Privacy Policy
This policy explains what personal data Oriforma collects, why, who else receives it, and how long we keep it. It describes what the service actually does today. Where a practice is still changing we say so rather than describing an intention as a fact.
1. Who is responsible for your data
Oriforma is operated by Stellek Intelligence (Hongkong) Technology Limited, Room 02, 9/F, The Broadway, 54-62 Lockhart Road, Wan Chai, Hong Kong, registered in Hong Kong SAR. For the purposes of the EU and UK General Data Protection Regulation, that company is the data controller.
Privacy questions and rights requests: privacy@oriforma.com.
2. What we collect
2.1 Account data
- Your email address, and a cryptographic hash of your password. We never store the password itself.
- A username derived from your email address, and a display name if you provide one.
- The interface language you were using when you registered, or that you later selected. We use it to decide which language to write our emails to you in.
- If Google sign-in is available and you choose it: your Google account identifier, email address, profile name and profile picture URL.
2.2 Content you create
Designs, files, folders, components, version-control snapshots and their names and descriptions. Files you import, including the original filename and the geometry derived from them. Where the service offers AI features and you use them: the text of your conversations, the images you upload, and the models generated from them.
None of this is public unless you publish it, and section 2.6 covers what becomes public when you do. Section 7 notes one exception: where AI features are offered, the files they generate are served from addresses that are not access-controlled.
2.3 Security and abuse-prevention data
When an account is registered, or when someone attempts to register with an address that already has an account, we record the IP address, the browser user-agent string, the email address used, and whether the attempt succeeded. We use this only to detect and limit abuse.
2.4 Payment data
If you subscribe to a paid plan, payment is handled by a third-party payment processor on pages it hosts. We never see or store your full card number or security code. We store the processor's customer and transaction identifiers, the card brand, its last four digits and expiry month and year, amounts, and links to receipts and invoices hosted by the processor. We may change processor; this description applies to whichever one we use.
Paid plans are not yet active on this service.
2.5 Cookies and browser storage
We set one cookie, auth_token, which holds your sign-in session. It lasts 24
hours and is marked SameSite=Strict. It is strictly necessary to keep you signed
in; we do not ask for consent for it because the service cannot function without it.
We also use your browser's local storage to keep your session token, your display preferences (language, theme, panel layout, viewer settings) and your file list for the mobile view. On community model pages we additionally put a random session identifier in your browser's session storage, which the browser discards when you close the tab; section 2.7 explains what it is for. That data stays in your browser.
That session identifier is the one item above that is not strictly necessary. The community pages load, configure and download exactly the same without it; it exists only so that we can measure them. We write it without asking you first, which is a choice we have made and not a requirement we are claiming. Section 2.7 says what it is used for, how to stop it being written, and how to object to the measurement.
We run no advertising, no tracking pixels, no third-party analytics service and no error-reporting service. We load no fonts, scripts or stylesheets from third-party CDNs. Apart from the services named in section 4, no third party observes your use of this site. We do measure how community model pages are used — on our own servers, without storing IP addresses, and only as section 2.7 describes.
2.6 What is public when you publish
The community area at https://oriforma.com/community is public to anyone, signed in or not. Nothing of yours appears there unless you publish it, and publishing is something you do deliberately, one model at a time.
When you publish a model, these become public: its title, summary and description, its cover image (a screenshot taken from your browser at the moment you publish), the design itself and its parameters, the licence you chose, and the dates it was published and last updated. Anyone can view, configure and download it.
Your handle and display name are public. Your community avatar, biography and profile links are also public when you choose to provide them. Counts shown next to published work, including downloads and likes, are public. Deleting your account clears your community profile and avatar reference; uploaded avatar files without any remaining account reference are removed from our server by our cleanup process. This does not recall copies already downloaded or cached.
Your email address is never public. It is not shown on a published model, not given to the people who download it, and not included in exported files. The internal username we derive from your email address (section 2.1) is never displayed to anyone else either; your handle is what other people see.
