Privacy Policy

Vitrine is made by Mash Lab, an independent software studio, which is the controller of the personal data described here. Write to support@mashlab.app with any question about it.

Your work. The projects, screenshots and other files you upload, your slide text and settings, and the looks you save. We store them to give you the editor and to render your exports. Basis: providing the service you asked for.

Your account. If you sign in, the name, email address and profile picture your Google or GitHub account shares with us, and that provider's identifier for you. We ask for nothing else and hold no password. Basis: providing the service, and keeping your work past the 24-hour anonymous window.

Your credits and purchases. A ledger of credits granted, spent and refunded, and a record of each purchase (what was bought, the amount, date and Paddle's identifiers), plus the email address we gave Paddle for you. Basis: contract and our legal obligations around payments.

A usage log. For each owner, a line per action — an export, a render, an AI request — with its time, kept with that owner's files. We use it to understand how Vitrine is used and to set fair limits. Basis: our legitimate interest in running the service.

Network address. Your IP address is used to apply rate limits and prevent abuse of sign-in and AI features. Request logs are kept only as long as needed for security and troubleshooting.

Vitrine uses only what the service needs to work:

• A signed session cookie identifies your browser (anonymous work) or your account. Scripts cannot read it, and it lasts up to one year.
• A short-lived cookie (30 minutes) carries the sign-in state while you are away at Google or GitHub.
• Your browser's local storage keeps a copy of your deck so your work survives a reload.

We do not currently run analytics or advertising trackers. If we add analytics, we will ask for your consent before it runs and update this policy first.

Anthropic — when you use AI copy or translation, the description you type, or the caption text of the slides involved, is sent to Anthropic's API. Images are not.

Paddle.com — the merchant of record. It handles your payment details; we never see your card. It receives your name and email to issue the receipt.

Google and GitHub — only when you choose to sign in with them.

Cloudflare — carries traffic between you and our servers, so it sees requests to Vitrine in transit.

We and these providers may process data outside your country. Where data leaves the European Economic Area or the UK, we rely on the safeguards the law provides, such as standard contractual clauses. We do not sell personal data.

• Anonymous work is deleted 24 hours after you first save something.
• Deleted projects and files stay recoverable for 24 hours, then are removed.
• Exports are removed from the server about an hour after they are made.
• An account's work is kept until you delete the account.

When you delete your account, your projects, uploads, saved looks and usage log are erased immediately. If you never bought anything, your credit records go too. If you did, we keep the purchase records — amounts and dates, with your email removed — for as long as a payment dispute or tax rules could need them. A one-way hash of your identity is kept so that a deleted account cannot claim the welcome credits again. Daily backups of the credit ledger are kept for 14 days.

You can download everything we hold about you and delete your account yourself, in Settings. You also have the right to ask us for access to, correction of, restriction of or objection to our processing of your data, and to data portability, by writing to support@mashlab.app. You can also complain to the data protection authority where you live or work.

Vitrine is not meant for children under 16, and we do not knowingly collect their data.

If this policy changes materially, we will say so in the app. See also the Terms of Service and the Refund Policy.