Where your work actually goes.

What runs on your device

The editors themselves. Modeling, sculpting, texture painting and viewport rendering all execute in your browser, on your GPU, through WebGPU — with a WebGL 2 fallback where WebGPU is unavailable. Your mesh, your layers and your brush strokes are held in the page, not uploaded to be processed. Closing the tab without saving leaves nothing on a server.

Unsaved work is also kept locally in your browser’s own storage so a reload does not lose it. That copy lives on your device and is cleared when you clear site data.

What leaves your device, and when

• When you save to your account. Your project document, its thumbnails and any assets you uploaded are stored under your account so they open on your other devices. Nothing syncs before you save.
• When you use an AI feature.That request’s prompt, and any images or models it takes as input, are sent to the provider running the model, solely to produce your result. Nothing else in your project is sent.
• When you publish or share. Community items and share links are, by design, readable by whoever you gave the link to.
• Sign-in and billing. Your email address, and the subscription state your payment provider reports back.

Where it is stored

Account data and project records live in a Supabase Postgres database; larger files — models, textures, thumbnails and exports — live in Cloudflare R2 object storage. The application is hosted on Vercel. Access to a stored document is checked per request against the account that owns it, and database row-level security backs that check at the data layer.

Accounts and sign-in

Authentication runs on Supabase Auth — Google sign-in, or an emailed sign-in link. Mixos never receives your Google password, and there is no Mixos password to leak.

Payments

Subscriptions and credit purchases started on the web are handled by Stripe; subscriptions started in the iOS app are handled by Apple. Card numbers are entered on the payment provider’s own surface and never reach Mixos servers — we receive only the fact that a subscription or purchase is active.

Training on your work

The privacy policy states it directly: your projects, models, textures, brushes and prompts are not used to train AI models, and are not sold or licensed to anyone for that purpose. AI providers are used under their commercial API terms, which do not permit training on submitted content by default, and the training opt-out is taken where one is offered. A third party’s internal systems cannot be audited from here, so that describes what is done and contracted for rather than a guarantee about someone else’s conduct.

Who processes your data

The complete, authoritative list lives in the privacy policy. In summary:

• Infrastructure — Supabase (auth, database, storage), Cloudflare (object storage and delivery), Vercel (hosting).
• Payments — Stripe, and Apple for purchases made in the iOS app.
• AI — fal.ai, OpenAI, Google and Anthropic, depending on the feature.
• Email — Resend for sign-in and service mail, Kit for product email if you opted in.

Deleting your account

You can delete your own account from the account page — it is at the bottom, and you confirm by typing your email address. It permanently removes your account, every saved project, your uploaded models and textures, and cancels any subscription. Billing and tax records are kept for as long as the law requires, and backups are overwritten on a rolling cycle, so a copy can persist there briefly. If the button doesn’t work for you — a team owner has to hand off the team first — email support@mixos.io.

Reporting a vulnerability

Report it to support@mixos.io with enough detail to reproduce it. Mixos is a one-person operation, so there is no bug bounty and no formal SLA — but the mail goes straight to the person who can fix it, and a genuine report gets a reply. Please don’t access other people’s accounts or data while testing, and give a reasonable window to ship a fix before publishing.

What this page does not claim

No uptime guarantee, no service-level agreement, and no SOC 2, ISO 27001 or equivalent audit — none of those exist today, and saying otherwise would be the easiest lie on the site to tell. If a compliance review needs one of them, say so at the address above rather than assuming.