Your handle is chosen once, cannot be changed afterwards, and is permanent and public. Because it is written into the attribution of files other people download, a handle that has ever held public work is never released to anyone else, even after the account that held it is closed. We never suggest a handle derived from your email address, and we refuse one that matches the local part of it — but the choice is yours, so do not put anything in it you would not want to be public for good.
If you sign in and like a model, we store your account identifier, the model, and the time. Other people see only the total number of likes, never who liked what. These records are deleted when you delete your account; while your account exists they have no retention limit.
2.7 Community activity data
To know whether the community area works — specifically, whether visitors actually configure a model before downloading it — we record a small number of events on published model pages. An event is written when a model page is opened, when a parameter on it is changed, when an STL or STEP file is downloaded from it, when a model is opened in the editor, and when a model is published.
Each row holds only: what happened; which model and which version; for a parameter change, which parameter was changed — never the value you entered; a random 22-character identifier for the current browser session, taken from your browser's session storage (not a cookie) and discarded when you close the tab; your account identifier if you were signed in at the time, and nothing in its place if you were not; and the time.
We do not store your IP address with these rows. The first page view and the first parameter change are each recorded at most once per browser session per model, a limit the database itself enforces, so that the share of visitors who configure a model is a real proportion rather than a count of slider movements. We do not use this data to build a profile of you, we do not combine it with your content, and we neither sell it nor share it with anyone.
Download statistics count each format (STL and STEP) separately: once per signed-in account per model, or once per anonymous browser session per model. Downloads by the signed-in author are excluded. Counts cover all versions of a model. These client-reported observations are not verified file deliveries and do not grant reputation points, rankings or awards. Starting another anonymous session can produce another observation. Previous activity records remain retained under their original collection rules.
If your browser does not give the page session storage — because your settings or an extension block it for this site — there is no session identifier, and the page view and the parameter change are then not recorded at all: the once-per-session limit is enforced by the database, which refuses a row it cannot key, so the measurement simply loses that visit. Downloads from the model page are also not measured without session storage; downloading the actual file still works. Open-in-editor and publish events do not require session storage. What a row holds is unchanged in every case: no parameter value, no IP address. A private or incognito window does not block session storage — it keeps it for the window and throws it away when you close it — so browsing that way does not stop the measurement.
If you would rather not be measured: blocking session storage for this site removes the identifier, and you can email privacy@oriforma.com to have the rows that carry your account identifier deleted. We do that by hand — there is no setting for it yet. Section 9 covers your right to object to processing we base on legitimate interests.
2.8 Shared configuration links
A model page lets you change the model's parameters, and gives you a link that reproduces the values you chose. That link carries those values, so you should know which part of it goes where before you share it.
Numbers and on/off settings travel in the address itself. They are sent to
our servers whenever the page is opened, they appear in our web servers' request logs, and
they are visible to anyone who can see the address — in your browser history, in a chat
message, on a shared screen. Text you type into a parameter — a name, a phone number,
a web address — travels in the fragment of the link, the part after the # sign,
which browsers do not send to the server at all. It is resolved in the browser of
whoever opens the link. We do not receive it, it is not written to our logs, and it is never
written to the community activity rows described in section 2.7.
Two consequences worth stating plainly. A page opened from a configuration link asks search engines not to index it, so a link you share is not added to search results by us. And the picture used when a link is shown as a preview on another site is the model's own cover image, rendered from its default values — never from the values in your link.
None of this makes a configuration link private. Anyone you send it to can read everything in it, including the text in the fragment. If you put something in a parameter that you would not want that person to have, do not share the link.
2.9 Reports and moderation records
Anyone signed in can report a model that is public in the community area, and we keep a record of what we then decided. This is a separate purpose from the measurement in section 2.7: these rows are not used for measurement, and the measurement rows are not used for moderation.
