CTWCAD Privacy Policy
This Privacy Policy explains how CTWCAD ("CTWCAD," "we," "us") collects, uses, shares, and protects information when you use our website at ctwcad.com, the CTWCAD desktop application, the CTWCAD mobile application, the CTWCAD Fusion 360 plugin, and any related services (together, the "Service"). It also describes the rights you have over your information and how to exercise those rights.
Read this policy alongside our Terms of Service, which govern your use of the Service.
This policy applies to information about CTWCAD users. It does not cover the practices of third-party services that operate independently of CTWCAD, even when those services integrate with the Service — notably Google's Fusion 360, your Google Account, and any other third-party design tool you use. Their practices are governed by their own privacy policies.
1. Introduction
CTWCAD is a CAD environment that pairs a local design experience with cloud sync, collaboration, and AI-assisted design tools. The Service is in private beta, available by invitation. This Policy describes what information the Service collects from you, how we use that information, who we share it with, how long we keep it, and what choices you have.
We have written this Policy to be readable. Where a section uses defined legal terms, we explain them in plain language afterwards.
By creating an account, signing in, or otherwise using the Service, you confirm you have read this Policy. Specific features of the Service — including the CTWCAD Fusion 360 plugin — require an additional, explicit authorization step that references this Policy by version. You can revoke that authorization at any time. See §6.4.
2. Who we are
CTWCAD is operated by Seth Ricks ("the operator"), at the email address listed in §14. CTWCAD is a private-beta service and does not currently operate as an incorporated entity; references in this Policy to "CTWCAD," "we," "our," or "us" should be read as references to the operator and any contractors operating under the operator's direction.
If CTWCAD reorganizes or incorporates, we will update §2 and §13.3 with the new operating entity. Material changes are governed by §13.
3. Information we collect
3.1 Account information.
When you sign in to CTWCAD with Google, we receive your Google account identifier, email address, display name, and (where you have set one) profile photo. We use these to create and maintain your CTWCAD account. We do not receive your Google password.
We also store your role in CTWCAD (member, admin, or owner), the allowlist entry that authorized your access, an avatar color we generate from your email, your storage limit, and the timestamps for account creation, last update, and most recent sign-in.
3.2 Files and CAD data you upload to ctwcad.com.
When you upload files through the website, the desktop app, or the mobile app, we store the file content (CAD geometry, document data, images, PDFs, and any other format you upload), the file's name, size, content type, your specified folder and project, the version history you create, your share settings (private, link, public-read), any tags or comments you attach, and your editing timestamps.
We also store a small amount of generated metadata: a thumbnail seed used to render previews, the inferred file kind (e.g. "step", "stl", "image"), and a download URL token from Firebase Storage so the website and apps can fetch the file.
3.3 Fusion 360 plugin data.
If you install and authorize the CTWCAD Fusion 360 plugin, the plugin transmits the data described in §3.3.1 and §3.3.2 to our servers. Authorization is explicit: the plugin opens this website and asks you to agree to this Policy before any data is transmitted. You can revoke the authorization at any time (§6.4); revocation stops further data transmission.
3.3.1 Geometry, parameters, sketches.
For each Fusion 360 document you save while the plugin is active, the plugin transmits the document's three-dimensional geometry, its parametric feature tree (the ordered sequence of features such as extrudes, fillets, holes, patterns, and assemblies), the sketches you have constructed including their geometric and dimensional constraints, every parameter and the relationships you have defined between parameters, the document and project names, and the timestamps for document creation and last save.
We have full access to this data once it reaches our servers. We process it as described in §4.
3.3.2 Edit history and workflow signals.
Where Fusion 360 exposes the data and you have not turned off edit history transmission, the plugin also transmits the order in which you constructed your features, modifications and undos you performed, the sequence in which you defined parameters and assigned constraints, and the time you spent on each feature. We refer to this collectively as "workflow signals."
Workflow signals are the primary input to the AI models described in §4.3. Geometry alone does not tell us how an engineer thinks; the sequence of decisions does.
3.3.3 What the plugin does not transmit.
The plugin does not transmit your Fusion 360 account credentials (we authenticate you via Google OAuth, not Autodesk), Fusion 360 documents that you opened but did not save while the plugin was active, files or data outside Fusion 360 (other applications, your operating system, your filesystem outside the plugin's working directories), or add-in data unrelated to the CAD workspace.
The plugin does not screenshot your display, keylog your input, or transmit any data while you are not actively saving a Fusion 360 document.
3.4 Desktop application diagnostic bundles.
The CTWCAD Windows desktop app, when configured to do so, uploads a session diagnostic bundle to the cloud at the close of each session. The bundle contains structured logs from your session: which features you used, which files you opened, errors and warnings the app encountered, and crash reports if any occurred. The bundle is uploaded to a per-user, owner-readable Storage location.
