Privacy Policy

Effective October 26, 2026

In short: your photos never leave your browser, there are no ads or analytics, and we never see your card details. The details are below.

1. Who is responsible for your data

The data controller is [owner's full name or company name, country, address]. For any question about your data, email [email protected].

2. What we collect

• Account: username, name, email and password. The password is stored only as a secure hash.
• Session: a sign-in cookie (HttpOnly, Secure, SameSite=Lax). It keeps you signed in; sign-in doesn't work without it.
• License and devices: your chosen platform, your computer's name and fingerprint, an anonymized iPhone identifier, and license check dates.
• Security log: time, request type, result and the connection's IP address (which may belong to Cloudflare). Passwords, tokens and keys are never logged.
• Purchases: the order number and payment status from Lemon Squeezy. We never receive your card details.

3. What stays with you

• A photo you add to the web try-on is processed in your browser and stored only in its local storage (IndexedDB) on your device.
• Favorites, recently viewed designs and photo position are kept in your browser's localStorage.
• Projects and photos in the Slurx app are stored on your computer.

You can clear this data in your browser settings ("Clear site data") or with the "Remove photo" button in the try-on.

4. Why we use it

• Signing you in and issuing your license: performance of a contract.
• Protecting against break-ins, fraud and abuse: legitimate interest.
• Answering support requests: performance of a contract and your request.

We don't sell data, show ads or use third-party trackers or analytics.

5. Who we share data with

• Cloudflare: site protection and delivery.
• Lemon Squeezy: payments and taxes (their privacy policy covers payment data).
• Server hosting provider: [provider name and country].

Data may be processed outside your country. We share only what the service needs to work.

6. How long we keep it

• Account data: for as long as the account exists, then up to [30] days in backups.
• Security log: [12 months].
• Purchase data: as long as tax and accounting law requires.

7. Your rights

You can request a copy of your data, correction, deletion of your account or restriction of processing, and you can withdraw consent. Email [email protected] from your account's address and we'll reply within 30 days. You can also contact the data protection authority in your country.

8. Security

We use HTTPS, hashed passwords, sign-in attempt limits, request origin checks and an admin activity log. Found a vulnerability? Report it to the address in security.txt.

9. Children

Slurx is not intended for children under 16. If you believe a child has created an account, contact us and we'll delete it.

10. Changes

When this policy changes, we'll update the date at the top of the page and announce significant changes in advance.