A report row holds only: which model, and which version if the reporter was looking at a particular one; the category chosen from infringement, inappropriate content, spam and other; the note the reporter typed; the account identifier of the person reporting; the state of the report and which decision settled it; and the times it was filed and settled. Reporting requires a signed-in account. We do not store the IP address of the person reporting with these rows. One account can have only one open report on the same model — a constraint inside the database, not a check in the page — and there is a daily limit on how many reports one account can file, which we count from the stored rows before accepting a new one.
A moderation record holds: what we did, and to which model, kept by that model's address so that the record outlives the model itself; whose account it concerned; which of our staff accounts decided it; the reason code and the sentence we wrote; what state the model was in before, so that an appeal can put it back; which reports it answered; when we decided, and when the notice to the author went out; the date the 14-day appeal window closes; and, if an appeal is filed, when it was filed, what the author wrote in it, which staff account reviewed it, how it came out and when. It has no column for the words of the person who reported, and the reason we write is our own — section 5.9 of the Terms of Service says the same from the other side. If a model is deleted the reports about it go with it, and the record of what we decided stays.
What reaches the author. If we act on a report, the author is told what we removed and why, in wording we write. They are not told who reported it, and the note you typed is not forwarded to them. A copyright notice sent to our designated contact works differently, and deliberately: section 5.7 of the Terms of Service commits us to passing your notice on to the author including the contact details in it, because the counter-notice process cannot work otherwise. If you would rather not be identified to the author, use the report inside the service — and understand that it is not a copyright notice and does not start that process.
Section 3 gives the legal basis for this, and section 6 how long we keep it.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and operating your account; storing and serving your designs | Performance of a contract |
| Sending account emails (verification, password reset, security notices) | Performance of a contract |
| Publishing a model you chose to publish, and serving it to visitors | Performance of a contract |
| Processing AI requests you initiate, where AI features are offered | Performance of a contract |
| Measuring how published models are used (section 2.7) | Legitimate interests — knowing whether the feature is worth keeping, without profiling anyone |
| Receiving reports about published models, acting on them, telling the author what we decided and why, and keeping the record of that and of any appeal (section 2.9) | Legitimate interests — running a lawful public area; legal obligation where one applies |
| Rate limiting, abuse detection, keeping IP and user-agent of registration attempts | Legitimate interests — keeping the service usable and secure |
| Billing and keeping financial records | Performance of a contract; legal obligation |
We do not sell personal data, and we do not use it for advertising or profiling.
4. Who else receives your data
We use a small number of outside services. Each one receives only what it needs. Anything you publish to the community area is, by its nature, received by whoever views it.
One other transfer between people, rather than to a service: if you write to us with an infringement or content complaint, we pass it to the author of the content you complained about, including the contact details in it, so that they can respond. Section 5.7 of the Terms of Service states the same thing from the other side. A report filed from inside the service goes the other way round — the author is told what we decided and why, and is not told who reported it. Section 2.9 sets out both.
4.1 Email delivery
Account emails (verification, password reset, and similar) are delivered through a third-party email delivery service. It receives your email address and the content of the message, which contains your display name and a single-use link, and uses them only to deliver that message. We may change delivery service; this description applies to whichever one we use.
4.2 AI model providers
AI features (an assistant, and generating models from text or images) are not offered in every release or every region. The core of Oriforma — the editor, your files and your exports — never involves them. This section applies only where AI features are offered and you choose to use them.
When you use an AI feature, the text you type and any images you upload are processed by a machine-learning model so it can produce a response. That model runs either on infrastructure we operate or at a third-party AI model provider acting on our behalf. We may use more than one provider, use them as fallbacks for one another, and change which providers or models we use — including moving to models we host ourselves — without notice, so long as this description stays accurate.
Third-party providers receive only what is needed to answer your request: the text and images you submitted and the context of the conversation. They are not permitted to use it for anything other than producing the response.
Generating a 3D model from text or an image may additionally send that prompt or image to a model-generation service, and may make the resulting geometry available to that service at a URL on our servers.
If you do not want your input processed this way, do not use the AI features. Nothing else in Oriforma sends your content to a model provider.
4.3 Payment processor
When paid plans are active, your email address and your account identifier are sent to our payment processor to create a customer record. Card details go directly from your browser to the processor and never pass through our servers.