You — and only you — can read your own diagnostic bundles via the "My Diagnostics" page on the website. Other users, including users with admin role, cannot read your diagnostics. The CTWCAD operator can read diagnostics through the Firebase console for the purposes of investigating issues you report; we will tell you when we do.
3.5 Usage data, device data, and cookies.
When you visit ctwcad.com or use the apps, we automatically collect information about how you use the Service: the pages you visit, the features you click, the projects and folders you open, the duration of your sessions, and aggregate performance metrics like page load time and animation frame rate. This information is associated with your account when you are signed in.
We collect device information including operating system and version, browser name and version, screen size and pixel density, and a generated device identifier we use to recognize your sign-in across the desktop app, the mobile app, and the website.
We use cookies, local storage, and equivalent browser storage technologies to keep you signed in, remember your theme preference, remember which folders you had open, cache portions of your CTWCAD data so the app loads quickly, and for similar quality-of-life purposes. We do not use third-party analytics cookies.
3.6 Information from third parties.
When you sign in with Google, we receive the information described in §3.1 from Google. When you upload files, the underlying storage service (Firebase Storage / Google Cloud Storage) processes them on our behalf and provides us with usage and access metadata.
When you connect a desktop or mobile device, we may receive a Firebase Cloud Messaging registration token associated with that device so we can deliver push notifications you have opted in to receive (for example, the desktop sign-in approval push from your phone).
4. How we use your information
4.1 Operating and maintaining the Service.
We use your information to provide the Service: to authenticate you, serve your files, render your projects and folders, run searches you initiate, sync between your devices, deliver email and push notifications you have opted in to, enforce your storage quota, and operate every feature you interact with.
4.2 Communicating with you.
We use your contact information to send you transactional emails (account confirmations, security alerts, sign-in approvals, password or session resets), respond to support requests, and notify you of material changes to this Policy or our Terms of Service.
We do not currently send marketing email. If we begin sending marketing email, you will be able to opt out via an unsubscribe link in every such message.
4.3 Improving the Service and training AI models.
CTWCAD includes AI-assisted design tools that propose features, parameters, and construction sequences as you work. To make these tools useful, we train and refine machine learning models using data collected through the Service. The Fusion 360 plugin data described in §3.3 is the primary input to that training; the website-uploaded files described in §3.2 may also be used for training where you have not opted out (§6.5).
4.3.1 What "training on workflow patterns" means.
We extract aggregated, anonymized signals from your workflow data — which features tend to follow which other features, common sketch construction patterns, parameter naming conventions, the shape of dependency graphs in parametric models, and similar patterns. These signals feed machine learning models that power CTWCAD's design assistant, similar features, and search.
4.3.2 How we anonymize and aggregate.
Before workflow signals enter a training run, an anonymization pipeline strips file names, project names, parameter names that contain identifying strings, and any user-identifying metadata. Models train on patterns that recur across many users; no model is trained from a single user's data alone, and no training output is keyed to a specific user's identity.
We retain the un-anonymized source data so we can re-run anonymization when we improve the pipeline, and so you can exercise your access and deletion rights against the original data (§6.1, §6.3).
4.3.3 What we will not train on.
We do not train models to reproduce, replicate, or reverse-engineer your specific designs. We do not use the geometry or visual appearance of your CAD work as a training output. The product of training is a model that understands engineering process, not a model that knows what you have built.
If you opt out of training (§6.5), data we collected from you after the opt-out date is excluded from training datasets going forward. Models that were trained on data we collected before the opt-out cannot be retroactively un-trained — that is a limitation of how machine learning models work — but we will exclude you from future training runs.
4.4 Security, abuse prevention, and incident response.
We use your information to detect and prevent fraud, abuse, and security incidents; to enforce our Terms of Service; and to defend the Service. This may include analyzing usage patterns to identify unauthorized access attempts, inspecting reported content, and preserving evidence in connection with a security incident.
4.5 Legal compliance.
We use your information to comply with applicable law and regulation, including responding to lawful subpoenas and court orders (§5.4).
5. How we share your information
5.1 Service providers and infrastructure.
We host the Service on Google Cloud Platform via Firebase: Firestore for structured data, Cloud Storage for file blobs, Cloud Functions for server-side logic, Firebase Authentication, and Firebase Cloud Messaging. Google processes your data on our behalf as a data processor; Google's Cloud Data Processing Addendum governs that processing.
We do not currently use other third-party processors. If we add a processor, we will update §5.1 with their identity, the purpose of the processing, and (where applicable) the contractual safeguards in place.
5.2 Collaborators you choose.
When you share a project, folder, or file with another user — by adding them as a member, by sharing a link, or by enabling public-read on a specific file — that user gets the access level you chose. We do not share your data with collaborators you have not selected.
