Privacy notice
What KresCAD uses, what stays on your device, and how to contact us. Updated 23 September 2026.
KresCAD
For privacy questions, access or correction requests, or a complaint about KresCAD, contact hello@krescad.com.
Your plans and projects
The current drawing workspace processes your PDF and editable project in your browser. Browser recovery storage may contain the original PDF, markups, project name and saved time. We do not receive those recovery copies through normal drawing or recovery use. We cannot restore a local file that your browser has removed.
You control project downloads and exports. Keep independent copies. Use the previous-work panel to review or discard recovery copies. Clearing this site's browser data removes local drafts and preferences and can sign you out; save important work first.
Website visits, analytics and access checks
Our hosting and security provider, Cloudflare, processes request information such as your IP address, browser information, requested URL and request time to deliver and protect the service. Private-preview access may also use Cloudflare Access authentication information and security cookies.
We use Cloudflare Web Analytics (Real User Measurements) to understand aggregate visits and page performance. This analytics service does not use cookies or local storage and is not used for advertising profiles. Under our current setting, its script is not injected for visitors in the EU.
If you choose Allow analytics, Google Analytics also measures page visits and a small set of product events: app opened, PDF opened, first markup or measurement created, and export requested. We do not send drawing contents or file names to Google Analytics. Google advertising signals are disabled. Google Analytics is not loaded if you choose No thanks. We do not use advertising pixels or embedded third-party media. Emailing us does not automatically subscribe you to marketing.
Your terms acceptance
KresCAD stores the accepted terms version and date in your browser. KresCAD use requires no licence key or account, and this preference is not sent to a central account database.
Licence checks for separate private or paid access
When licence access is used, our server sends the licence key and device instance details to Lemon Squeezy to activate or validate access. The response can include licence status, product details and customer email. A secure, encrypted browser cookie maintains the session. Device and instance identifiers are also stored in your browser so the same device can be recognised. Licence checks do not send your drawings.
Lemon Squeezy handles its checkout and payment processing when a purchase is offered. We do not ask you to email card details. Any new public-account or payment flow will be described before it is introduced.
Support and information you choose to send
If you email us, we receive your address, message and any attachments. We use these to answer your request and diagnose the reported problem. Remove confidential or unnecessary personal information before sending a plan or screenshot. We do not need entire project sets for most reports.
Purposes and providers
We use information to supply requested access, keep the service secure, respond to support requests, administer any purchases, and meet applicable legal obligations. Where European or UK data protection law applies, the relevant basis may be performing a contract or requested pre-contract steps, our legitimate interests in secure operation and support, or a legal obligation. Optional marketing or non-essential tracking requires a separate choice where required; Google Analytics is loaded only after you choose to allow it.
Cloudflare, Lemon Squeezy and the email service delivering correspondence may process information outside Australia. Information may also be shared where required by law or reasonably necessary to investigate misuse. We do not sell your drawings or contact details. We will update this notice before introducing materially different processing.
Retention and security
Local recovery copies remain until you save and the app removes the corresponding clean recovery copy, explicitly discard them, or the browser removes its storage. Preferences and device identifiers remain until cleared. The application session cookie lasts up to 90 days, subject to validation and earlier expiry or revocation.
We keep support and account information only as long as reasonably necessary for the request, service administration, dispute handling and applicable legal obligations. Hosting and security records follow the configured provider retention periods. We use access controls and encrypted connections, but cannot guarantee absolute security. Do not place secrets in URL parameters or send licence keys with bug reports.
Your choices and rights
You can ask about personal information we hold, request access or correction, ask for deletion where appropriate, or raise a privacy complaint. We may need proportionate information to verify your identity. We will explain any lawful reason for retaining information. Where applicable, you may also have rights to object, restrict processing, obtain portable data or withdraw consent without affecting earlier lawful processing.
Contact us first if you wish, but you may also complain to the relevant privacy regulator, including the Australian Information Commissioner where applicable, or your local data protection authority. You can manage browser storage using the cookies and local-storage notice.
Information for people in the EEA
If EU or EEA data protection law applies, we use necessary account and support information to provide the service you request, security information for our legitimate interest in protecting the service, and records required by law for our legal obligations. Optional Google Analytics is activated only after your separate choice to allow it. Any future optional tracking will likewise require a separate choice before activation. We do not use automated decisions that produce legal or similarly significant effects.
You may contact hello@krescad.com to exercise applicable rights. Where the GDPR applies, we normally respond within one month; if a permitted extension is needed, we explain it within that first month. You can complain to your local data protection authority without contacting us first.