Privacy

Data we collect

What is stored depends on how you use the product — guest and signed-in users are not the same.

• Account: email, password hash on the server, and google_sub when you sign in with Google
• Sign-in: IP address, sign-in time, and related email when you log in with a password or exchange a Google OAuth code — used for security and access review
• Sign-out: IP address and time when you choose Log out, when the session expires, or when you close the tab/window (best-effort)
• Designs: specification JSON you save to the server after sign-in
• Reference bodies: meshes you upload, nearest matches from the on-server sample library, or results from the human generation service when you choose to use it
• Browser: JWT and email in localStorage to keep you signed in (AuthSession); a threed_device_id cookie (UUID) to limit how many accounts one browser can register in a configured window — not a login cookie
• Server: HTTP logs at the level configured in the service — raw passwords are not written to logs; successful sign-ups may add a register_device_events row tied to the device id

How we use data

We use data to provide what you ask for: sign-in, the design library, the editor, drape, and pattern print.

Sign-in and sign-out IP and time records are used for account security and investigating suspicious access — not for advertising.

We do not sell personal data and do not use your pattern data to train in-product AI models.

Third-party services

External connections start with your action — we do not send data unnecessarily.

• Google OAuth — when you choose Sign in with Google (Nest holds the client secret; the portal does not talk to Google directly)
• human-api — when you generate a parametric body via MakeHuman (separate service; AGPL isolated from Nest/portal)
• Hosting/infrastructure — whoever runs this instance (cloud or your organisation’s servers)

Open-source and dataset credits

Tailorsim runs open research software and datasets on the server to provide the service — we do not redistribute the full packages or body libraries for download, but we credit the authors. Anyone who wants to reuse them should take them from the upstream projects under each project’s own license.

• GarmentCode / pygarment (MIT) — Maria Korosteleva and collaborators · pattern construction and mesh bake on the server · https://github.com/maria-korosteleva/GarmentCode
• Sample body library (~5000) — from GarmentCodeData (Korosteleva et al.) · used for measurement-based nearest-mesh search on the server · https://igl.ethz.ch/projects/GarmentCodeData/
• MakeHuman — source under AGPL-3.0 · runs separately as human-api · see that service’s GET /license and https://www.makehumancommunity.org/

Retention

Server-side designs remain until you delete them or an administrator removes the account.

Sign-in and sign-out IP and time records remain in the instance database until an operator deletes them or per your organisation’s retention policy.

Browser tokens remain until you log out, clear site data, or switch devices.

Guest editor work stays mainly in the browser — it is not uploaded until you save after sign-in.

Your choices

• Use the editor without registering — OAuth is not required
• Log out to remove the token from your browser
• Delete designs from `/designs` yourself
• Request account deletion or data questions — contact the operator of the instance you use

Security

Signed-in API calls use Bearer JWT · use HTTPS in production

Do not share links or files that expose tokens or confidential pattern work

Policy changes

We may update this page when features or law change — the date at the top of this page will change accordingly.