Privacy Policy
Last updated October 17, 2026
Your designs stay yours.
Here's what we keep.
STEVE is a CAD tool at stevecad.studio that helps you describe, generate and refine 3D designs. This policy explains what information we collect when you use it, why, and what control you have.
01Summary
- You sign in with Google or X. We never see or store a password.
- Your designs and files are stored on our own server. We don't sell them, share them with other users, or make them public.
- We use a small number of service providers to run STEVE (sign-in, hosting, issue tracking and AI). They only get what they need to do their job.
- We use AI to troubleshoot and fix STEVE: bug reports and feature requests you send, and the system's own logs, are analysed by AI tools.
- STEVE's assistant runs on your own API key with the AI provider you choose: Anthropic, OpenAI, xAI, Google or OpenRouter.
- We may use designs to troubleshoot STEVE using AI services. Any other use of a design is authorized by its owner: designs are never shared for any other purpose.
- No advertising, no analytics trackers, no selling of data.
02What we collect
We don't receive your Google or X password, and we don't ask for payment details, phone numbers, contacts or your posts on X.
03How we use it
- To run STEVE: signing you in, saving your designs, and generating geometry from your requests.
- To keep it secure: spotting failed sign-ins, abuse and attacks, and locking accounts after repeated failed attempts.
- To fix and improve STEVE: investigating errors and understanding how features behave. We use AI tools to do much of this work; see AI features.
We don't use your designs to train AI models, we don't build advertising profiles, and we don't send you email.
Our legal basis
| What we do | Legal basis (GDPR) |
|---|---|
| Your account, saving and building your designs, the assistant, the API, apps and connectors you use | Providing the service you asked for (contract) |
| Security: logs, limits, spotting abuse and attacks | Our legitimate interest in keeping STEVE and its users safe |
| Troubleshooting and fixing STEVE, including reading a design with AI services when needed | Our legitimate interest in keeping STEVE working for everyone |
| Bug reports and feature requests you send | Your choice to send them, and our legitimate interest in fixing STEVE |
| Recording that you accepted the terms and confirmed a risk, and keeping that record | Providing the service you asked for (contract), and our legitimate interest in establishing and defending legal claims |
| Answering legal requests | Legal obligation |
Where we rely on legitimate interest, you can object (see Your rights).
05API, apps and connectors
These are optional. Anyone signed in can turn the Steve API on for their workspace; when you do, we record your name with that choice and when you accepted the terms.
- API keys and apps. When your software uses the Steve API, or an app acts for you, we record each request in your workspace's activity log: which key or app made it, what it asked for, the result, and the IP address it came from. You can see this log in Settings, under Developers. We use it to show you what happened, enforce limits, and spot misuse automatically.
- Apps you connect. An app someone else built receives the data the scopes you allowed let it read, and that app's developer handles it under their own terms and policy, not ours. Disconnect it in Settings at any time.
- Webhooks. If you add a webhook, we send your workspace's events (for example "a document was saved") to the address you chose.
- Connectors. A connector you run receives the actions you, or the software and AI you allow, ask it to do, with what each one needs (for example a design as a file). It sends back how each run went, its results and files, and the events it reports (such as a machine's status). We log each request a connector makes, with the IP address it came from, to secure the channel.
- If we withdraw access. If we withdraw a workspace's access to the Steve API because of misuse, we keep that workspace's ID and the date, even after the account is deleted, so the same sign-in can't simply turn it back on. We keep nothing else about it.
06AI features
STEVE's assistant
The assistant runs on an API key you add in Settings, with the AI model provider you choose. STEVE supports:
- Anthropic (Claude models)
- OpenAI (GPT models)
- xAI (Grok models)
- Google (Gemini models)
- OpenRouter (models from many vendors; OpenRouter passes your request to the vendor of the model you chose)
When you ask the assistant to build, inspect or change a design, your request and the relevant parts of your design are sent to that provider to produce a response, under your own account and agreement with them. For how that provider handles your design, refer to your agreement with that AI service provider, including whether it may be used to train their models. We store your key encrypted, never show it again after you save it, and use it only for your requests.
AI tools you connect
If you connect your own AI agent or app to STEVE (for example Claude, ChatGPT, Cursor or Gemini, through STEVE's MCP server), what you and your agent read and change in STEVE passes through that agent and its provider. For how they handle your design, refer to your agreement with that AI service provider.
