Figurekeep See pricing

Privacy policy

Your images never leave your device. This page explains the little we do collect, and why.

Version 4, effective October 30, 2026. Figurekeep is run by Figurekeep LLC, a South Carolina limited liability company ("we", "us"). Contact: support@figurekeep.com.

The short version

What happens to your images

When you open an image in Figurekeep, it is read by your own browser. The AI models that select your figure run on your device. They find the figure in your picture; they never make or change images. Cutouts, PDFs, PNGs and cutting-machine kits are made on your device and saved straight to it. No image, image data or file name is sent to us or to anyone else, on any plan.

If you save a project, it is stored in your browser's own storage (IndexedDB) on that device, with the original images it uses. The project you're working on is kept there too, as you work, so it is still there after a refresh or a closed tab. It is never sent to us. Clearing your browser data deletes it.

What we collect, and why

When you visit the site or use the app

Our hosting provider, Cloudflare, processes the technical details every website receives: your IP address, browser type, the page requested and the time. It is used to deliver the site and keep it secure (for example, to block attacks), and is kept for a limited time under Cloudflare's own policies. We do not use it to identify you.

We use Cloudflare Web Analytics, which counts visits, pages and where visitors came from, without cookies and without identifying anyone.

The first time you select a figure, your browser downloads the AI model files and the program that runs them from our own file server (Cloudflare R2, served at figurekeep.com). Your browser keeps a copy, so later visits don't download them again. The server sees a normal web request (IP address, browser), never anything about your images.

When you download a file

After you download a file, the app sends our server one word for the kind of file (a print sheet, cut files, a token, a character sheet, a character file, a project backup or something else) and nothing else. Like every web request, it reaches our server with the technical details every request carries (see above), such as your IP address and browser type: we use the IP address only briefly, in memory, to limit how often one address can send it, and we don't keep it. We don't record your browser or device, the file's name or contents, or whether you have Pro. Our server adds the word to that day's total for that kind, and the daily totals are all we keep (Cloudflare's own server logs apply, as for any page; see above). We can't tell who downloaded anything, or count people. If your browser sends Global Privacy Control, the app doesn't send the word at all.

When you make a Sigil link (when the app opens)

A Sigil link puts the text of a character sheet on our server so you can share it. To stop the service being flooded, we limit how many new sheets can be made each day. For that limit our server keeps a scrambled form of the day and your IP address (not the address itself) for 2 days, then deletes it.

When you buy Pro

Our payment partner is the merchant of record for all purchases. It collects your payment details, billing address and email address, charges any sales tax and sends your receipt and licence key. Its own privacy policy applies to that information. We receive your name, email address, what you bought, and your licence key status. We never see your full card number.

When you activate Pro

To unlock Pro, the app sends your licence key and a device label (such as "Chrome on Windows") to our licence server. The server checks the key with our payment partner and returns a signed pass that your browser keeps. When you activate a device, the server also gives our payment partner that device's label, as the name of the activation. The server also uses your IP address to limit how many tries can be made; it isn't stored in the device list. While the app is open and you're online, it checks your licence about every 2 hours, and also when you open Manage licence.

We keep a list of the devices your key is on, in Cloudflare's key-value storage (Workers KV). For each device it holds:

The list is filed under a scrambled form of your key (a keyed hash, not the key itself) and holds no IP address, name or email address. We use it so you can see and turn off your devices, so keys can't be shared widely, so a browser that cleared its data can get its place back, and so a device unused for a long time can give its place back.

A device leaves the list when you turn it off, in Manage licence or in Activate Pro when your key is already on all its devices (also when our payment partner tells us it was already off), or when the list grows past 20 devices: devices whose place was given back go first, then the ones unseen longest.

If we haven't recorded a check-in from a device for 8 hours (we record check-ins to within 3 hours, so its last one may be as little as 5 hours ago), a browser with your key and the same label (for example, the same browser after it cleared its data) can take over its place, and Pro stops on the browser that had it at its next check-in. For that device we then also keep, under the same scrambled key, a random code that browser made, so only that browser can use the place, and when the code was set or last renewed. It is renewed when that browser checks in and the code is at least 30 days old.

When you activate a device and your key is already on as many devices as it allows, a device whose last recorded check-in is more than 30 days old gives its place back (the longest unseen first): we turn Pro off on it with our payment partner, and it stays in the list, marked as given back. If saving the list fails, we note its scrambled key in Cloudflare's cache for up to 24 hours. Our payment partner keeps its own record of your key's activations.

