Privacy Policy

Last updated: October 2026

1. Information We Collect

When you create an account, we collect your email address and hashed password. If you sign in via GitHub or Google OAuth, we receive your public profile information (name, email, avatar) from those services.

We collect basic usage data such as message counts and model usage to enforce plan limits and improve the service.

2. API Keys (BYOK)

When you provide your own API keys (Bring Your Own Key), they are stored locally on your machine using OS-level encryption (DPAPI on Windows, Keychain on macOS). Your API keys are never transmitted to or stored on our servers.

3. AI Conversations

Your conversation messages are sent to AI providers (Google Gemini, Anthropic, OpenAI, etc.) to generate responses. When using our provided models, messages pass through our cloud server for rate limiting and plan enforcement. We store conversation metadata (titles, timestamps) to enable conversation history.

4. Local MCP Server

The Cosindra desktop application runs a local MCP server on your machine. All tool executions (spawning actors, modifying blueprints, etc.) happen locally within your Unreal Engine editor. No project files or source code are transmitted to our servers.

5. Files You Upload

RigMaster. When you upload a 3D model to RigMaster, it is sent to our servers to build the rig. We keep the uploaded model for up to 24 hours so we can run the rig and investigate rigs that fail, then it is deleted automatically. The rigged files we produce stay available to you for 7 days, then they are deleted automatically. For each rig we also keep a technical record — your settings, the marker positions and the quality measurements, never the model itself — to support you and improve RigMaster; it is deleted with your account.

AssetSmith. Reference images you upload, and the descriptions you type to create one, are sent to our AI provider (fal.ai) to generate your model. We delete those images from our storage 24 hours after they are uploaded or created. A model you paid for is kept in your account until you delete it or close your account. A result that is not saved, such as a character brought in from RigMaster or a model your storage could not keep, is deleted 24 hours after it was made.

MotionSmith. Characters you upload or bring in from RigMaster are kept in your account until you delete them or close your account. They are processed on our own servers and are not sent to AI providers. The motion prompts you type are sent to our GPU provider (RunPod), where our motion model runs. The motions it makes are kept for 24 hours unless you save them; saved motions stay in your account until you close it.

6. Data Retention

To delete your account, email [email protected] from the address registered to it. We then turn on account deletion for you under Account → Security, where you confirm it with a code we email to that address. The account closes straight away: you are signed out on every device and any subscription is cancelled, so you are not charged again. We keep the account's data for 30 days in case you change your mind — email us within that time and we can restore it — and then delete it permanently: your profile, your conversations, and everything you created, uploaded or shared. We keep only what the law requires us to keep: payment and subscription records for as long as tax and accounting rules require, and the consent records described in section 9.

You can ask [email protected] for a copy of the data we hold about you at any time; we send it as a set of files. Conversation history is also deleted when you delete a conversation.

7. Third-Party Services

We use the following third-party services:

  • Anthropic, Google (Gemini), OpenAI, Moonshot (Kimi, directly or through OpenRouter), DeepSeek, and Mistral — your messages and generation prompts, sent only to the provider of the model you choose
  • Google (Gemini) — in MaterialForge, the image you turn into a material (From image) and the flat rendered views of a model you choose to repaint, with your description; the model file itself is not sent
  • fal.ai — AssetSmith reference images and descriptions, and MaterialForge texture prompts
  • RunPod — the GPU servers our own models run on: your MotionSmith prompts, and AssetSmith reference images when a model is generated there
  • Lemon Squeezy — payments and subscriptions; we never see your card number
  • Resend — the emails we send you
  • Cloudflare — delivers this website and stores your files (R2)
  • Hetzner — hosts our servers in Germany
  • GitHub, Google — sign-in, if you choose them
  • Google (Google Analytics) — only if you accept analytics cookies: the pages you open and a few product events, as described in section 9
  • PostHog (EU region) — only if you accept analytics: how you use the site (clicks, scrolling, page changes and session recordings), with form fields and the text you type masked, as described in section 9

If you use your own API key, your requests go to that provider under your own account; this includes Groq, Cerebras, and Together AI.

Each of these services has their own privacy policy that governs their use of your data.

8. Security

We use industry-standard security measures including JWT authentication, rate limiting, and encrypted connections. API keys are stored using OS-level encryption. Passwords are hashed with bcrypt.

