Privacy Policy

Your privacy is important to us. This policy explains what information we collect, how we use it, and your rights regarding your data.

Effective June 6, 2026. Last updated August 31, 2026.

Who We Are

MyLaserTools.com is operated by YXE Creations Craft Hub Inc., a corporation incorporated federally in Canada (242 Stilling Union, Saskatoon, SK, Canada). We are the controller responsible for the personal data described in this policy.

For any privacy question or to exercise your rights, email hi@mylasertools.com or visit our Contact & Support page.

1. Information We Collect

Account Information

When you create an account, we collect and store:

Your email address
Authentication credentials (encrypted password or OAuth token)
Account creation and last login timestamps
Your marketing-email choice, when and where you made it, and the consent wording version shown to you

Third-Party Authentication

If you sign in using Google OAuth, we collect:

Your email address from your Google account
Google user ID (used for authentication purposes only)
Basic profile information provided by Google

We do not access your Google contacts, files, or other personal data beyond what is necessary for authentication.

Anonymous Usage Data

We may also collect anonymous usage data automatically, including:

Pages visited and actions taken on the site
Tool usage and generation events
Browser type, operating system, and screen size
Referring URLs and timestamps

Map Designer Data

When you use Map Designer, we may process map-related information needed to operate the tool, including:

Place search text, selected place names, and manually entered coordinates
Map center coordinates, zoom level, bounds, rotation, and selected layers
Topography, bathymetry, style, border, and export settings
Project names, saved revisions, autosave timestamps, and export requests

Saved Map Designer projects may include the places or coordinates you select and may be associated with your account or browser.

2. How We Use This Information

We use the collected information for:

Providing and managing your user account
Authenticating your identity when you sign in
Sending account-related notifications (password resets, security alerts)
Improving the performance and usability of our tools
Understanding which features are most useful to our users
Fixing bugs, monitoring errors, and ensuring uptime

We do not use your email address for marketing purposes without your explicit consent. We do not sell or share your personal information with third parties for advertising.

If you opt in to marketing email, we use your account ID, email address, name, and preference history to keep our mailing system synchronized. You can withdraw that consent at any time in your account settings or through the unsubscribe link in an email.

3. Cookies, Storage & Analytics

We use cookies and similar browser storage to run the service and, with your consent, to measure how our tools are used. We do not use advertising cookies or cross-site advertising trackers, and we never sell your usage data.

Essential cookies

We use strictly necessary cookies to sign you in, keep your session active, remember your cookie choice, and help protect against fraud and abuse. These are required for the site and account features to work and do not require consent. If you block them in your browser, you will not be able to sign in.

First-party and Google analytics

We measure how the tools are used with our own first-party analytics so we can improve them. This uses your browser's local storage and session storage (not advertising cookies) to count page and tool views and remember which website referred your visit. These records are anonymous, do not include your name, email, account ID, or session ID, and are not linked back to your identity.

With your consent, we also use Google Analytics 4 to understand overall page and session activity and high-value actions such as exports and Map Designer interactions. It may collect a randomly generated analytics identifier, pages viewed, approximate location derived from your IP address, device and browser type, and relevant events. Some events are sent from your browser and some from our server on your behalf. Google Analytics is loaded through Google Tag Manager, with IP anonymization enabled, and is not used for advertising or ad personalization. Google Tag Manager loads when you visit so it can manage tags and apply your consent choice, but it does not itself set analytics cookies. Google Analytics is blocked by default and only loads after you accept in our cookie banner. If you decline, we do not load Google Analytics, set its cookies, or send its events from your browser or server. Google processes consented analytics data on our behalf; see Google's Privacy Policy.

Your choices

When you first visit, a cookie banner lets you accept or decline analytics cookies, and we remember your choice. You can change it by clearing this site's cookies so the banner appears again. Blocking essential cookies prevents sign-in and account features. Declining or blocking analytics does not affect your ability to use the tools.

4. Third-Party Services

Authentication Services

We use Google OAuth for third-party authentication. When you sign in with Google, your authentication is handled by Google's servers. We only receive the minimal information necessary to create and manage your account. Please review Google's Privacy Policy for information about how Google handles your data.

Analytics Services

We use our own first-party analytics and, with your consent, Google Analytics 4 to understand how the tools are used. We do not use analytics for advertising, and we do not sell your usage data. See the Cookies, Storage & Analytics section above for details, including how to accept or decline Google Analytics.

Billing & Payments

Map export packs and Pro subscriptions are sold and processed by Polar, acting as our Merchant of Record. Polar processes your payment and billing details to take payment, issue invoices, and handle applicable taxes. We do not receive or store your full payment card details. Please review Polar's Privacy Policy for how they handle payment data.

Email Communications

We use email-delivery and mailing-system providers to send account messages and, only when you opt in, marketing email. For marketing synchronization, those systems receive the minimum account information needed to identify the subscriber: your stable account ID, email address, name, and current preference, plus a previous email address when it is needed to update or remove the right subscriber. Unsubscribing in an email is written back to MyLaserTools so that your account remains opted out.