When you contact us

We keep the emails you send us so we can answer them and help you later. You never need to send us an image. If you choose to share one (by email, or in #cutout-fails on our Discord), please only send art you have the right to share: no photos of real people, and no characters or art owned by companies. We use it only to look into the problem and to test Figurekeep. We keep test copies in private storage that only the people who run Figurekeep can open, until the fix ships or for 12 months, whichever comes first, and then delete them. We never share or redistribute it, and we never use it to train an AI model unless you explicitly tell us we may. Ask us any time and we'll delete our copies sooner. A post in #cutout-fails is visible to everyone in the server, and Discord's own privacy policy also covers it.

When you sign up for news

If you sign up on figurekeep.com to hear from us, we keep your email address, the page you signed up on, the version of the sign-up text you saw, and when you signed up and confirmed, in a Cloudflare database (D1), together with a simplified copy of your address and its domain, a random number used to check our links, and a record of the confirm emails we sent you (how many, when, and when the link expires). We don't keep your IP address or any details about your browser. The links in our emails carry codes that aren't stored anywhere; the random number lets us check each one. The confirm link works once; the unsubscribe link keeps working.

If you don't confirm, we delete your address 48 hours after the last confirm email we sent you. Until that email goes out, your sign-up waits in our queue, which can take several days on busy days. If we can't send it at all (for example, your email domain can't receive mail), we delete your address within 48 hours of signing up, or straight away if it had already waited longer. Unsubscribing deletes it too, and every email has an unsubscribe link. You can also ask us to delete it any time at support@figurekeep.com.

To honour an unsubscribe, to stop anyone using the form to flood someone's inbox, and to stop emailing addresses that bounce, we keep a one-way code made from your address: for 90 days after you unsubscribe, 30 days after an unconfirmed sign-up we emailed is deleted, 7 days after our email provider refuses the address, and 365 days after an email to it bounces or is marked as spam. We can't read your address from it, but we can tell if the same address is used again. To limit how many emails one domain can receive in a day, we also keep a daily count under a one-way code of the domain (never the domain itself), for that day and the two after it.

When we send you an email, we check that your address's domain (the part after the @, never the whole address) can receive mail, using Cloudflare's public DNS (the internet's address book).

Two short-lived records: if you ask us to delete your address, it is held only while that deletion runs; and to ignore repeated delivery notices from our email provider, we keep its message ids (never your address) for 24 hours.

We use your address only to email you about Figurekeep. We never sell it. Our email provider, Resend, a company based in the US, sees it only to deliver our emails, which come from hello@mail.figurekeep.com. Replies go to hello@figurekeep.com.

To keep bots out, the sign-up uses Cloudflare Turnstile. It loads only when you start to sign up, never just for reading a page. Cloudflare sees your IP address and browser details to run that check. We keep none of them.

What your browser stores

Figurekeep stores a few things in your browser's own storage: your Pro pass, licence key and this device's activation id (if you have Pro), and the random code from a takeover (if there was one), your settings, your saved projects and a copy of the AI model files. These stay on your device. We do not use cookies for tracking or advertising, so there is no cookie banner. Our payment partner's checkout may set its own cookies when you buy.

Who we share information with

We never sell or rent personal information, and we do not share it for advertising.

How long we keep it

Licence and order records: while your licence is active and for as long as tax and accounting law requires afterwards. Device list: it has no automatic expiry. A device stays listed until you turn it off or the list grows past 20 devices. Once your licence has ended, you can't turn devices off and no device can be added, so the list stays until you ask us to delete it. The random code kept for a place taken over expires 400 days after it was last renewed. Ask us and we delete the list sooner. Support emails: up to two years after the last message. You can ask us to delete your emails sooner, unless we need them for an open dispute. News sign-ups: your address stays until you unsubscribe or ask us to delete it; an unconfirmed sign-up is deleted 48 hours after the last confirm email we sent, and the one-way codes that honour an unsubscribe and stop abuse last 7 to 365 days (see When you sign up for news). Server logs: as set by Cloudflare, usually days, not months. Daily download totals: kept with no end date, as they hold nothing about anyone; older ones may be combined into monthly totals. Web Analytics: we see only totals, and Cloudflare keeps that data under its own policy. The Sigil limit's scrambled day-and-IP values: 2 days.

Your choices and rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing support@figurekeep.com. Depending on where you live (for example in the EU, the UK or certain US states), you may have further rights, including the right to complain to a data protection authority. We will answer within 30 days. Deleting your licence records ends Pro on your devices.

Children

Figurekeep is not directed at children under 13, and we do not knowingly collect personal information from them. Buying Pro requires being an adult or having a parent's permission.

Security

The app never sends us your images. If you choose to send us one, we keep it private, limit access to the people who run Figurekeep and delete it on request. For everything we hold, we use encrypted connections and keep secrets out of the app.

Changes

If we change this policy, we will update the date at the top and, for significant changes, say so on the site. The promise that your images never leave your device will not change.