Privacy Policy

Version 2.0, effective 29 November 2026. This policy describes the data F3D collects, why, who processes it, how long it is kept and your rights. The F3D operator is the data controller; contact details are on the Contact page.

1. Data F3D collects

• Account: email, username, display name, hashed password, email verification status, language, and what you choose to add to your profile (avatar, bio, website, social links, country); the IP address at registration and at your most recent activity; your referral code and who referred you; your two-step secret (stored encrypted) and recovery codes if you turn the feature on.
• Sign-in with Google, Facebook, Apple: the identifier issued by the provider, email and the basic profile details the provider returns. F3D never receives your password for those services.
• Anti-abuse: every registration attempt records a signal made of the email domain and hashed values of the IP address, the browser string and the device id; the signal is not linked to an account. The device id is a random value kept in a cookie (see the Cookies section). This data is used only to detect multiple accounts and reward fraud.
• Content: models, images, descriptions, comments, ratings, reports; the prompts and input images you send to the AI Studio and the resulting generations; your messages with the Luci assistant; what you send through the Contact and Feedback forms (with the IP address and browser string).
• Transactions: orders, amounts, the price snapshot taken when the order was created, the payment notifications sent back by the payment gateway (including the reference), credit history. F3D never receives your card number.
• Usage: downloads, generations, likes, bookmarks and follows, notifications received and read, sessions (device, browser string, IP address, time), and the technical logs needed to run the service.

2. Purposes and legal basis

• Providing the service agreed in the Terms of Service: accounts, uploads, downloads, AI Studio, the Luci assistant, payments, rewards.
• Protecting the platform: anti-abuse, content moderation, copyright reports.
• Notifications: events about your account and content through three channels (on site, email, browser push); you switch each type on or off per channel in Notification settings. Security and account emails (email verification, password reset, account deletion confirmation) are always sent.
• Measurement and marketing in the browser: advertising tags, analytics tags and page performance metrics load only with your consent through the cookie banner (Cookies section).
• Product analytics and member engagement: while you are signed in, activity events linked to your account (for example registration, downloads, uploads) are sent to the product analytics tool and to the email marketing and automation systems of F3D, regardless of the cookie banner choice. While you are signed out and have not given marketing consent, server-side events may still reach the product analytics tool under a shared “guest” id, without your IP address or browser string and without creating a user profile. Events are sent to Meta only with your marketing consent. If you subscribe to the newsletter, your email and your consent choice are stored to send it.
• Legal obligations: accounting, tax, lawful requests from competent authorities.

3. Processors acting for F3D

• File storage and backups: Google Cloud Storage. File delivery: BunnyCDN. Edge protection and page caching: Cloudflare.
• AI: the images you send to the AI Studio, or the images generated from your prompt, go to Tripo to build the 3D model; your prompts and images go to Google Gemini (through the Google Gemini API) to rewrite prompts, generate images and moderate. Messages with the Luci assistant go to Google Gemini for answers; comments, model titles and descriptions may be sent to Google Gemini for automatic moderation.
• Payments: the SePay payment gateway receives what it needs to process and confirm a transaction.
• Email and push delivery: the email delivery service of F3D and the push service of the browser you use.
• Analytics and marketing: PostHog (product analytics), Mautic and Activepieces (email marketing and automation), Meta (conversion measurement, only with your consent), Google Tag Manager, Google AdSense and Google One Tap sign-in (only with your consent).
• Technical monitoring: error logs, metrics and traces of the system are sent to Datadog.

F3D does not sell personal data. Data may be processed on servers outside Vietnam by the processors above under contractual safeguards.

4. What is public

Username, display name, avatar, bio, website and social links on your profile, published models, comments, badges and leaderboard positions are public. Email, credit balance, transaction history and sessions are not public: only you and authorised F3D staff can access them.

Cookies

The cookie banner offers two choices: Essential only and Accept all. The choice is remembered for 6 months (183 days) and recorded as proof of consent (a hashed visitor id, your account if you are signed in, the cookie groups you chose, the time). While the choice is valid the banner does not show again; to choose again, delete the f3d_consent cookie of f3d.vn in your browser and reload the page. No marketing tag loads before you consent.

• Essential (always on): f3d_session keeps you signed in, 30 days; f3d_reg_device a random device id against multiple accounts, set when you register, or when you start a Google, Facebook or Apple sign-in or account link, 1 year; f3d_consent remembers your cookie choice, 6 months; f3d_locale remembers your language, 6 months; f3d_ref a referral code, 30 days, set only when you open a referral link; luci_guest_token keeps a conversation with the Luci assistant while you are not signed in, 1 year, set only when you chat.
• Display preferences: f3d_theme remembers light or dark mode and f3d_density remembers the model grid density, 1 year each, set only when you change that preference.
• Marketing and measurement (consent only): f3d_anon a random anonymous id for measurement, 180 days, removed when you withdraw consent; g_csrf_token protects a Google One Tap sign-in, 10 minutes; and the cookies set by Google Tag Manager, Google AdSense, PostHog and Meta (for example _fbp, _fbc). With “Essential only” these tags are not loaded and send nothing.
• Admin staff only: f3d_admin_session keeps a session in the admin area; regular users never receive this cookie.

6. Retention

• Sessions: valid for 30 days from sign-in, or until you sign out or revoke them; session records are deleted 30 days after the session expired or was revoked.
• Read notifications: deleted after 90 days; unread ones stay until you delete them or the notification expires.
• Anti-abuse signals: 90 days. Messages sent through the Contact and Feedback forms: 30 days. Technical logs: 30 days. Database backups: 30 days.
• Audit logs of significant account and admin actions, including IP addresses: 24 months in the database, then archived for a further 5 years.
• AI Studio: prompts, input images and generations are kept; generations that are not published can be downloaded for 30 days.
• Deleted accounts: the profile is anonymised 7 days after you request deletion (if you confirmed by email and did not cancel); email, username, profile, avatar, IP addresses, sign-in links, sessions and push subscriptions are deleted or replaced with anonymous values. Credit, order and payment history is kept as financial and audit records, linked to the anonymised account.
• Models and comments: when you delete your account you choose whether your published models stay or are removed; models that stay and your remaining comments no longer show your name or avatar.

7. Your rights

You may access, correct, obtain a copy of and delete your data. Most of it is self-service in the Account area (profile, email, password, sessions, sign-in links, notification settings, account deletion). Other requests, including a request for a copy of your data, go through the Contact page; F3D answers within 30 days. You may complain to the competent data protection authority.

8. Security

Passwords are hashed with Argon2id; connections are encrypted; system secrets are kept out of the source code and two-step secrets are stored encrypted; the admin area requires two-step verification and admin actions are logged. If an incident affects your data, F3D notifies you within 72 hours of confirming it.

9. Children

The service is not intended for anyone under 16. Accounts found to belong to children are deleted together with related data.

10. Changes to this policy

Material changes are announced at least 7 days in advance by email or in-account notification, with the new effective date at the top of this page.