5.3 Aggregated and de-identified disclosures.
We may publish or share aggregated and de-identified information that does not identify you (for example, total user count, total file count by file type, average parameters per parametric model). Such disclosures do not constitute sharing of your personal information.
5.4 Legal requests and protective disclosures.
We may disclose your information when required to do so by law, including in response to a subpoena, court order, or other legal process. We may also disclose your information when we have a good-faith belief that disclosure is necessary to protect the safety of any person, to address fraud or security issues, to enforce our Terms of Service, or to protect our legal rights.
If we receive a legal request for your data, we will (where permitted) attempt to notify you so that you can exercise your rights.
5.5 Business transitions.
If CTWCAD is sold, merges with another entity, restructures, files for bankruptcy, or otherwise undergoes a business transition, your information may be transferred to the new entity. The new entity will be bound by this Policy or a successor policy that protects your information at least as much. We will notify you of the transition in advance where reasonably possible.
5.6 We do not sell personal information.
We do not sell your personal information for monetary consideration. We do not currently engage in "sharing" your personal information for cross-context behavioral advertising as that term is defined under California law. See §11.4 for the formal CCPA / CPRA notice.
6. Your rights and choices
6.1 Accessing and downloading your data.
You can view all of the personal information CTWCAD holds about you through your account on the website. You can download your files individually via the file drawer's Download button, in bulk via a project's Export-as-ZIP, and in raw form by emailing us a request under §14.
6.2 Correcting your data.
You can update your name, profile photo, and email through your Google Account; the Service automatically reflects those changes. You can rename your files, folders, and projects from the website.
If you discover an error in CTWCAD's records that you cannot correct yourself, contact us under §14 and we will correct it within 30 days.
6.3 Deleting your data.
You can move individual files to Trash, permanently delete trashed files, and delete entire projects through the website. You can revoke the Fusion 360 plugin authorization at any time (§6.4) and request deletion of all data the plugin has uploaded by emailing us under §14.
You can request that we close your account and delete all of your data. We will complete the deletion within 30 days of your request, subject to the retention exceptions in §7.
6.4 Revoking the Fusion 360 authorization.
The Fusion 360 plugin authorization is revocable at any time. To revoke, visit ctwcad.com/settings → Connected apps & training, and click "Revoke Fusion 360 authorization." Once revoked:
- The plugin stops transmitting data on its next sync attempt.
- Your previously-transmitted data is excluded from new training runs going forward.
- Models that were trained before revocation are not affected, as described in §4.3.3.
You can re-authorize the plugin at any time by signing in to the plugin again. Re-authorization references the version of this Policy in effect at the time and will require you to agree to that version.
6.5 Opting out of training.
You can opt out of having your data — both Fusion 360 plugin data and ctwcad.com files — used to train models. To opt out, email us under §14 with the subject line "OPT OUT OF TRAINING." Your opt-out takes effect within seven days. Data we collect from you after the opt-out date is excluded from training datasets going forward; see §4.3.3 for the limitation on retroactive opt-out.
6.6 Closing your account.
You can request that we close your CTWCAD account by emailing us under §14 with the subject line "CLOSE MY ACCOUNT." We will close the account, delete your stored files, and delete your account information within 30 days. We will retain audit logs and de-identified analytics as described in §7.
7. Data retention
7.1 Active account data.
We retain account information, files, and metadata for as long as your account is active. If you do not sign in for twelve consecutive months, we may notify you that your account will be closed for inactivity and proceed with closure 30 days after notice.
7.2 Trashed files.
Files you move to Trash remain recoverable for 30 days, after which they are permanently deleted. You can permanently delete a trashed file before the 30-day period elapses.
7.3 Diagnostic bundles and audit logs.
Session diagnostic bundles uploaded by the desktop app (§3.4) are retained for 90 days, after which they are automatically deleted unless you have specifically asked us to preserve a bundle for issue investigation. Audit logs of administrative actions are retained for two years for security and compliance purposes.
7.4 Training datasets and trained models.
Anonymized workflow signals used in training datasets are retained for the lifetime of the model trained on them, plus seven years. Trained models are retained indefinitely. Both are subject to your opt-out (§6.5) for going-forward training; the retroactive limitations described in §4.3.3 apply.
8. Security
8.1 Encryption in transit and at rest.
All connections to the Service use TLS 1.2 or higher. Data stored in Firebase Storage is encrypted at rest under Google-managed encryption keys. Data stored in Firestore is encrypted at rest under Google-managed encryption keys.
8.2 Access controls.
Access to your data is controlled by Firebase Security Rules configured to enforce the access boundaries described in this Policy: non-owner admins cannot read other users' diagnostic bundles, the Fusion 360 plugin can only write to your own data, and other rules specific to each collection. Rules are versioned in our source control and reviewed before each deploy.
