Privacy

Who we are

CarCad Cloud is the website at https://carcad.com.au. CarCad Desktop is the desktop app that signs in here. CarCad is operated by Lowcodemasters Pty Ltd (ABN 59 665 255 925). This page is the privacy policy for both.

Questions about this policy: support@carcad.com.au.

Account and sign-in

When you create an account we store your email, name and a password hash. We never store the password itself. Email changes need the current password and a new verification email. Optional contact details (phone and address) are stored encrypted.

We keep a per-day record of when you were first and last seen while signed in.

If you use the in-app assistant we store how many requests you made that UTC day.

You can turn on two-factor authentication. We then store an encrypted authenticator secret and recovery codes.

Google sign-in uses Laravel Socialite. We request Google’s default openid, profile and email scopes, keep Google’s subject id, and use the verified email and name Google returns. We do not offer GitHub sign-in.

CarCad Desktop signs in with Passport (authorization code and PKCE). We store access and refresh tokens, bind them to an install when you register one, and you can revoke them from Settings. Personal access tokens you create in the browser are stored the same way.

Apps and installs

When you sign in to CarCad Desktop we keep a record of that install: a random install ID made by the app, the platform (macOS, Windows ARM64, Windows x64 or Linux x64), the app and operating-system version, a device name you can change, and when it was first and last seen. The app checks in when it starts and about once a day to update these. We do not collect hardware identifiers, serial numbers or usage analytics, and we do not store your IP address with the install (IP addresses appear only in security logs and live sessions). You can see, rename and remove your installs in Settings ▸ Installs. Removing one signs it out. Installs not seen for 12 months are deleted automatically. If an account is deleted, its install records go with it. Contact us at support@carcad.com.au if you want an install record removed.

CarCad Desktop

This section covers the desktop app. CarCad Cloud is described in the other sections.

Avatar and profile

Your profile can include a username, display name, bio, country, preferred currency and a photo. You choose whether the profile is public.

Photos are stored on the private Cloud disk, served only through a short-lived signed /avatars link, never a public bucket URL; a public profile can show it through that route.

Marketplace and purchases

Paid drawings check out through Stripe Checkout (card payments). Stripe collects the card. We never see or store card numbers. Each order keeps the amount, currency, title, licence terms, file hash and Stripe payment intent. We also keep the Stripe session id and whether the order is paid, refunded or disputed.

Sellers complete Stripe Connect onboarding. Bank details stay with Stripe. We store the connected account id. Onboarding status is read from Stripe when you open your payment settings.

Paid downloads are stored with the buyer, seller, design and order.

If you report a listing we store the reporter, a reason and the free-text details you typed.

If a listing is taken down or the restriction is lifted we store an in-app notification for the seller with the model title and reason.

Saving a listing in the desktop marketplace embed stores that listing id on your account.

Getting a free listing in the desktop marketplace stores that listing and release id on your account.

Published listings (name, description, vehicle, price and licence terms) are public. Your display name is public only if you turn on a public profile.

Uploaded models and files

STEP and STL uploads (up to 10 MB on the website) go on the private storage disk with a random server path. The public disk is refused for CAD files. Website downloads are sent only after we check that you own the file or bought it. CarCad Desktop downloads use short-lived signed links. Trashed drawings stay recoverable and still count toward quota until you delete them for good.

Cookies

The site sets:

• Session — carcad-cloud-session (from the app name). HttpOnly, SameSite=Lax, Secure on staging and production. Holds your signed-in session.
• CSRF — Laravel’s XSRF-TOKEN cookie, plus a CSRF token in page forms and the csrf-token meta tag.
• Theme — carcad-theme with values light, dark or auto. Path=/, Max-Age=31536000, SameSite=Lax, Secure on HTTPS. Not HttpOnly (the page reads it before first paint). Also stored in localStorage.
• Remember me — Laravel’s remember-me cookie if you tick Remember me on log in.
• Passport — laravel_token after a browser sign-in, used for first-party API calls from the page.
• Marketplace embed — __Host-carcad_embed when you start an embedded store session. Secure, HttpOnly, SameSite=None, Partitioned.

Security

All traffic uses HTTPS. Passwords are hashed. Two-factor secrets and contact details are encrypted. CAD files and profile photos are kept on a private storage disk.

Security logs and IP addresses

Security audit events store the request IP and a shortened user-agent, plus the action name. They do not store passwords, tokens or recovery codes. Diagnostic events from the desktop (level, event name, app version, platform, and optionally an error code and duration) are stored without a free-text message or stack trace, and are deleted after 30 days. Audit events are not pruned automatically. Database sessions also record IP and user-agent while the session is live.

Processors

These services handle data for us when they are enabled:

• Laravel Cloud — hosts the app, the MySQL database and attached object storage.
• Cloudflare R2 — Laravel Cloud Object Storage for files and photos.
• Stripe — checkout, refunds, disputes and seller Connect accounts.
• Google — sign-in (email, name, subject id).
• Mailgun — verification, password-reset and other mail when the Mailgun integration is enabled.
• OpenAI — the in-app assistant, when an administrator has enabled it. Your question and the matching public listing text are sent to OpenAI. Account passwords and payment details are not.
• Have I Been Pwned — password-compromise checking is on (the default outside tests). Only a partial SHA-1 hash of the password is sent, using k-anonymity. The password itself is not sent.

Retention, export and deletion

Contact us at support@carcad.com.au if you want a copy of your information or if you want your account deleted. We will respond within 30 days. If an account is deleted, that user’s app installs are removed with it.

Installs unused for 12 months are deleted. Expired Passport tokens are purged daily. Diagnostic events older than 30 days are deleted. Payment ledger rows are append-only and are not deleted by the app. Trashed CAD files stay until you delete them for good.

Children

We do not ask for age and we do not have a parental-consent flow. The site is built for people who can create an email account and complete checkout. We do not knowingly store a child’s profile as such.

Changes to this policy

When this page changes we update the “Last updated” date at the top. The live text is always https://carcad.com.au/privacy.