How SchemSmith handles personal data, under the General Data Protection Regulation (GDPR).
The controller responsible for the processing described here is the provider named in the Impressum: Michael Manke, Kurze Lemppen 7, 89075 Ulm, Germany. You can reach us by email at [email protected] for any question about your data or to exercise the rights listed in section 5.
SchemSmith carries no advertising and no tracking cookies. We count page visits and the referring site on our own server, without cookies and without storing your IP address (section 3a). We do not profile you and we do not share your data with advertisers. The only cookie the site sets is the sign-in session cookie, which is strictly necessary to keep you logged in. Because we set no cookies that require consent, there is no cookie banner.
When you open the site, our hosting provider writes standard server logs containing your IP address, the requested URL, the time of the request and your browser's user agent. This is necessary to deliver the pages and to detect attacks and abuse, so the legal basis is our legitimate interest in a secure and functioning service under Art. 6(1)(f) GDPR. The logs are kept by the hosting provider for a short period and then deleted.
We also count page visits on our own server. For each visit to the landing page, the app or a build listing we
record the page, the time, the referring site and any campaign tag in the link (such as ?ref= or
utm_source). We set no cookie for this, store nothing in your browser, do not store your IP
address and drop visits from known bots. No third-party analytics service is involved. This tells us which
channels bring visitors so we can improve the site and our marketing, which is our legitimate interest under
Art. 6(1)(f) GDPR. You can object to it at any time by emailing us.
If you have an account, we also note with it when you sign in, buy credits or a build, start or finish a build and export one. This shows us how many visitors go on to use the service, again on the basis of our legitimate interest under Art. 6(1)(f) GDPR. When you delete your account, these entries are unlinked from it and remain only as anonymous counts.
If the link that brought you to the site carried a ?ref= or utm_source tag, the pages
you open from there keep that tag in their address, and the sign-in form sends it along when you request a
sign-in link. If that creates a new account, we store the tag with the account as where it came from; it is set
once and never changed, and nothing is stored in your browser for this. This shows us which channels and
partners (such as a creator whose link you followed) bring new accounts, which is our legitimate interest under
Art. 6(1)(f) GDPR. The tag is part of your data export and is deleted with your account.
To enforce per-address rate limits on script runs and on sign-in emails, we hold your IP address in the server's memory for at most 24 hours and count the requests made from it. This protects the service against automated abuse and cost attacks, and rests on our legitimate interest under Art. 6(1)(f) GDPR. The counters are discarded when the day rolls over or when the server restarts.
If you create an account we store your email address, the time you signed up, the time you last signed in and,
if the link you arrived through carried one, its campaign tag (section 3a).
Sign-in works with a link we email you: the link contains a single-use token that is valid for 15 minutes and
is stored only in hashed form. Once you have signed in, your browser holds the session cookie
ss_session, which is strictly necessary for the service and lasts 90 days. All of this is
necessary to perform the contract with you under Art. 6(1)(b) GDPR. We keep this data until you delete your
account, which you can do at any time in the app (Credits → Delete account) or by emailing us.
When you generate a build, your prompt, the screenshots of the rendered build and the build script are sent to Anthropic, PBC, San Francisco, USA, which runs the AI model that produces the build. This is necessary to provide the service you asked for, under Art. 6(1)(b) GDPR. The transfer to the USA is covered by the EU-US Data Privacy Framework and by standard contractual clauses. Under Anthropic's commercial terms, your inputs and outputs are not used to train models; Anthropic may retain them for a limited period for trust and safety purposes. See https://www.anthropic.com/privacy.
We store every build with your account on our server: your prompts, the model's replies, the build scripts and the screenshots taken during the build. This lets you reopen a build later, continue it and export it, and is necessary to perform the contract with you under Art. 6(1)(b) GDPR. Builds are kept until you delete your account, which removes them together with it.
If you rate a build in the app (thumbs up or down, and after a thumbs down an optional line on what was off), we store the rating with that build to learn whether builds turn out well and to improve them. The legal basis is our legitimate interest in improving the service, Art. 6(1)(f) GDPR. Rating is voluntary and you can change it at any time; it is kept with the build and deleted together with it when you delete your account.
We also record metering data for each generation — the tokens used, the resulting cost, the model and the time — and store it with your account so that credits can be deducted correctly. The legal basis is Art. 6(1)(b) GDPR, and we keep this record for 12 months for accounting purposes.
Credit packs are sold by a third-party payment provider acting as merchant of record, which is named at checkout. It processes your payment details, billing address and invoices as its own controller under its own privacy policy, which is shown at checkout; we never see your card details. From the payment provider we receive the order id, your email address, the product purchased, the amount and the payment status. We process this to perform the contract with you under Art. 6(1)(b) GDPR and to meet our legal obligations under Art. 6(1)(c) GDPR, and we keep it for 10 years as German tax law requires.
If you publish a build to the community, we store the build script, three screenshots of it, the title and prompt you enter, the schematic files we generate from the script, and the display name you choose. The display name, title, prompt, screenshots, block count and dimensions are shown publicly on the community pages and can be seen by anyone; your email address is never shown. When someone buys a build we record who bought which build, when, and for how many credits, and the credits booked to the author. All of this is necessary to provide the community feature you chose to use, under Art. 6(1)(b) GDPR. A listing stays until you ask us to remove it or delete your account; the purchase records are kept for 10 years as German tax law requires.
Sign-in emails are sent through Resend, Inc. (USA), which processes your email address in order to deliver the message. Their privacy policy is at https://resend.com/legal/privacy-policy. The legal basis is Art. 6(1)(b) GDPR, as the email is how you sign in.
The application is hosted by Railway Corporation (USA), and Cloudflare, Inc. (USA) provides DNS and the reverse proxy in front of it, which means requests to the site pass through their infrastructure. The legal basis is our legitimate interest in a reliable, protected service under Art. 6(1)(f) GDPR. Data processing agreements are in place with each provider, and transfers to the USA rely on the EU-US Data Privacy Framework and/or standard contractual clauses.
Your editor settings and your saved builds are kept in your browser's local storage. When you ask for a sign-in link, the prompt you were typing and the script in the editor are kept there too, so that they are back in place when the link returns you to the app; the app deletes them then, or the next time it finds them more than an hour old. They stay on your device, are never uploaded to us, and you can remove them at any time by clearing the site data in your browser.
Apart from the providers named above — Anthropic, the payment provider, Resend, Railway and Cloudflare — we do not pass your data to anyone, except where we are legally required to. We do not sell personal data, and we do not use it for advertising.
You have the right to obtain access to the data we hold about you, to have inaccurate data corrected, to have your data erased, to have processing restricted, to receive your data in a portable form, and to object to processing that is based on our legitimate interests (Art. 15 to 21 GDPR). Where processing rests on your consent, you can withdraw that consent at any time with effect for the future. In the app, the credits dialog lets you download a copy of your data as a file and delete your account, which removes your builds and listings; purchase and metering records stay for the periods named in section 3. For anything else, email us at the address in section 1.
You also have the right to lodge a complaint with a data protection supervisory authority. In Germany this is the Landesbeauftragte for data protection of the federal state in which the controller is established: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Stuttgart.
We do not use your data for automated decision-making or profiling that produces legal effects for you. The AI model generates builds; it makes no decisions about you.
SchemSmith is intended for people aged 18 and older. We do not knowingly process the personal data of minors. If you believe a minor has created an account, please contact us and we will delete it.
We may update this policy when the service or the providers behind it change. The current version is always the one published here, and the date below tells you when it was last revised.