4.4 Google
This applies only where Google sign-in is available and you choose to use it. Google receives the fact that you are signing in to Oriforma and returns your email address, account identifier, profile name and profile picture URL. We use these details to create or identify your account and show your name and avatar. We do not request access to your Gmail messages, Google Drive files or Google contacts.
If we enable reCAPTCHA on the registration page, loading it gives Google your IP address, browser user-agent and interaction signals on that page.
4.5 Translation
Machine translation of community content is not enabled on every release or every region. This section applies only where it is enabled.
Where it is enabled, the title, summary, description, parameter labels and version notes of a model you publish are sent to a machine-translation model so that it can produce versions in other languages. That model runs either on infrastructure we operate or at a third-party AI model provider acting on our behalf. Only text you have already published is sent. We never send the values a visitor types into a model's parameters, your email address, your handle, or any private file. Where it is not enabled, nothing is sent and your model is shown in the language you wrote it in.
You can replace any translation with your own wording at any time, and your own wording is used in preference to a machine translation.
4.6 Hosting
Our application and database run on infrastructure we operate. That infrastructure may include servers, storage and network capacity rented from cloud hosting providers; such a provider holds the data only on our behalf, as a processor, and does not use it for its own purposes. Some AI and 3D-generation workloads, where offered, run on separate machines we operate, reached over an encrypted connection. We may change hosting providers; this description applies to whichever we use, and section 5 covers where they may be located.
5. International transfers
If you are in the European Economic Area or the United Kingdom, note that using an AI feature, where one is offered, may transfer the content of your request — including any image you upload — outside that area. The providers and infrastructure involved may be located in countries that are not covered by a UK or EU adequacy decision. We are working to put appropriate safeguards in place for these transfers. Until then, treat the AI features as unsuitable for confidential or personal information, and do not upload images of identifiable people.
The same applies to the infrastructure that runs the service itself (section 4.6), including any cloud hosting provider we use: it may be located outside that area, in a country not covered by an adequacy decision.
Where machine translation is enabled (section 4.5) and the model serving it is not one we operate, the published text of a model may be transferred outside that area in the same way.
Anything you publish to the community area is published worldwide, which is a transfer you are making deliberately rather than one we make on your behalf.
6. How long we keep it
| Data | Retention |
|---|---|
| Account record | Until you delete your account (see section 8) |
| Designs, files, components, version history | Until you delete them; deleted items stay in trash for 30 days, then are removed |
| Models you published, and their versions | Updates retain previous frozen versions. Closing a share, deleting it as its author, or an administrator taking it down hides its public content and leaves a notice at its source address. Frozen versions and source references are retained so existing remixes and component uses continue to work. Account deletion removes unreferenced work or anonymises retained work. Retained attribution no longer links to an active profile after account deletion. Currently there is no automatic purge. |
| Your handle | Not released once it has held public work, so that attribution in files already downloaded cannot come to point at someone else |
| Community activity rows (section 2.7) | Deleted together with the model they refer to. We have not yet set a shorter age limit for them. |
| Web-server request logs (addresses requested, including any values carried in them — section 2.8) | Kept while they remain on the server. We have not yet set an age limit for them, and we do not yet strip the values from the address before writing the line. |
| Reports about published models, infringement notices, and the record of what we decided and of any appeal (section 2.9) | One year after the matter is closed. As with published models above, we do this by hand — there is no automatic purge. |
| Registration attempts (IP, user-agent, email) | 30 days |
| Password-reset records | 7 days after the link expires |
| Unused email-verification records | 7 days after expiry |
| Machine translations of published text (section 4.5) | Kept with the model version they belong to, and removed with it. A translation stops being shown as soon as you change the text it was made from. A translation you wrote yourself is kept until you remove it. |
| Exported files awaiting download | 1 hour |
| AI conversations, prompts, uploaded images and generated models (where AI features are offered) | Kept while your account exists. We have not yet set a fixed limit for these, and they are not currently removed when an account is closed — see section 8. |
| Payment records | Kept after account closure, as financial records |
7. Security
Passwords are hashed with bcrypt. Email-verification and password-reset links are stored only as SHA-256 hashes, so the links themselves exist only in the email we send you. All traffic to this site uses TLS.
