Mola Mola
Privacy Policy
Last updated 25 September 2026.
The short version: we collect the least we can get away with, we do not sell anything to anyone, there are no advertising or tracking cookies, and your design files are private to your account.
1. What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Your email address | To create your account, sign you in, and contact you about the service or your billing. | Performance of a contract |
| Your name and profile picture, if you sign in with Google | To show who is signed in. Google gives us only your name, email and picture. Nothing else. | Performance of a contract |
| Definitions and projects you upload | Stored so you can reopen them and so shared links keep working. Private to your account. | Performance of a contract |
| Usage events — which actions you take, whether they succeeded, how long a solve took, and which components a file uses | To find what is broken and decide what to build next. No keystrokes, no screen recording, no content of your designs. | Legitimate interest in improving the service |
| Billing records — subscription status, period, and Stripe identifiers | To know what you are entitled to, and to meet accounting obligations. | Contract, and legal obligation |
| Waitlist answers, if you filled in the early-access form | To decide who to invite and understand who wants this. | Consent |
We do not collect your card number. Payments go directly to Stripe, who send us only the result.
2. Where your work is processed
Worth knowing, because it is unusual: the geometry engine runs inside your own browser. When you move a slider, the computation happens on your machine, not on a server. Your design does not leave your computer to be solved.
The exceptions, and they are the only ones: files you save to your account are uploaded so you can reopen them elsewhere, and a share link is solved on our server so the recipient does not need the definition itself.
3. Who else touches it
We use a small number of processors. Each gets only what it needs.
| Who | What for | Where |
|---|---|---|
| Supabase | Database, file storage, sign-in | EU |
| Cloudflare | Hosting, content delivery, the share-link solver | Global edge network |
| Stripe | Payments and subscriptions | EU / US |
| Resend | Sending sign-in and service emails | EU (Ireland) |
| Only if you choose "Continue with Google" | Global |
We do not sell personal data, and we do not share it for advertising. Transfers outside your region rely on the standard contractual clauses these providers operate under.
4. Cookies and local storage
No advertising cookies, and no third-party tracking cookies.
- A sign-in token, stored in your browser so you stay signed in. Strictly necessary.
- Your preferences — theme, panel layout, recent files — stored locally in your browser and never sent to us.
- Cloudflare Web Analytics gives us page counts. It sets no cookie and does not fingerprint or follow you across sites.
Fonts are served from Google Fonts, which means Google sees the IP address your browser connects from when loading them. We are replacing this with self-hosted fonts.
5. How long we keep it
- Account and files — until you delete them, or until you close your account.
- A closed account — deleted within 30 days, except billing records.
- Billing records — kept as long as accounting and tax law requires, typically seven years.
- Usage events — kept in aggregate; individual rows are pruned once they stop being useful.
- Waitlist entries — deleted on request, or when early access is no longer running.
6. Your rights
Wherever you live, and specifically if you are in the EU, the UK or another jurisdiction with similar law, you can ask us to:
- Show you what we hold about you
- Correct anything wrong
- Delete your account and data — the right to be forgotten
- Export your data in a portable form; your projects already download as files from inside the app
- Object to or restrict processing based on legitimate interest, including usage analytics
- Withdraw consent you previously gave, such as for the waitlist
Email hello@molamola.cloud and we will act within 30 days. There is no charge. If you think we have handled your data badly you can complain to your local data protection authority, and we would rather you told us first so we can fix it.
7. Security
Everything travels over HTTPS. Your files sit in private storage, and database access is restricted per user at the row level so one account cannot read another's. No system is perfect; if we ever discover a breach affecting you, we will tell you.
8. Children
The service is not intended for children under 16. We do not knowingly collect their data, and will delete it if we find we have.
9. Changes
If we change this policy in a way that matters, we will tell you by email or in the application before it takes effect. The date at the top always reflects the current version.