How SchemSmith handles personal data, under the General Data Protection Regulation (GDPR).
The controller responsible for the processing described here is the provider named in the Impressum: Michael Manke, Kurze Lemppen 7, 89075 Ulm, Germany. You can reach us by email at [email protected] for any question about your data or to exercise the rights listed in section 5.
SchemSmith carries no advertising, no analytics and no tracking cookies. We do not profile you and we do not share your data with advertisers. The only cookie the site sets is the sign-in session cookie, which is strictly necessary to keep you logged in. Because we set no cookies that require consent, there is no cookie banner.
When you open the site, our hosting provider writes standard server logs containing your IP address, the requested URL, the time of the request and your browser's user agent. This is necessary to deliver the pages and to detect attacks and abuse, so the legal basis is our legitimate interest in a secure and functioning service under Art. 6(1)(f) GDPR. The logs are kept by the hosting provider for a short period and then deleted.
To enforce per-address rate limits on script runs and on sign-in emails, we hold your IP address in the server's memory for at most 24 hours and count the requests made from it. This protects the service against automated abuse and cost attacks, and rests on our legitimate interest under Art. 6(1)(f) GDPR. The counters are discarded when the day rolls over or when the server restarts.
If you create an account we store your email address, the time you signed up and the time you last signed in.
Sign-in works with a link we email you: the link contains a single-use token that is valid for 15 minutes and
is stored only in hashed form. Once you have signed in, your browser holds the session cookie
ss_session, which is strictly necessary for the service and lasts 90 days. All of this is
necessary to perform the contract with you under Art. 6(1)(b) GDPR. We keep this data until you delete your
account, which you can do at any time in the app (Credits → Delete account) or by emailing us.
When you generate a build, your prompt, the screenshots of the rendered build and the build script are sent to Anthropic, PBC, San Francisco, USA, which runs the AI model that produces the build. This is necessary to provide the service you asked for, under Art. 6(1)(b) GDPR. The transfer to the USA is covered by the EU-US Data Privacy Framework and by standard contractual clauses. Under Anthropic's commercial terms, your inputs and outputs are not used to train models; Anthropic may retain them for a limited period for trust and safety purposes. See https://www.anthropic.com/privacy.
We store every build with your account on our server: your prompts, the model's replies, the build scripts and the screenshots taken during the build. This lets you reopen a build later, continue it and export it, and is necessary to perform the contract with you under Art. 6(1)(b) GDPR. Builds are kept until you delete your account, which removes them together with it.
We also record metering data for each generation — the tokens used, the resulting cost, the model and the time — and store it with your account so that credits can be deducted correctly. The legal basis is Art. 6(1)(b) GDPR, and we keep this record for 12 months for accounting purposes.
Credit packs are sold by a third-party payment provider acting as merchant of record, which is named at checkout. It processes your payment details, billing address and invoices as its own controller under its own privacy policy, which is shown at checkout; we never see your card details. From the payment provider we receive the order id, your email address, the product purchased, the amount and the payment status. We process this to perform the contract with you under Art. 6(1)(b) GDPR and to meet our legal obligations under Art. 6(1)(c) GDPR, and we keep it for 10 years as German tax law requires.
If you publish a build to the community, we store the build script, three screenshots of it, the title and prompt you enter, the schematic files we generate from the script, and the display name you choose. The display name, title, prompt, screenshots, block count and dimensions are shown publicly on the community pages and can be seen by anyone; your email address is never shown. When someone buys a build we record who bought which build, when, and for how many credits, and the credits booked to the author. All of this is necessary to provide the community feature you chose to use, under Art. 6(1)(b) GDPR. A listing stays until you ask us to remove it or delete your account; the purchase records are kept for 10 years as German tax law requires.
Sign-in emails are sent through Resend, Inc. (USA), which processes your email address in order to deliver the message. Their privacy policy is at https://resend.com/legal/privacy-policy. The legal basis is Art. 6(1)(b) GDPR, as the email is how you sign in.
The application is hosted by Railway Corporation (USA), and Cloudflare, Inc. (USA) provides DNS and the reverse proxy in front of it, which means requests to the site pass through their infrastructure. The legal basis is our legitimate interest in a reliable, protected service under Art. 6(1)(f) GDPR. Data processing agreements are in place with each provider, and transfers to the USA rely on the EU-US Data Privacy Framework and/or standard contractual clauses.
Your editor settings and your saved builds are kept in your browser's local storage. They stay on your device, are never uploaded to us, and you can remove them at any time by clearing the site data in your browser.
Apart from the providers named above — Anthropic, the payment provider, Resend, Railway and Cloudflare — we do not pass your data to anyone, except where we are legally required to. We do not sell personal data, and we do not use it for advertising.
You have the right to obtain access to the data we hold about you, to have inaccurate data corrected, to have your data erased, to have processing restricted, to receive your data in a portable form, and to object to processing that is based on our legitimate interests (Art. 15 to 21 GDPR). Where processing rests on your consent, you can withdraw that consent at any time with effect for the future. In the app, the credits dialog lets you download a copy of your data as a file and delete your account, which removes your builds and listings; purchase and metering records stay for the periods named in section 3. For anything else, email us at the address in section 1.
You also have the right to lodge a complaint with a data protection supervisory authority. In Germany this is the Landesbeauftragte for data protection of the federal state in which the controller is established: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Stuttgart.
We do not use your data for automated decision-making or profiling that produces legal effects for you. The AI model generates builds; it makes no decisions about you.
SchemSmith is intended for people aged 18 and older. We do not knowingly process the personal data of minors. If you believe a minor has created an account, please contact us and we will delete it.
We may update this policy when the service or the providers behind it change. The current version is always the one published here, and the date below tells you when it was last revised.