Privacy Policy

Effective 23 August 2026

This policy explains what Pack3D collects when you use the packing workspace, why, and what control you have over it. We have deliberately kept the service narrow: we run no analytics or advertising, and we never sell your data. The only third party involved is the network and security provider described below.

Who is responsible

Pack3D operates this service and is the data controller. For any privacy question or data request, contact privacy@pack3d.net.

Pack3D is operated by Carl Debes Johansen, Brandsbjergvej 88, 2600 Glostrup, Denmark. Contact: contact@pack3d.net.

What we collect

Account details: the username you choose and your password. Passwords are stored only as a salted Argon2 hash; we cannot read them.
Terms acceptance: which version of these terms you agreed to when you registered, and when. We deliberately do not store an IP address with it.
Uploaded models: the 3MF or STL files you submit, kept only to produce your packed result.
Job data: filenames, settings (printer, clearance, scale), timestamps, and the resulting layout.
Contact messages: if you write to us through the contact form, we keep your message and the details you include with it (name, email address, printer count) so we can reply.
Cookies: one strictly-necessary session cookie (HttpOnly, SameSite=Strict) that keeps you signed in. It expires after 24 hours at most (sooner after 8 hours of inactivity) and carries no tracking identifier. In addition, our network provider Cloudflare sets a short-lived security cookie (such as __cf_bm) as part of the bot protection that shields the service from automated abuse. Neither is used for advertising or cross-site tracking.
Network address: when the service runs behind a proxy, your IP address is used transiently as a key to rate-limit sign-in and registration attempts. It is not used to build a profile.

Why we may process it (legal bases)

To provide the service you asked for: packing your files and showing your results (performance of a contract).
To keep the service secure: rate limiting and abuse prevention (legitimate interest).
To answer you: replying to messages you send through the contact form (legitimate interest, or steps taken at your request prior to a contract).
To show what you agreed to: keeping the version and date of the terms you accepted (legal obligation and legitimate interest).

How long we keep it

Your uploaded input file is deleted automatically once its job finishes.
Packed results and job metadata stay until you delete the job, and the oldest entries are removed automatically once your history grows beyond a fixed limit.
Account details are kept until you delete your account, which you can do yourself at any time from the account page. Deleting your account removes your jobs, uploaded files, and results immediately.
Contact messages are kept while we handle your inquiry and deleted automatically after 12 months at the latest.

Who else is involved

The service is self-hosted on a server located in Denmark (EU). Your files, results, and account data are stored only on that server. The complete list of processors acting on our behalf is:

Cloudflare, Inc. (United States) — network and security provider. Cloudflare terminates the secure connection at its edge, so requests (including files you upload) pass through its systems on the way to our server; it also runs a bot check in your browser and sets the security cookie described above. Nothing is stored with Cloudflare beyond what that transit and protection require.

We use no other processors. If that changes, this list is updated before the new processor begins handling any data, and business customers who have a data processing agreement with us are notified.

International transfers

Cloudflare, Inc. is a United States company, so the request data it handles as our processor can be transferred to the US. That transfer is safeguarded by the EU-US Data Privacy Framework, under which Cloudflare is certified, and by the standard contractual clauses in Cloudflare's data processing addendum. Your stored data (files, results, account details) does not leave our server in Denmark.

Your rights

If you are in the EU/EEA you have the right to access, correct, export, restrict, or delete your personal data, and to object to processing. Email privacy@pack3d.net and we will take care of it within the time the law requires. You may also complain to your national data-protection authority (in Denmark, Datatilsynet).

Children

Pack3D is a tool for production printing and is not directed at children. You must be at least 16, or the age of digital consent in your country, to create an account.

Changes

We may update this policy as the service evolves. Material changes will be reflected in the effective date above.