Privacy Policy

Mixos (“Mixos”, “we”, “us”) operates the browser-based 3D creation tools at mixos.io and the Mixos iOS app, and is the controller of the personal data described here. This Privacy Policy explains what information we collect, why, who we share it with, and the choices you have.

Information we collect

• Account information. When you create an account we receive your email address and basic profile details from your sign-in method (Google or an emailed magic link). We do not receive or store your Google password.
• Content you create. Projects, textures, uploaded models, and related files you choose to save to the cloud are stored so we can sync them across your sessions. Editing and rendering generally run on your device. Saving, sharing, AI requests, and the usage reporting described below send information to our servers.
• AI conversations. Mixos AI stores your messages, attached images and video reference frames, assistant replies, tool requests and results, and references to assets used in the conversation. A request may include relevant workspace state or saved asset information so the assistant can carry out your instructions. We also store token, cost, and credit usage for each model step. Conversations are stored in our database and may be backed up in private object storage.
• Payment information. Paid plans are processed by Stripe. We never see or store your full card number — Stripe handles payment data and returns only a customer identifier and subscription status to us.
• Usage data. We collect usage and diagnostic information — for example, pages visited, features used, how a session started, device type, approximate country, and error reports. It is linked to your account when you are signed in and to a random browser identifier. We use it to operate and improve the service, and we review it mostly in aggregate. Older event records are archived in private object storage.

How we use information

• To provide, maintain, and secure your account and the service.
• To save and sync your projects, provide Mixos AI conversation history and backups, and enforce plan limits and AI-credit allowances.
• To process subscriptions, payments, and renewals.
• To respond to support requests and communicate service-related notices.
• To detect, prevent, and address abuse, fraud, and technical issues.

We don't train AI on your work

We do not use your projects, models, textures, brushes, or prompts to train AI models, and we do not sell or license them to anyone else for that purpose. Everything you make in Mixos is yours.

When you use an AI feature, your prompt and any input images or models needed for that request are sent to the provider that runs the model to produce your result. For Mixos AI, this can also include conversation history, workspace context, and tool results. We use commercial API services and available training opt-outs for these requests. Provider handling is governed by the applicable provider terms, and we cannot audit their internal systems. The providers are listed below.

Who we share information with

We disclose information to these providers as needed to run Mixos. Some, such as payment and sign-in providers, also process information under their own privacy terms.

Infrastructure

• Supabase — authentication, database, and file storage.
• Cloudflare — asset storage, private AI conversation backups and analytics archives, and content delivery.
• Vercel — application hosting and page-view analytics.
• Google — sign-in, if you choose to sign in with Google.

Payments

• Stripe — subscription billing and payments started on the web.
• Apple — billing for subscriptions started in the iOS app. Apple processes those payments under its own privacy policy and tells us only that a subscription is active.

AI providers

When you use an AI feature, the prompt and any input images or models for that request are sent to the provider that runs the model. Which one depends on the feature:

• fal.ai — image generation and editing, model retexturing, upscaling, 3D model generation, video generation, and vector tracing in the logo maker.
• OpenAI — image generation and editing, text generation, content moderation, and the embeddings behind library search.
• Google — image editing and generation, and layer and region planning.
• Anthropic — Mixos AI, using a Mixos-managed API account. Mixos AI sends relevant conversation history and inputs to Anthropic for each model step. If you use a separate assistant that asks you to connect your own provider key, its requests may instead go to Anthropic or OpenRouter under your agreement with that provider.

Email

• Resend — sign-in links and service email.
• Kit — product and marketing email, if you opted in. Every message has an unsubscribe link, and unsubscribing does not affect service email.

We may also disclose information if the law requires it, or to protect the rights, safety, or property of our users or ourselves. If we are ever involved in a merger or sale of assets, your data may transfer to the buyer, who would remain bound by this policy or give you notice of a change.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are used in California and other US state privacy laws.

Why we are allowed to use your data

If you are in the European Economic Area or the United Kingdom, the law requires us to name a legal basis for each use of your personal data. Ours are:

• Performing our contract with you — running your account, saving and syncing your projects, running the AI generations you ask for, and processing payments and renewals.
• Our legitimate interests — keeping the service secure, preventing fraud and abuse, and understanding aggregate usage so we can improve Mixos. We balance these against your rights and use the least data that works.
• Your consent — marketing email, which you can withdraw at any time by unsubscribing.
• Legal obligations — keeping billing and tax records for as long as the law requires.

Where your data is processed

Mixos is operated from the United States, and the providers listed above may process data in the United States and other countries. If you are in the European Economic Area or the United Kingdom, your personal data may be transferred outside your home country. Contact us for details of the transfer safeguards that apply to a particular provider.

Cookies and local storage

We use cookies and browser local storage to keep you signed in, remember your editor preferences, keep the usage identifier described above, and operate core functionality. We do not use advertising cookies. You can clear these through your browser, though doing so may sign you out and reset local settings. The Privacy control on the account page stops this device from sending new Mixos product analytics events. It does not remove events already collected or stop essential service and security records.

Data retention

We keep your account, saved content, and Mixos AI conversations while your account is active. You can delete projects and individual conversations at any time. Deleting a conversation removes its messages and private conversation backup, but does not delete a library asset saved from that chat.

If you delete your account, we remove its saved content, conversations, and associated private files. Billing and tax records may remain for as long as the law requires. Usage events, including older archived events, may remain after account deletion; the account ID is removed from live events, but a browser identifier or other event details may still allow an event to be linked to you. We retain these records for service analytics and security while they are useful, subject to applicable law and deletion requests. Copies in infrastructure backups may persist until the backup cycle expires. AI providers retain submitted inputs under their own schedules, which we do not control.

Security

We use industry-standard measures — including encryption in transit and access controls scoped to your account — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your rights

Depending on where you live, you have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent you have given. You are entitled to exercise these rights without being charged or receiving a worse service. To make a request, contact us at support@mixos.io. We answer within one month, and will tell you if we need longer.

If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your national data protection authority. If you are in California, you have the rights described above under the CCPA as amended, including the right not to be discriminated against for exercising them; we do not sell or share personal information, so there is nothing to opt out of.

Children

Mixos is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you.

Contact

Questions about this policy or your data? Email support@mixos.io.