Hosting & Infrastructure

We rely on a small number of trusted providers (sub-processors) to run the service:

Supabase, for authentication and database storage
Cloudflare, for hosting, the application database, and content delivery
Polar, for one-time payments and subscription billing
Google, for optional sign-in (OAuth) and, with your consent, Google Analytics loaded through Google Tag Manager

These providers process data only as needed to operate MyLaserTools and under their own data protection terms.

International Data Transfers

We are based in Canada and our providers may process data in Canada, the United States, the European Union, and other regions. Where data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, in line with applicable data protection law.

Map and Place Search Services

Map Designer uses our hosted map infrastructure for map, topography, and bathymetry tiles. Tile requests may include normal technical data such as IP address, browser headers, requested tile coordinates, and timestamps in our service logs.

Some city search results may come from our local GeoNames-based search index. Those searches are handled by our servers.

For users with Mapbox search enabled, place search text is sent from our server to Mapbox to return place names and coordinates. We do not send your MyLaserTools account ID to Mapbox as part of that search request. Mapbox may process the request under its privacy policies.

5. Design Data

When you share or save a design, the tool settings you configured (such as text, font, dimensions, and colors) are stored on our servers. Shared design links do not contain personal information and are not linked to your account. Anyone with a shared link can view the design settings, so avoid including sensitive information in your designs if you plan to share them. Saved designs are linked to your account and are private to you. You can delete your saved designs at any time.

Saved Map Designer projects may also store place names, coordinates, map view settings, selected data layers, layer styling, export settings, and revision history. Local Map Designer autosaves are stored in your browser using IndexedDB. When you preview or export a map, the request may be processed by our map export service and may include your user ID, map bounds, selected layers, output size, and related export settings. To show a rasterized export preview, we temporarily store the generated export and rasterized preview images for up to 24 hours. The final SVG stays private to your account and becomes available only after you use a map export; abandoned previews expire automatically. The final export is saved privately in My Designs until you delete it or delete your account.

Public designer profiles. You can claim a handle and publish an optional public profile page at /u/[handle]. Profiles are off by default: claiming a handle publishes nothing until you turn your profile public. Your avatar, location, and join date each have their own visibility switch that is off by default; your profile stats (followers, published designs, likes, and downloads) have their own switch; and any links appear only if you add them. We never publish your account name or Google profile photo automatically; a public profile shows only the display name, avatar, and details you choose to add. You can make your profile private, remove any field, or delete the profile entirely at any time from your account settings, and the public page reflects the change immediately.

Community Designs and profile pictures. If you choose to submit a design to Community Designs, the design file, a generated preview image, your title and description, and your public display name are stored on our servers and made publicly available to anyone immediately. If you upload a profile picture, it is stored on our servers and shown publicly next to your published designs. Only submit content and images you are comfortable making public. You can set a submission to private or delete it, and you can remove your profile picture, at any time from your account. Publishing is voluntary, and we review published designs after they go live rather than before; see our Terms of Service for the license you grant when you submit.

6. Data Retention

We retain your account information for as long as your account remains active. You can delete your account through account settings or ask us for help at hi@mylasertools.com. Account content and preferences are erased or tombstoned through that workflow, subject to the limited operational exception below and any records we must retain by law.

Anonymized analytics data is retained for as long as necessary to improve our services. This data cannot be linked back to any individual.

Marketing synchronization records are a temporary operational exception to immediate account deletion. They can retain your account ID, current or previous email address, name, preference, and event time long enough to propagate an opt-out or deletion safely to the mailing system. Delete events omit your name. We do not delete these records immediately because doing so could allow an older subscription event to be replayed after your account is deleted; they remain subject to access and deletion requests and will be removed under a checkpoint-aware retention process when that process is available. These records are included when responding to an applicable personal-data access request.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate personal data
Deletion: Request deletion of your account and personal data
Data Portability: Request a copy of your data in a portable format
Withdraw Consent: Withdraw consent for data processing where applicable

Where data protection law applies, we rely on the following legal bases: performing our contract with you (to provide and manage your account and paid features), your consent (where we ask for it), and our legitimate interests (to secure, maintain, and improve the service using anonymous analytics).

To exercise any of these rights, please contact us at hi@mylasertools.com. We will respond within the timeframe required by applicable law. If you are in the EU, UK, or another region with a data protection authority, you also have the right to lodge a complaint with your local supervisory authority.

8. Data Security

We take reasonable measures to protect your personal information, including:

Encrypting passwords using industry-standard hashing algorithms
Using secure HTTPS connections for all data transmission
Storing data with reputable cloud service providers
Regularly reviewing and updating our security practices

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Children's Privacy

MyLaserTools is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us at hi@mylasertools.com and we will delete it.