FormaCAD Privacy Policy
Last updated: October 19, 2026
This Privacy Policy explains what personal information the operator of FormaCAD, a sole proprietorship operating under the name "FormaCAD" in Canada ("FormaCAD", "we", "us", "our") collects when you use the FormaCAD website and web application at formacad.app and our desktop application (together, the "Service"), how we use and share it, and the choices and rights you have. It applies to users in Canada, the United States and elsewhere.
FormaCAD is a 2D drafting tool. It is not affiliated with, endorsed by, or sponsored by Autodesk, Inc. or any other CAD vendor.
By creating an account or using the Service you acknowledge this Policy. Where the law requires your consent (for example, for advertising cookies), we ask for it separately.
1. Who is responsible
FormaCAD is currently operated as a sole proprietorship, not a corporation. The person responsible for your personal information, and designated to ensure compliance with this Policy, is the Privacy Officer:
FormaCAD, Canada
Attention: Privacy Officer
Email: support@formacad.app
Mailing address: available on request by writing to the email above
2. Where your drawings are kept
The .dft files, DXF, SVG and PDF files you create are generated in your browser or on your computer and saved where you choose. Imported PDFs, images and DXF files are processed locally in your browser. If you lose a file that you saved on your own device, we cannot recover it for you.
A .dft file can hold more than shapes: component prices and supplier details, pictures and documents you attach, and project information from Project Settings (for example the client, team and contact details, the site address and project files). All of it stays inside the file on your device; we do not receive it.
Loading product information. When you ask FormaCAD to read a product page (a component's "Load information"), our server visits the address you give, reads the page and downloads only the pictures and documents you pick, and passes them to your browser. We do not keep the page, the files or the address afterwards; the request is linked to your account only to apply its rate limit.
We ask that you do not send us confidential drawings or files by email unless we ask you to.
3. Information we collect
a) Information you give us
- Account information: email address, and name if you provide it or sign in with Google.
- Password: handled by our authentication provider (Clerk). We never see or store your password in readable form.
- Messages you send us (for example feedback or support requests), including your email address and the content of the message.
b) Information collected automatically
- Sign-in events: date and time, sign-in method (email or Google), and approximate location (country and city) derived from your IP address by our hosting provider.
- A one-way cryptographic hash of your IP address (we do not keep the readable IP address in our database) used to detect abuse.
- Usage limits: which actions you performed (save or export) and when, so we can apply the free-plan limits.
- Technical data our servers receive with every request: IP address, browser type, device type and request time, which are kept in short-lived hosting logs.
- Preferences stored in your browser (for example zoom speed, the time your visit started, and whether you have seen a notice) using local storage. These stay in your browser.
- Preferences kept with your account when you are signed in, so they follow you to another device: your keyboard shortcuts and shortcut mode, your highlight and cursor colors, whether the Compass Cube shows, and the unit new drawings start in.
c) Advertising and cookies
- The free plan is supported by ads from Google AdSense. Google and its partners may use cookies, device identifiers and similar technologies to show and measure ads, and may show personalized ads if you allow it. See Section 7.
We do not intentionally collect government identifiers, health information, precise location, biometric data, or the content of your drawings.
4. How we use your information
- To create and secure your account and let you sign in.
- To provide the Service and apply any plan limits that may apply in the future.
- To detect, prevent and respond to fraud, abuse, and security incidents.
- To show ads on the free plan.
- To measure how the Service is used, in aggregate, so we can improve it.
- To respond to your messages and to send service notices (for example changes to these terms, and security notices).
- To occasionally tell you about important product updates or to ask for your help testing something. You can opt out at any time (Section 9).
- To comply with legal obligations and enforce our Terms of Use.
We do not use your information to make decisions about you that have legal or similarly significant effects, and we do not use automated decision-making or profiling for that purpose.
5. Legal bases and consent
Where privacy law requires a legal basis (for example, if you are in the European Economic Area or United Kingdom), we rely on: performance of our contract with you (account and plan limits); our legitimate interests (security, fraud prevention, aggregate analytics); legal obligation (tax and accounting records); and your consent (advertising cookies and optional emails), which you can withdraw at any time.
In Canada we rely on your knowledge and consent, which may be implied for information that is reasonably necessary to provide the Service, and express for advertising cookies and marketing emails.
6. Who we share information with
We do not sell your personal information for money. We share it only as follows:
| Recipient | Purpose | What they receive |
|---|---|---|
| Clerk | Authentication, account management, sign-in with Google | Email, name, password (hashed by Clerk), sign-in data, and the preferences that follow your account |
| Vercel | Hosting and serverless functions | Request data (IP address, browser, request time) |
| Neon | Database hosting | Account email, sign-in events, usage limits |
| Google (AdSense, Funding Choices) | Ads on the free plan and the consent message | Device and browser data, cookie identifiers, ad interactions |
| Google (sign-in with Google, if you choose it) | Sign-in | The account you choose to sign in with |
| Google Fonts (when you choose a font for text) | Delivering the font files to your browser | Your IP address and browser data, as with any web request |
| Websites you ask us to read (Load information) | Reading the product page you named | Our server's request for that page; nothing about you |
| Professional advisers, and authorities when required | Legal, tax, audit, and to respond to lawful requests | Only what is required |
| A successor, in a merger or sale of our business | Continuity of the Service | Your information, subject to this Policy |
Our service providers may only use your information to provide services to us and are bound by contract to protect it.
