Privacy notice
Covers geop-cad.dev, app.geop-cad.dev, book.geop-cad.dev and docs.geop-cad.dev. Last updated 27 September 2026.
Who is responsible
Tobias Jacob
Hübingerweg 26
56323 Waldesch
Germany
Email: see the contact link
This is also the site's imprint (Impressum, § 5 DDG).
In short
- The CAD app runs entirely in your browser. Your parts are not uploaded anywhere unless you send a bug report.
- The app and this website count anonymous usage statistics, without cookies and without storing anything on your device. You can switch them off in the app (Privacy button) and for this website below, and they are off automatically if your browser sends Do Not Track or Global Privacy Control.
- No advertising, no tracking across sites, no session recordings, no selling of data.
Hosting
All four sites are served by Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). To deliver a page, Cloudflare necessarily processes your IP address and technical request data (time, requested URL, browser identification) and may keep them in short-lived logs for security and to keep the service running. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in serving the sites securely. Cloudflare is certified under the EU-US Data Privacy Framework, and processes this data on our behalf under a data processing agreement.
All scripts, images and other resources are served from these sites themselves; no page loads anything from third parties.
The CAD app
Your parts
The CAD kernel is compiled to WebAssembly and runs in your browser. Parts you build, sketches you draw and files you load or save are processed only there. Saving downloads a file to your device; nothing is sent to us.
Anonymous usage statistics
To learn which features are used and which fail, the app sends the following events to PostHog (PostHog Inc.), hosted in PostHog's EU cloud in Frankfurt, Germany:
- that the app was opened (page URL, referring page, browser and version, operating system, device type, screen and window size, browser language, time zone);
- that a step was added, changed, removed or moved, and which kind of operation it is (e.g. “extrude”) — never its values, names or sketch;
- when a step fails: its kind of operation and the kernel's error message, with every name removed;
- which built-in example was opened, and that a file was saved or loaded (not its contents).
This runs in PostHog's cookieless mode: no cookie is set and nothing is stored on or read from your device. To count visitors, PostHog computes a hash of your IP address and browser identification together with a secret that changes every day; the IP address itself is not stored, and the hash cannot be linked across days. PostHog derives an approximate location (country, region) from the IP address before discarding it. We do not create user profiles and cannot identify you.
Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in finding and fixing failures and in understanding how the app is used. You can object at any time, with effect for the future, by switching statistics off under Privacy in the app; that choice is remembered in your browser's local storage (a single flag, used for nothing else). Statistics are also off if your browser sends Do Not Track or Global Privacy Control. PostHog processes this data on our behalf under a data processing agreement. Statistics are kept for at most one year.
Bug reports
If you send a bug report from the app, we receive your description, the part you were working on (the program file), the page URL, your browser identification, the time and the last error message. They are stored in Cloudflare R2 and used only to reproduce and fix the bug, and deleted when no longer needed for that. To prevent abuse, your IP address is kept for up to 24 hours to limit how many reports can be sent per day. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in fixing reported bugs and protecting the service from abuse. Do not put personal information into the description if you do not want us to have it.
This website
Anonymous usage statistics
To learn which parts of this page are read and which links are followed, geop-cad.dev sends the following events to PostHog, set up exactly as for the app above (EU cloud, cookieless mode, nothing stored on your device, no profiles, no recordings):
- that the page was opened (the same technical details as for the app);
- which sections of the page were on screen long enough to be read;
- which examples were shown in the carousel, and whether its arrows were used;
- which link or button was followed, and in which section: the app or one of its examples, sponsoring, GitHub, the book, the documentation, the contact email or this privacy page. Not what you write in an email — the contact link only opens your own mail program.
The legal basis, your right to object and the retention period are the same as for the app's statistics. Your choice for this website is kept separately from the app's, since your browser keeps the two sites' storage apart:
If you email us, we use your address and message only to answer you, and delete them when the conversation is finished unless we are required to keep them. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where your message concerns a contract.
External links
Links to GitHub and Ko-fi open those sites; nothing is transferred to them before you click. Their own privacy policies apply there.
Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Because the usage statistics are anonymous, we usually cannot find data belonging to you in them. Email us to exercise any of these rights. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (datenschutz.rlp.de).