Privacy Policy
What Hooray3D collects when you turn a photo into a 3D model, who processes it, where, and how long it is kept.
Last updated: 2026-10-09
This policy explains what Hooray3D collects when you use hooray3d.com, why, who else processes it, and how long it is kept.
Who is responsible for your data: Hooray3D ("we"). For privacy questions or requests, email support@hooray3d.com.
The short version
- Your photos are deleted after 7 days. We never use your photos or models to train AI models.
- To make a model, your photo is sent to fal.ai, which runs the 3D model on its servers. For a figurine, fal.ai first draws a figurine design from your photo. Every upload and every design is checked by SeeAPI for prohibited content.
- Converting a model to STL or OBJ happens in your browser. That step sends nothing to us.
- The relief maker on our image, PNG and JPG to STL pages also runs in your browser. The picture you give it is never uploaded.
- The print tools (STL viewer, 3MF to STL, GLB to STL, STL repair, STL editor and lithophane maker) run in your browser too. The files and photos you open in them are never uploaded.
- Payments are handled by Waffo Pancake, our merchant of record (or Creem). We never see or store your card details.
- We use Google Analytics to count visits and see which pages and features people use. It sets cookies. In the EU, the EEA, the UK and Switzerland it only runs if you accept them.
What we collect
| Data | When | Why |
|---|---|---|
| Photos you upload | When you choose a photo | To make your 3D model and check it is allowed |
| Text you enter, and a short description of your photo (for example "golden retriever") | When you generate | To guide the model and check it is allowed |
| The 3D models we make for you | After each generation | To show them to you and let you download them |
| Figurine designs drawn from your photo | When you make a figurine | To make your figurine and check it is allowed |
| That you have permission to use the photo, and when you said so | When you tick the box for a figurine | To keep a record of your permission (see the Content Rules) |
| Email address, name and profile picture | When you sign up, by email or with Google | To run your account |
| Orders, credits and subscription status | When you buy | To give you what you paid for |
| IP address, browser type, and a one-way hash of your IP address | When you use the site | Security, sign-in sessions, and limiting free previews to 2 a day |
| Moderation results (allowed or blocked, and why) | For each check | To enforce the Content Rules |
| How you use the site: pages you visit, actions such as "model made" or "download", browser and device type, approximate location | When you use the site; in the EU, the EEA, the UK and Switzerland, only if you accept analytics cookies | To see which pages and features help people, with Google Analytics |
You can use the free preview without an account. We then create an anonymous guest session in your browser. If you sign up later, your guest models move to your account.
We do not collect your payment card number. We do not sell your data or share it for advertising.
Who processes your data, and where
| Service | What it receives | Where it processes |
|---|---|---|
| fal.ai (Features & Labels, Inc.) | Your photos, any text you enter, and the models it makes. It runs Rodin Gen-2.5 (by Deemos), SAM 3D (by Meta), TRELLIS and TRELLIS 2 (by Microsoft), Moondream (photo descriptions) and FLUX.1 Kontext [pro] (by Black Forest Labs, for figurine designs), and stores photos, designs and results on its file servers | On its servers, in the United States |
| SeeAPI | Your photos, figurine designs, the text you enter, and a small picture of each result | On its servers, in Singapore |
| Cloudflare | Every request to the site; it hosts the site and our database, runs the Turnstile bot check, and stores copies of the models you make with credits (Cloudflare R2) | Its global network |
| Waffo Pancake (Waffo.com Limited) and Creem, our merchants of record | Your payment details, email and billing country, entered on their checkout pages. They are the merchant of record for your purchase | Their servers |
| Only if you choose "Sign in with Google" | Google's servers | |
| Resend | Your email address, when we send you account emails | Its servers |
| Google Analytics (Google). How Google uses this data | The pages you visit and actions such as "model made", "download" or "sign-up", your browser and device type and approximate location, linked to a random ID in its cookies. When you sign up or buy, our server also tells it, using that same ID; for a purchase, the order number, product and amount. Never your name, email address or photos. Google Analytics does not store IP addresses | Google's servers, including in the United States |
Where each part of Hooray3D runs:
- 3D generator: on servers. Your photo is uploaded to fal.ai.
