No reply is ever sent to you automatically. A drafted support reply is read by a person, who decides whether to send it. The tooling has no ability to send mail on its own.

We store the outcome of each automated check — the decision, a short reason, and which check made it — alongside the comment it relates to, so that a wrong decision can be found and reversed.

4. International transfers

The Service is operated from the United States; your data may be processed there and in the regions our providers operate. Where required, we rely on appropriate transfer safeguards.

5. Retention

We keep account data and User Content while your account is active. Security logs containing IP addresses are kept only as long as needed for security and compliance and then deleted or rotated (short retention). Transaction records are kept as required for tax, accounting, and audit purposes.

Published designs and comments are kept while published. Deleting a comment or unpublishing a design removes it from the Service; a hidden or removed item and its screening record are retained for a period afterwards so that moderation decisions stay auditable and reversible, and so that a removal can be enforced. See §3.1 for what unpublishing cannot undo.

6. Your rights

Depending on your location (e.g., EEA/UK under GDPR, California under CCPA/CPRA), you may have rights to access, correct, delete, export, or object to processing of your personal data, and to withdraw consent. You can manage profile data and delete saved designs in your account, or contact [email protected] to exercise rights. We will respond as required by law. You may also lodge a complaint with your data-protection authority.

7. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided data, contact us to delete it.

8. Security

We use technical and organizational measures (including access controls, encryption in transit, and edge protections) to protect data. No system is perfectly secure; we cannot guarantee absolute security.

9. Changes

We may update this Policy; material changes will be posted with a new effective date.

10. Contact

Questions or requests: [email protected].