Privacy notice
This is how Throwcast handles information about you. It is short because we collect little, and specific because a generic notice would be false. If anything here is unclear, write to hello@throwcast.app.
Who is responsible
Throwcast — the sites at throwcast.app, studio.throwcast.app and manual.throwcast.app, and the email we send — is operated by an individual entrepreneur registered in Ukraine, trading as Throwcast. That person is the controller of the personal data described here. Full registration details are available on request at hello@throwcast.app.
Throwcast is a professional tool for people who plan and rig projection. It is not intended for children, and we do not knowingly collect data about anyone under 16.
What we collect, and why
If you ask for access
When you join the list on throwcast.app, or press Request access in the app, we store your email address, the note you type, and the time of the request. To limit repeated submissions we also keep a hashed form of your IP address for 24 hours; the address itself is not stored. We use this to decide whom to invite and to email you when there is a place. The legal basis is our legitimate interest in running a list you asked to be on. We keep the entry until you are invited or declined and for at most twelve months after the request, or delete it sooner if you ask.
If you have an account
Your account is your email address and a password, which our sign-in provider stores as a hash we cannot read. We also record when you sign in, and we name your workspace after the first part of your email address. We use this to run your account, to send you invites and password resets, and to tell you about changes to the service that affect you. The legal basis is the agreement between us. We keep it while your account exists.
Your projects
Everything you put into a project is stored so we can show it back to you: the document, the models and images you import, and a thumbnail. Projects often contain other people’s property — a client’s venue drawings, for instance. We store that content for you and use it for nothing else: we do not mine it, do not use it to train anything, and we disclose it to nobody. You can choose to share a project yourself, which is a different thing — see below. It stays until you delete the project or your account. You can export any project as a file at any time from the app.
If you share a project
The app can create a link that opens one project read-only, for anyone who has it, with no account and no signing in. We store the link itself: a random token, which project it opens, who created it, and when. That record is what lets the link be opened and lets you revoke it, and it is deleted when you revoke the link or delete the project.
Sharing is a disclosure you make, not one we make. Whoever holds the link can see the project’s contents, including anything in it that belongs to a client. The link works until you revoke it — it does not expire on its own. If a project contains personal data, you are the one deciding to show it, and you should be satisfied that you may.
When somebody opens a shared link we do not ask who they are, do not create an account for them, and keep nothing that identifies them. As with any page, our hosting providers see the request and its IP address and keep the short-lived technical logs described below.
When we look at your project
To help with a problem, the operator can open any project from an administration panel, in a read-only mode that cannot change it. Every such opening is written to an audit log with who opened what and when. We do this only to investigate a problem you have reported, or to investigate abuse of the service.
When something goes wrong
If the app hits an error, a report goes to Sentry, an error-tracking service hosted in Germany. A report contains the error and where in the code it happened, the type of browser and device, and the identifier of the project that was open. It is not tied to your name or email address, and it contains no project content. Reports are kept for 90 days.
We send email only for the service: an invite, a password reset, and occasional notes about the beta to account holders. It goes out through Resend from send.throwcast.app, hosted in the EU. There are no marketing lists.
Delivering the pages
Our hosting providers see your IP address and the pages you request, as any web host does, and keep short-lived technical logs for security and operations. We do not keep those logs ourselves. None of our sites sets a cookie, there is no advertising, and nothing here follows you to another site.
Counting visits
All three sites carry Cloudflare Web Analytics, which Cloudflare adds to each page as it is served. It records a page view: the site and the path within it, the page you arrived from, your country, and your browser, operating system and device type, along with timings for how quickly the page drew. Inside the app it also notes when you move from one screen to another.
It is measured without cookies and without storing anything in your browser, and Cloudflare states that it does not identify individuals from an IP address, a user-agent string or anything else. What comes back to us is counts and averages — how many people opened a page, from where, on what — never a person and never a session we could follow. It is not used for advertising and it does not track you across other sites.
The legal basis is our legitimate interest in knowing whether the sites work and whether anyone is reading them. Nothing depends on it: if you would rather not be counted, any tracker blocker stops the script and every page behaves exactly as before.
In your browser
The app keeps your interface preferences — panel sizes, what the viewport shows — in your browser’s local storage, on your machine, and your session too if you have signed in. Somebody opening a shared link has no session, only the preferences. Clearing the site’s data removes them.
Who handles data for us
| Provider | Does | Where |
|---|---|---|
| Supabase | database, sign-in, file storage | Frankfurt, EU |
| Cloudflare | serving the pages, DNS, counting visits | worldwide network |
| Resend | Ireland, EU | |
| Sentry | error reports | Germany, EU |
Each processes data only on our instructions, under its own data-processing terms. Nobody else receives your data from us, and we never sell it.
Backups
We may keep our own backup copies of the database and of uploaded files so that the service can be restored after a failure. Those copies are under our control in Ukraine. Data you delete is removed from them within 30 days.
Where your data is
The services above run in the European Union. The operator works from Ukraine, so administering the service, supporting you and keeping backups means your data is accessed from there.
Your rights
You can ask us to show you what we hold about you, correct it, delete it, or hand it to you in a portable form, and you can object to our use of it. Email hello@throwcast.app and we will answer within a month.
There is no button yet for deleting an account: ask, and we delete the account and every project in it. Your projects are portable already — export any of them as a file from the app. If you are in the EU or the UK you can also complain to your data-protection authority.
Changes
When this notice changes, the date at the top changes with it, and account holders get an email about anything material.