The CTWCAD operator has administrative access to the underlying Firebase project for the purposes described in §3.4 and §4. The operator does not access your CAD geometry or design content as a matter of routine.
8.3 Incident notification.
If we discover a security incident affecting your personal information, we will notify you within 72 hours of discovery (or as soon as reasonably possible, where 72 hours is not feasible) by email. The notification will describe the nature of the incident, the information involved, the steps we are taking, and what you can do.
9. International users and cross-border transfers
The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to that transfer.
For users in the European Economic Area, the United Kingdom, and Switzerland, see §12 for the legal bases and protections that apply to your data.
10. Children's privacy
The Service is not directed to children under the age of 16, and we do not knowingly collect information from children under 16. If you believe we have collected information from a child under 16, contact us under §14 and we will delete the information promptly.
11. Notice for California residents (CCPA / CPRA)
This section provides additional disclosures required for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
11.1 Categories of personal information we collect.
In the past 12 months, we have collected the following categories of personal information from California residents: identifiers (name, email, Google account ID, IP address, device identifier); customer records information (account profile data); commercial information (account creation date, sign-in history); internet activity (usage data, cookies as described in §3.5); geolocation data (only the country derived from IP); professional information (CAD designs and related work product as described in §3.2 and §3.3); and inferences drawn from the above (the workflow signals described in §3.3.2).
11.2 Sources, purposes, and disclosures.
We collect personal information from the sources described in §3. We use it for the purposes described in §4. We disclose it to the recipients described in §5. We do not sell or share personal information.
11.3 Your CCPA / CPRA rights.
You have the right to know what personal information we have collected about you (§6.1), correct inaccurate information (§6.2), delete your information (§6.3 / §6.6), opt out of the sale or sharing of your information (we do not sell or share, but the right exists), limit our use of sensitive personal information, and not be discriminated against for exercising any of these rights.
To exercise these rights, email us under §14. We will respond within 45 days. We may need to verify your identity before responding; we will not ask you for more information than necessary to do so.
11.4 We do not sell or share personal information.
We have not sold or shared the personal information of California residents in the past 12 months.
12. Notice for European, UK, and Swiss residents (GDPR)
12.1 Roles.
For the purposes of the General Data Protection Regulation, the UK GDPR, and the Swiss Federal Act on Data Protection, CTWCAD is the data controller for personal information collected through the Service. Google (as Firebase) acts as a data processor on our behalf.
12.2 Legal bases for processing.
We process your personal information on the following legal bases:
- Contract (Article 6(1)(b)): processing necessary to provide the Service you have requested.
- Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate interests in operating, improving, and securing the Service, where those interests are not overridden by your rights and freedoms. We use this basis for the security and abuse-prevention processing in §4.4.
- Consent (Article 6(1)(a)): the Fusion 360 plugin authorization in §3.3 and §6.4 is processed under your explicit consent. Training-data use under §4.3 is processed under consent for plugin data and under legitimate interests for non-plugin data, subject to your opt-out (§6.5).
- Legal obligation (Article 6(1)(c)): for the legal-compliance processing in §4.5 and §5.4.
12.3 Your rights under GDPR.
You have the right to access your data, rectify inaccuracies, request erasure, restrict processing, object to processing based on legitimate interests, and request data portability. To exercise any of these rights, email us under §14.
12.4 Right to lodge a complaint.
You have the right to lodge a complaint with a supervisory authority in the EU/EEA member state of your habitual residence, place of work, or place of the alleged infringement. In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ico.org.uk).
12.5 Data Protection Officer.
CTWCAD has not appointed a designated Data Protection Officer because our processing does not meet the threshold for mandatory appointment under Article 37 of the GDPR. Privacy questions should be addressed to the contact in §14, with the subject line "PRIVACY QUESTION."
13. Changes to this Policy
13.1 How we communicate changes.
We will post any changes to this Policy at ctwcad.com/legal/privacy with a new effective date and an updated version number.
13.2 Material changes and re-authorization.
If a change to this Policy materially affects how we handle your information — for example, if we expand the categories of data we collect, add a new category of recipients, or change the purposes for which we use your data — we will (a) notify you by email, and (b) for the Fusion 360 plugin authorization, require you to re-authorize the plugin under the new version. Existing authorizations remain valid under the version of the Policy in effect at the time they were granted.
13.3 Version history.
- v1.0 ({POLICY_EFFECTIVE}) — Initial publication.
14. How to contact us
For privacy questions, requests under §6, or any other inquiry related to this Policy, contact:
Seth Ricks
Email: sethbenricks@gmail.com
Subject line: PRIVACY (followed by your specific request)
We will acknowledge your inquiry within seven days and respond substantively within the timelines specified in §6 and §11.
End of CTWCAD Privacy Policy v{POLICY_VERSION}.