How we use AI to troubleshoot STEVE
STEVE is built and run with the help of AI. When you send a bug report or feature request, AI agents read it, including any screenshot you attach and the context it carries, to work out what went wrong and to write and test a fix. AI tools also read STEVE's server logs and error messages to diagnose problems and keep the system running. Those logs can include IP addresses, timestamps and the pages or actions requested. A person oversees this work.
Two rules apply to your designs:
- We may use designs to troubleshoot STEVE using AI services. To fix a problem with the platform, the people who run STEVE and the AI services we use may read a design (its source, files and generated model) without asking you first.
- Any other use of a design is authorized by its owner. A design is never shared for any purpose other than troubleshooting the platform, unless you authorize it yourself, for example by creating a share link or connecting an app.
The AI services we may use to troubleshoot STEVE are:
- Anthropic (Claude models)
- OpenAI (GPT models)
- Google (Gemini models)
- xAI (Grok models)
- OpenRouter, which passes requests to the vendor of the model we choose
We use only paid services for troubleshooting, under their business terms. If we add a service to this list, we'll update this policy first.
Don't include personal, confidential or export-controlled information in prompts, designs or reports.
08Storage and security
Your account and designs are stored in the United States, on servers we run in Akamai's (Linode's) cloud in Chicago. Connections are encrypted with TLS. The database isn't reachable from the internet, and the sign-in system's admin console only accepts connections from specific network addresses and requires two-factor authentication.
No system is perfectly secure. Because STEVE is an early-stage project, keep your own copies of anything important. If a breach puts your information at risk, we'll tell you, and the relevant authority where the law requires it, without undue delay.
Transfers outside your country
STEVE and the providers in Who we share it with are based in the United States. If you're in the EU, the UK or Switzerland, your information is transferred to the US. These transfers rely on the safeguards in each provider's own data protection terms, such as the EU–US Data Privacy Framework or the EU's standard contractual clauses.
09How long we keep it
| Data | Kept for |
|---|---|
| Account details and designs | Until you delete them or ask us to delete your account |
| Your acceptance of the terms, and the risks you confirmed (which version or text, when, and your account ID) | As long as we may need it to defend a legal claim, also after you delete your account |
| Web server logs | Up to 90 days |
| Sign-in and security events | Up to 90 days |
| Bug reports and feature requests | Until you ask us to delete them |
| API activity log | 1 year (security events, such as refused or suspicious requests, 2 years) |
| Connector runs, their results and files | 1 year |
| Events a connector reports | 30 days |
| Files STEVE makes for a connector run (such as a 3MF) | 30 days |
| Connector request log | 1 year (requests from devices that aren't paired, 30 days) |
| A workspace's withdrawn API access (its ID and the date only) | As long as the withdrawal stands, also after the account is deleted |
| Database backups | Up to 14 days |
When we delete your account at your request, your data is removed from the live system and drops out of backups within 14 days. The one exception is a withdrawn API access record (see API, apps and connectors).
10Your rights
- See and update your details in your STEVE account.
- Get a copy of your information, including in a portable, machine-readable form: Download my data in Settings → Account gives you everything in one zip.
- Correct or delete your information, or your whole account: Delete my account in Settings → Account deletes it and everything in it, then your sign-in account. The one exception: we keep the record that you accepted our terms and the risks you confirmed, because we may need it to defend a legal claim (GDPR Article 17(3)(e)).
- Restrict or object to how we use it, including anything we do on the basis of legitimate interest.
- Disconnect STEVE from Google or X at any time in that provider's security settings. This stops future sign-ins but doesn't delete your STEVE data.
- Complain to a data protection authority, for example the one where you live, if you think we've handled your information wrongly. We'd appreciate the chance to put it right first.
For anything you can't do yourself in STEVE, message us (see Contact). We'll respond within 30 days. These rights come from the GDPR and similar laws (such as the CCPA); we offer them to everyone, wherever you live.
11Children
STEVE isn't intended for anyone under 16, and we don't knowingly collect information from children. If you think a child has created an account, contact us and we'll delete it.
12Changes
We'll update this page when our practices change and revise the date at the top. If a change materially affects how we use your information, we'll let you know in STEVE before it takes effect.
13Contact
The people who run the STEVE project at stevecad.studio are responsible for your information (the "controller" under the GDPR).
Questions or requests about your privacy: message @10_X_eng on X (https://x.com/10_X_eng).