9. Cookies & Analytics

We use Google Analytics and PostHog only with your consent, as described below. We do not use Microsoft Clarity, Facebook Pixel, or any advertising or cross-site tracking service, and no third party tracks you across other websites through this one. Authentication tokens are stored in your browser's localStorage, which is strictly necessary storage and does not require consent. The full list of what we store in your browser, with purposes and lifetimes, is the Cookie Policy; it is the same list our cookie banner shows.

With your consent — given in the cookie banner and changeable at any time from Cookie settings in the footer — we run a small, first-party analytics system on our own servers. For each page you visit we then record: the page path, the referring URL and any UTM campaign parameters, your browser user agent, your country, your IP address, and an anonymous session identifier stored in a first-party cookie (cosindra_session_id, 13-month lifetime, used to count unique visitors and to link the interaction events described below into one visit — never for advertising, and never shared with third parties). Your country is read from the header our network provider (Cloudflare) attaches to each request; only when that is missing do we look it up ourselves.

With that same consent we record a small set of first-party product interaction events (for example: signing up, starting a generation and whether it succeeded, clicking "Apply in UE5" or a download button, using a template, creating a share) together with the session identifier, your account ID when you are signed in, and a salted hash of your IP — so we can see where the product loses people and fix it. Page-view and interaction-event records are automatically deleted after 90 days. Within that window we retain your raw IP address (until the record is deleted) so we can investigate abuse and respond to data subject access requests; on request we will only disclose a one-way SHA-256 hash of your IP, never the raw value.

Google Analytics. With that same consent we also use Google Analytics, a service of Google, to measure how the site is used. It receives the address of each page you open (without its query string, except campaign tags such as utm_source), the previous page or the site that linked to you, and some of the product events above (for example: starting a sign-up, starting a generation and whether it succeeded, clicking a download or pricing button) with short labels only — never your email, your prompts, your file names or your account ID. Your browser also sends Google the technical details that come with any request, such as your IP address and browser type; Google Analytics 4 does not store IP addresses and uses them only to estimate your country and city. Google Analytics sets two cookies, _ga and _ga_*, for 13 months (see the Cookie Policy). Advertising features, ad personalisation, Google signals and data sharing with Google are switched off. Google keeps the event data for 2 months, the shortest retention Google Analytics offers. When you withdraw consent, Google Analytics stops and both cookies are deleted. Google's use of this data is governed by its own privacy policy.

PostHog. With that same consent we also use PostHog, a product analytics service, as our processor; our PostHog project and its data are hosted in PostHog's EU region. We record how visitors use the site so we can see where it is confusing and improve it: the pages you open and how long you stay, your clicks (including repeated clicks on something that does not respond), how far you scroll, page changes, and session recordings, which replay the page as you saw it together with your mouse movements and clicks. Form fields and the text you type are masked in your browser before anything is sent, and so is your email address. Page addresses are sent without their query string, except campaign tags such as utm_source, and sign-in pages are not recorded at all. PostHog also receives a few of the product events above (for example: starting a sign-up, starting a generation and whether it succeeded, clicking a download or pricing button), with short labels only. We do not tell PostHog who you are: it receives the anonymous session identifier described above, never your name, email address or account ID, and it builds no profile of you. PostHog sets no cookies; it keeps a random visit id and the recording state in your browser's local and session storage (see the Cookie Policy). Your browser also sends PostHog the technical details that come with any request, such as your IP address and browser type; PostHog is set to discard IP addresses. When you withdraw consent, recording stops at once, PostHog stops receiving anything and what it kept in your browser is deleted.

Without your consent we count only that a page was opened: the page, the day, the country and the referring site. That count carries no cookie, no IP address, no browser details and no identifier. We keep a record of each decision you make in the banner (the random consent id, the time, the choice, the policy version, your country and browser type — no IP address) for 3 years, as proof that the choice was made. We honour the browser Do Not Track and Global Privacy Control signals — when either is enabled we record nothing at all, whatever the banner says.

The desktop app, the IDE extension and the local MCP server send us a small amount of usage telemetry when you are signed in (for example: app started, editor connected, tool-call counts, setup completed) so we can see where the product breaks. The IDE extension follows your editor's telemetry setting. These records carry your account ID and a salted hash of your IP, never the raw address.

10. Contact

For privacy-related questions, contact us at [email protected].