Privacy Policy

Effective October 12, 2026

In short: Atelier runs on your own computer, so your prompts, images, videos, 3D models and files stay there. We don't receive them. We collect what we need to run your account and subscription: your email, your subscription status, and a record of the computers you use Atelier on. Payments are handled by Stripe. We don't sell your data, and there are no ads or tracking in the app.

1. Who we are

Cruxbit Labs LLC (“we”, “us”), Florida, USA, makes Atelier and decides how the personal data described here is used. Contact us at info@cruxbitlabs.com. This policy covers the Atelier app, your account and subscription, and the Atelier pages on cruxbitlabs.com.

2. What stays on your computer

Atelier does its work on your own graphics card. Your prompts, the images, video and 3D models you make, the files you open, and your project library are stored on your computer and are not sent to us. The app has no analytics, ads or crash reporting that send data to us.

On your computer, Atelier also keeps:

a sign-in token in your operating system's credential store, so you stay signed in;
a signed record of your subscription status, so Atelier can work offline for up to 5 days;
an ID for the computer, so your subscription can count your computers: a one-way hash of the hardware ID your operating system gives the computer, which can't be turned back into that ID (or a random ID, if the hardware ID isn't available);
a record of the licence agreement and terms you accepted on the Setup screen, with their versions.

3. What we collect

Account: your full name, your country, your email address, your password (stored only as a secure hash by our sign-in provider), when you signed up, and which of our products you signed up from.
Agreements: which versions of our Terms and Privacy Policy you accepted, when, and the app version you accepted them in.
Subscription: your Stripe customer and subscription IDs, plan, status, renewal date, and any promo code applied.
Payment: Stripe collects your card details and billing address on its payment page. We don't see or store your full card number; Stripe may share limited details with us, such as the card brand, last four digits and country, and your billing address for tax.
Computers: the app's ID for each computer (described in section 2), the computer's name, the Atelier version, and when it last checked in.
Messages: emails you send us, and records of the sign-in codes and account emails we send you.
Technical logs: our service providers keep logs of requests, including IP addresses and timestamps, for security and troubleshooting.

4. Why we use it

to create and secure your account and sign you in;
to take payment, check your subscription and enforce the computer limit;
to put your name on invoices and receipts, work out sales tax or VAT, and comply with US sanctions law, which means we can't offer Atelier in some countries (your country);
to send you sign-in codes and messages about your account, billing and changes to our terms;
to prevent fraud and abuse, and to keep our services secure;
to meet our legal, tax and accounting obligations.

We don't sell your personal data or share it for targeted advertising, and we don't use it to train AI models. We only send you news and offers by email if you ask for them: the box at sign-up starts unticked, and you can turn it on or off any time in Atelier under Settings, Account, or with the unsubscribe link in any such email. We record when you turned it on or off.

If you're in the European Economic Area or the UK, our legal bases are: performing our contract with you (account, subscription, sign-in), our legitimate interests (security, fraud prevention, improving our service), and our legal obligations (tax and accounting records).

5. Who we share it with

We use these service providers, who process data for us under contract:

Supabase runs our sign-in and account database (servers in the United States) under its data processing agreement.
Stripe processes payments, subscriptions, invoices, tax and fraud checks under its data processing agreement. Stripe also acts under its own privacy policy for payment processing.
Resend delivers our account emails under its data processing agreement.
Vercel hosts cruxbitlabs.com. The site sets no tracking cookies.

We may also share data if the law requires it, to protect our rights or users' safety, or with a buyer if our business is sold, in which case this policy continues to apply.

6. Services you choose to connect

Google Gemini: if you add your own Gemini API key, the prompts and images you send to Gemini features go directly from your computer to Google, under Google's terms and privacy policy.
Claude Code by Anthropic: if you add Claude Code, it is installed with Anthropic's own installer and you sign in through Anthropic. What you ask Claude goes to Anthropic under your own Claude account and Anthropic's terms; Atelier never sees your Claude credentials.
Model and software downloads: during setup, updates and the first use of some features, Atelier downloads AI models and software from their publishers and package managers, such as Hugging Face, GitHub, Google Cloud Storage, Microsoft's Windows Package Manager, Scoop and Homebrew. Like any download, those sites see your IP address. Atelier turns off Homebrew's own usage analytics for the commands it runs.

We don't receive what you send to these services.

7. How long we keep it

We keep your account data while your account exists. When you delete your account, we delete your account and computer records and cancel any active subscription. We keep a record of the terms you accepted and of your email-news choice, with the email address they were given under, for 3 years after the deletion, as proof of consent that subscription laws ask us to keep, and then delete it. We keep payment, invoice and tax records for as long as the law requires, usually up to 7 years. Service-provider logs are kept for a short time, typically days to weeks.

8. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal data, to object to or restrict some uses, and to withdraw consent. To use these rights, or to delete your account, email info@cruxbitlabs.com from the address on your account. We'll answer within 30 days, or sooner if the law requires. We won't treat you differently for using your rights.

California residents: in the last 12 months we collected identifiers (name, email, account and device IDs, IP address), your country, commercial information (subscription and purchase records) and internet activity (technical logs), for the purposes in section 4. We don't sell or share personal information as defined by the CCPA, and we don't use sensitive personal information to infer anything about you.

EEA and UK residents: you can also complain to your local data protection authority.

9. International transfers

We're based in the United States and our providers store data there. If you use Atelier from elsewhere, your data is transferred to the United States, protected by our providers' standard contractual clauses or equivalent safeguards.

10. Security

We use encryption in transit, hashed passwords, access controls and signed subscription records. No system is perfectly secure; if a breach affects your data, we'll tell you as the law requires.

11. Children

Atelier is only for people 18 and older. We don't knowingly collect data from anyone younger. If you believe a minor has given us data, contact us and we'll delete it.

12. Changes

When we change this policy, we'll update the date at the top. For material changes, we'll tell you by email or in the app, and Atelier will ask you to review the new version. Read it together with our Terms of Service.