- Print-ready STL and OBJ export: in your browser, on your device. When you download a model, our server sends the model file to your browser, and the conversion, scaling and base all happen there.
- Relief maker (reliefs, outlines and cookie cutters): in your browser, on your device. The picture is read and turned into an STL there and is never sent to us or to anyone else.
- STL viewer: in your browser, on your device. The file is read and shown there.
- 3MF to STL: in your browser, on your device. The 3MF is read and the STL or zip file is made there.
- GLB to STL: in your browser, on your device. The GLB is read, sized and turned into an STL there.
- STL repair: in your browser, on your device. The file is checked and repaired there.
- STL editor: in your browser, on your device. The file is resized, turned, cut and given a base there.
- Lithophane maker: in your browser, on your device. The photo is read and turned into an STL there and is never sent to us or to anyone else.
- The sample files on these pages are ordinary files on our site: opening one downloads it to your browser, like an image.
How long we keep it
| Data | Kept for |
|---|---|
| Photos you upload | 7 days, then deleted from fal.ai's servers, and our record of the upload is deleted |
| Figurine designs | 7 days, then deleted from fal.ai's servers |
| Free preview models | 7 days |
| Models made with credits, while you have a plan | While your plan is active, and 30 days after it ends. We email you at least 7 days before we delete one |
| Models made with credits, without a plan | 12 months after they are made, or 30 days after a later plan ends if that is later. We email you at least 7 days before we delete one |
| Guest sessions (no account) | Models are deleted after 7 days; the guest session itself after 30 days |
| Account, orders and credits | While your account exists, and as long as tax and accounting law requires for orders |
| Moderation results (no images) | While your account exists |
| Google Analytics data linked to its random ID | Up to 14 months, then deleted by Google. Its totals (for example visits per page) identify no one and are kept longer |
International transfers: our providers process data outside your country, including in the United States (fal.ai and Google Analytics) and Singapore (SeeAPI). We only share what each provider needs to do its job.
Cookies
Cookies the site needs to work:
- the sign-in session cookie (also used for guest sessions);
- a language preference cookie;
- cookies Cloudflare sets for security and the Turnstile check.
Analytics cookies: Google Analytics sets _ga and _ga_ followed by an ID, each kept for up to 2 years, to recognise a returning browser with a random ID. In the EU, the EEA, the UK and Switzerland, Google Analytics only loads after you choose "Accept analytics". If you choose "Only necessary", it doesn't load, and our server sends it nothing about you. There you can change your choice at any time with Cookie settings, here or at the bottom of every page; choosing "Only necessary" then removes these cookies. Elsewhere, you can block Google Analytics with your browser's settings or Google's opt-out add-on.
We do not use advertising cookies.
Your rights
You can ask us to show, correct, export or delete your data. To delete your account and everything linked to it, email support@hooray3d.com from the address you signed up with. We will do it within 30 days. Data held only by payment providers (for example, tax records of a purchase) is kept by them as the law requires.
If you are in the EU or UK, you can also complain to your data protection authority.
Security
Data travels encrypted (HTTPS). Access to our systems is limited to what is needed to run the service. If a data breach affects your personal data, we will tell you, and the relevant authority, as the law requires (within 72 hours where the GDPR applies).
We do not sell your personal information. We only send account emails (for example password resets), not marketing. Receipts come from our merchant of record.
Children
Hooray3D is for people aged 18 or over. Do not upload photos of children, or of anyone who has not agreed. See the Content Rules.
Changes
If we change this policy, we will update the date at the top. If a change materially affects how your data is used, we will also tell account holders by email.