// Legal · last updated 2026-10-13T00:00:00.000Z
Privacy Policy
MillPath is made by CADMD SOFTWARE LLC (the “controller” of your personal data under EU and UK law). We collect as little as we can.
Your files stay on your device, unless you sign in
Drawings, projects, tool libraries, posts and G-code are processed in your browser and stored there (local storage and the browser’s database). Clearing your browser data deletes them; keep copies of important projects.
They are uploaded to us only if you sign in: the Backup is then on unless you turn it off (in Your account; turned off, nothing more is sent from that browser). With it on, your projects (with their 3D models), tool library, posts and the G-code you export are kept in your account so you can open them on other computers and download past exports again. They are stored with Cloudflare (our hosting provider) and you can delete them at any time in Your account; deleting your account deletes them all. If you make a share link for a project, anyone with that link can open a copy of the project until you remove the link.
What we process, why, and on what basis
Data from your Google account (your name, e-mail address and profile picture) is used only to sign you in and show your account. It is not sold, not shared for advertising, and not used to train AI models. MillPath’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
| Data | Why | Legal basis (EU/UK) | Kept |
|---|---|---|---|
| Technical data (IP address, browser, time of request) | To deliver and protect the site (by Cloudflare) | Legitimate interest | Short-term server logs |
| E-mail address | To sign you in and send account messages | Contract | While you have an account |
| Post reports you send (how a program ran: whether it ran, the result, the kinds of problem, your controller, the first error line, your note; the post and app version — never your drawing or G-code) | To confirm and fix the posts; to give the Pro days promised for a report | Legitimate interest; your request | While the post is offered |
| Posts you send (the post settings learned from your file or your own post, a few sample lines, your controller and machine, your note; the whole file only if you tick it) | To add and correct posts for everyone; to give the Pro days promised | Your request | While the post is offered |
| Error reports from the app (what went wrong, the app version, your browser type, a little context such as the machine type and the kind of file — never your files, drawings or G-code; your e-mail if you are signed in) | To find and fix faults | Legitimate interest | 90 days |
| Country (two letters, worked out by Cloudflare from the IP address when you sign in or visit; the IP address itself is not stored with your account) | To know which countries members come from, for languages, support hours and taxes | Legitimate interest | While you have an account |
| Name and profile picture from your Google account (when you sign in with Google) | To show who is signed in | Contract | While you have an account |
| Projects, tool library, posts and exported G-code (signed in, with Backup on) | To keep your work, open it on your phone and other computers, and keep your export history | Contract | Until you delete them or your account. On the Free plan a project is deleted 30 days after its last change or after the account became Free (the end of the trial or of a plan), whichever is later, with an e-mail 7 days before; the export history after 30 days; on Hobby and Pro the history is kept 1 year. Up to 50 MB of backup on Free; unlimited projects on Hobby and Pro (fair use, 10 GB) |
| Share links you create | To let the people you choose open a copy of a project | Contract | Until you remove the link or the project |
| Your e-mail address and name in our e-mail service (Brevo) | The welcome e-mail and messages about your account and safety | Contract, legitimate interest | While you have an account |
| Your choice to receive MillPath news | Occasional product news, only if you tick it in Your account | Consent (withdraw any time) | Until you untick it or unsubscribe |
| Plan, renewal date, export counts | To apply your plan | Contract | While you have an account, then as tax law requires |
| Billing records | Payments, taxes, accounting | Contract, legal obligation | As tax law requires (typically up to 7 years) |
| How the site and the app are used (pages seen, where you came from, device and browser type, approximate location, and events such as signing in, exporting a program, starting checkout and buying a plan — never your drawings, files, G-code or e-mail), by Google Analytics 4 | To see what helps people and improve MillPath | Your consent in the EU / EEA, the UK, Switzerland and Türkiye (asked first); legitimate interest elsewhere. Turn it off any time under Cookie settings | Up to 14 months in Google Analytics |
| Visit counts (each page view or app opening adds 1 to daily totals by page, the site it came from and the country; no cookie, no IP address, nothing that tells one visitor from another) | To see which pages and sources help people find MillPath | Legitimate interest | Daily totals, kept |
| Steps of an app opening (each opening of the app adds 1 to daily totals of how far it got: something to work on, an operation, Export pressed, G-code out, a few events such as the simulation played or a sign-in asked for, the machine type, whether signed in, and the furthest step with a rough length of time; no cookie, no IP address, no id, nothing that tells one opening or visitor from another) | To see where people stop in the app and make those steps easier | Legitimate interest | Daily totals, kept |
| Usage summary of your account (signed in only: daily totals of the time the app was in use and how often you used each part of it, such as machine types, kinds of file opened, operations added, exports by post, nesting, the quote, lessons; never your drawings, files, file names, G-code, clicks or keystrokes) | To see which features help people and where they get stuck, and improve MillPath | Legitimate interest. Turn it off any time in Your account (Usage summary); turning it off deletes what was kept | While you have an account; deleted with it |
| Messages and files you send us (support, post reports) | To answer you and improve MillPath | Legitimate interest, or your consent | Up to 3 years, or until you ask us to delete them |
Cookies
MillPath keeps your settings and work in your browser’s storage, and a sign-in cookie when you have an account; these are needed for the service and need no consent. In the EU / EEA, the UK, Switzerland and Türkiye, Google Analytics cookies are set only if you accept them in the cookie notice: until then nothing from Google is loaded. Elsewhere Google Analytics runs unless you turn it off. You can change your choice any time under Cookie settings (in the site’s footer, or the ? menu in the app). We do not use advertising cookies (Google’s advertising features are switched off), and we do not sell or share personal information for advertising.
Service providers
- Cloudflare, Inc. — hosting, the database and file storage for accounts, security, and e-mail forwarding.
- Stripe, Inc. and its Link service: payments. Plans are sold through Link, which is the merchant of record for the payment and keeps the billing records it needs for taxes. Card details go to Stripe, not to us; Stripe’s privacy policy and Link’s privacy policy apply to the payment.
- Google LLC — signing in with Google (your name, e-mail address and profile picture, as described above).
- Google LLC (Google Analytics 4) — statistics on how the site and the app are used, only with your consent.
- Brevo (Sendinblue SAS, France) — sending the welcome e-mail and account messages, and MillPath news to those who chose to receive it.
They process data for us under their terms. Some are in the United States; transfers from the EU/UK rely on the safeguards those providers offer (such as the EU-US Data Privacy Framework or standard contractual clauses).
Your rights
You can ask us to access, correct, delete or export your personal data, and to object to or restrict its use: support@millpath.app. We answer within 30 days. People in the EU and UK can also complain to their data protection authority. California and other US state residents have the right to know, delete and correct their personal information and not to be discriminated against for using these rights; we do not sell or share it.
Children
MillPath is not directed at children under 13 (16 in the EU), and we do not knowingly collect their personal data.
Security
The site is served only over HTTPS. Your project files never reach our servers. Access to account data is limited to what is needed to run the service.
Changes
We will update this page when our practices change; the date above shows the current version. For material changes we will tell account holders by e-mail.
Contact
CADMD SOFTWARE LLC
301 Danube Ave, Apt 10
Tampa, FL 33606, USA
support@millpath.app