Privacy Policy

1. Scope

This policy covers the GG Cabinet Tools SketchUp extension, the cnctool.org website, and the API between them. We decide how the data described here is handled — the "controller" under the EU General Data Protection Regulation (GDPR), and the "Personal Data Controller" under Vietnam's Decree 13/2023/ND-CP on personal data protection.

It does not cover third-party sites you reach from ours, or SketchUp itself, which has its own policy.

2. What we collect

• Account. Your email address, a bcrypt hash of your password (never the password itself), email-confirmation and password-reset tokens, the IP address the sign-up came from, the country code Cloudflare reports for it, and the language that implies.
• Sign-in. Session and refresh tokens — refresh tokens are stored only as digests — plus their expiry and revocation times.
• Settings and presets. Toolbar layout, tool defaults, G-code, layer, unfold and component-stats settings, toolpath and marking presets, and the component instance names you save.
• Usage counters. Which tool ran, how many times, and when it last ran. No drawing geometry is sent with these counters.
• Warehouse files. For Pro accounts, the files you choose to sync, with their name, size, version, and checksum.
• Purchases. The email used at checkout, amount, currency, provider and provider reference, and — for Vietnamese bank transfers — the account name, bank, and branch shown on the transfer.
• Support. Whatever you write to us, and the address you write from.

3. What we do not collect

• Card numbers, CVV, or banking credentials — those go straight to Stripe or Gumroad and never reach our servers.
• Advertising identifiers or cross-site tracking. We run no advertising network and no third-party analytics.
• Your drawings. The extension does not scan your models or upload anything you have not chosen to sync.

4. Why we use it

• To run your account and sign you in — necessary to provide the Service you asked for.
• To deliver Pro entitlements and keep payment records — required by our agreement with you and by accounting law.
• To keep the Service secure, prevent abuse, and improve the tools using aggregate usage counters — our legitimate interest in a working, safe product.
• To send account email: confirmation, password reset, trial and upgrade notices. We do not send marketing email unless you ask for it.

In GDPR terms the bases are performance of our contract with you (running the account and Pro entitlements), legal obligation (accounting and tax records), and our legitimate interests (security, abuse prevention, and improving the tools). Under Decree 13/2023/ND-CP we process this data to perform the contract you asked for, and ask for your consent where that decree requires it.

5. Cookies

The website sets a session cookie to keep you signed in, and a "remember me" cookie if you choose that option. Cloudflare may set cookies needed for security and delivery.

We set no advertising or profiling cookies. The SketchUp extension uses tokens rather than cookies.

6. Who we share it with

We do not sell personal data. We share only what each provider needs to do its job:

• Stripe — card payments.
• SePay — matching Vietnamese bank transfers to an order.
• Gumroad — marketplace purchases.
• Resend — sending transactional email.
• Cloudflare — content delivery, protection, and R2 object storage for plugin builds and Warehouse files.
• Our hosting provider — the servers and database running the Service.

We also disclose data where the law requires it, or where it is needed to establish or defend a legal claim.

7. Where your data is stored

Our servers, database, and object storage are operated by providers with infrastructure in several countries, so your data may be processed outside the country you live in.

Where that happens we rely on the standard contractual protections those providers offer.

8. How long we keep it

• Account data, settings, presets, and usage counters: while the account exists.
• Refresh tokens: until they expire or are revoked.
• Warehouse files: until you delete them or close the account.
• Payment records: as long as accounting and tax rules require, even after an account is closed.

9. How we protect it

Passwords are hashed with bcrypt. Refresh tokens are stored as digests, never in the clear. Traffic runs over HTTPS. The admin panel is limited to accounts holding the admin role.

No system is perfectly secure, so use a strong, unique password and tell us if something looks wrong with your account.

10. Your rights

You can ask for a copy of your data, correct it, delete your account and its data, object to or restrict how we use it, withdraw a consent you gave, or take your data elsewhere in a portable form. These are the rights GDPR Articles 15-22 give people in the EU and UK, and the rights Chapter II of Decree 13/2023/ND-CP gives people in Vietnam.

Email [email protected] from your account address and we will answer within 30 days. Deleting an account removes your account data, presets, usage counters, and Warehouse files; payment records are kept where the law requires.

If our answer does not satisfy you, you may complain to your national data-protection authority — in Vietnam, the Department of Cybersecurity and High-Tech Crime Prevention (A05) of the Ministry of Public Security.

11. Children

The Service is aimed at woodworking professionals and hobbyists and is not directed at children under 16. We do not knowingly collect their data — write to us and we will delete it.

12. Changes to this policy

We may update this policy. The effective date at the top of this page identifies the current version, and we announce material changes by email or in the extension before they take effect.

13. Contact

Questions about your data, or a request about your rights? Write to [email protected].