Advertising and "sale" or "sharing" under U.S. state laws. Some U.S. state laws (for example California) treat the disclosure of cookie identifiers to an advertising network for ads based on your activity as "sharing" or "sale". We do this through Google AdSense on the free plan. You can opt out (Section 9). We do not knowingly sell or share the personal information of anyone under 16.
7. Cookies, ads and similar technologies
- Strictly necessary: authentication (Clerk) and security (bot protection on sign-up, provided by Cloudflare Turnstile through Clerk).
- Preferences: your settings stored in local storage.
- Advertising (free plan only): Google AdSense. In regions where consent is required (for example the EU, the UK, and Quebec), Google's consent message (Funding Choices) asks for your choice before ads that use cookies are shown.
- You can control cookies in your browser and through Google's ad settings at adssettings.google.com. Blocking ads does not stop you from using the Service.
- We honor the Global Privacy Control browser signal as an opt-out request where required by law.
8. Where your information is stored, and international transfers
Our service providers store and process information in the United States and possibly other countries, and the operator of FormaCAD is located in Canada. Your information may therefore be processed outside your province, state or country and may be accessible to courts, law enforcement and national security authorities there. Where required (for example when you are in the EEA or UK), we use contractual safeguards such as standard contractual clauses.
9. Your rights and choices
Everyone. You can access, correct, or delete your account information from the account menu (Account details, Delete account), or by writing to us.
Canada (PIPEDA, Alberta and British Columbia PIPA, Quebec Law 25). You may ask to access your personal information, request correction, withdraw consent, and ask us how it is used and to whom it was disclosed. In Quebec you may also ask for your information in a structured, commonly used technological format, and to have us stop disseminating it or de-index it where the law allows. We will respond within 30 days, extendable only as the law permits. If you are unsatisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial regulator (in Quebec, the Commission d'accès à l'information).
United States (California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with privacy laws). Depending on where you live you may have the right to know and access the personal information we hold; to correct it; to delete it; to obtain a portable copy; to opt out of "sale" or "sharing" for targeted advertising and profiling; to limit the use of sensitive personal information (we do not collect sensitive information for these purposes); and to not be discriminated against for using these rights. You may appeal a refusal by replying to our decision. If your appeal is denied you may contact your state attorney general.
How to opt out of advertising: use the ad choices in Google's consent message, your browser's Global Privacy Control setting, or Google's ad settings. Email us to opt out of sharing.
How to exercise your rights: email support@formacad.app from the email address on your account, with the subject "Privacy request". We will verify your identity (usually by confirming control of your account email) and respond within the time the law requires (generally 30 to 45 days). You may use an authorized agent; we may ask for proof of authority.
Marketing emails. We send only occasional product or testing emails. Every such message will identify us and include a working unsubscribe link, in line with CASL (Canada) and CAN-SPAM (United States). We will honor unsubscribe requests within 10 business days. Service and security messages are not marketing and may still be sent.
California "Shine the Light". California residents may ask once a year which categories of personal information we shared with third parties for their direct marketing. We do not share information for third-party direct marketing.
Nevada. We do not sell covered information as defined by Nevada law. You may still send an opt-out request to the email above.
10. How long we keep information
| Information | Retention |
|---|---|
| Account email and profile | Until you delete your account |
| Sign-in events (with city and hashed IP) | 30 days, then summarized into anonymous daily counts by date, country and method, and the detailed events are deleted |
| Anonymous daily counts | Kept, because they contain no personal information |
| Usage limits | Not currently collected (the free plan has no usage limits); if limits are introduced, only as long as needed to apply them, and detached from you if you delete your account |
| Hosting logs | Short-lived, as configured by our hosting provider |
| Messages to us | As long as needed to answer you and to keep a record of your request |
When you delete your account: we remove your email, city and hashed IP from our records, and detach your usage limits from you. We keep only the anonymous country, method and date statistics. Your data at our authentication provider is deleted when you delete your account.
11. Security
We use encryption in transit (HTTPS with HSTS), access controls, hashing of IP addresses, rate limiting on sensitive endpoints, restricted database roles. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify affected people and the regulators as required by law (PIPEDA, Quebec Law 25, and U.S. state breach notification laws), and keep a record of breaches.
12. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13 (COPPA). If you are under the age of majority where you live, you may use the Service only with the involvement of a parent or guardian. If you believe a child has given us personal information, contact us and we will delete it.
13. Links to other sites
The Service may link to third-party websites, including Google. Their privacy practices are their own; please read their policies.
14. Changes to this Policy
We may update this Policy. We will post the new version with a new "Last updated" date, and if a change is material we will notify you in the Service or by email before it takes effect, and ask for your consent again where the law requires it.
15. Contact and complaints
Questions, requests, or complaints: support@formacad.app, or by mail (ask us for the mailing address). In Canada, you may also contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your provincial regulator. In the United States, you may contact your state attorney general or the Federal Trade Commission (ftc.gov).