Two limitations you should know about. Our session cookie is set by the page rather than by the server, which means it is readable by scripts running on our own pages. And where AI features are offered, files they generate are served from addresses that are impractical to guess but are not access-controlled: anyone who has the address can retrieve the file.
8. Deleting your account
You can request deletion from your account settings. We email you a confirmation link. After you confirm, the account is scheduled for deletion seven days later, and you can cancel at any point during those seven days by signing in.
When deletion runs we permanently remove your files, folders, components, subscription records and quota records, and we replace your email address, password, display name and linked-account identifiers with placeholders.
Models you published to the community area are removed from the service at the same time. Where another member's variant or remix depends on one of them, it is instead hidden from the service with your name and handle taken off it, so that the work built on top of it does not break — nothing can depend on a model yet, so today they are simply removed. We do not yet offer the alternative of leaving a published model up anonymously; if you want that, email privacy@oriforma.com before you confirm the deletion. What other people have already downloaded, and the Creative Commons licence they received with it, are beyond our reach — section 5 of the Terms of Service explains that.
Your handle is not released. It stays reserved, so that nobody else can take an identity that appears in files already downloaded from your models.
Community activity rows (section 2.7) that record you opening or downloading someone else's model keep the account identifier on them; we do not delete them row by row. The account they point to no longer holds your email address or your name.
Some data is kept: payment records, as financial records; and an audit entry recording that the account existed, which includes the email address that held it.
As noted in section 6, any AI conversation history, prompts and generated files you created while AI features were offered are not currently included in this process. If you want them removed, email privacy@oriforma.com and we will do it manually.
9. Your rights
If you are in the EEA or UK you have the right to access your data, correct it, have it erased, restrict or object to how we use it, and receive it in a portable form. You may also complain to your national supervisory authority.
If you are a California resident you have the right to know what we collect, to have it deleted, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are used in the CCPA.
To exercise any of these, email privacy@oriforma.com. We will respond within 30 days.
10. Children
Oriforma is not intended for children. We do not knowingly collect data from anyone under 16, and we do not currently verify age at registration. If you believe a child has created an account, email privacy@oriforma.com and we will remove it.
11. Emails we send you
Account emails — address verification, password reset, security notices, and notice of a material change to this policy or to the terms — are part of running your account. They go out for as long as the account exists and cannot be switched off while it does.
We send no marketing email. One community email is neither marketing nor a notification: if we take down, hide or refuse to publish something of yours, we write to tell you what we removed, why, and how to appeal — section 2.9 above, and section 5.9 of the Terms of Service. That is an enforcement notice. It is the record of a decision about your account rather than news about other people, it carries no unsubscribe link, and like the account emails above it goes out for as long as the account exists.
When community notifications are enabled, we send daily summaries of public remixes, first verified component uses, approved Makes, earned badges, featured works, comments, new followers, publications from authors you follow, and changes to the distribution availability of your own versions. We also send a weekly report of public derivatives, confirmed references, downloads and reputation progress. These emails are on by default. Every email carries an unsubscribe link; your account also has global and per-category settings. Switching them off never affects account emails or enforcement notices. We do not send a separate email for each view or parameter change.
To deliver these updates reliably and show your notification centre, we store your account identifier, the event category and public-work reference or badge, event and read times, delivery status, retry count and your notification preferences. These records remain while your account exists and are removed when it is deleted. Other members cannot read your notification centre or email preferences.
12. Changes
If we make a material change we will update the date at the top of this page and notify account holders by email before it takes effect.
13. Contact
Stellek Intelligence (Hongkong) Technology Limited
Room 02, 9/F, The Broadway, 54-62 Lockhart Road, Wan Chai, Hong Kong
privacy@oriforma.com