Privacy policy: Ikimotion Studio

This policy explains what personal data Ikimotion Studio collects when you use the website (ikimotion.com) and the editor (ikimotion.app), why, how long we keep it, and what you can do about it.

Who we are

Ikimotion Studio is an independent software studio based in Texas, United States (“we”, “us”). We are the controller of the personal data described here, except where this policy names another company as the controller. The legal name and address of the operating company will be added here when it is formed.

For anything about privacy, write to privacy@ikimotion.com or use the contact form with the topic Privacy request. For everything else, write to hello@ikimotion.com.

Summary

We collect what we need to run your account and your projects, and to answer you when you write to us.
Help improve Ikimotion is a separate, per-project setting. It is off by default. Only when it is turned on in a project do we receive that project’s edits, artwork and tool usage, for the purposes listed below. It can be turned off and the data deleted at any time.
Payments are handled by Paddle, our reseller. We never see full card numbers.
We do not sell personal data and do not use it for advertising.
The website sets no cookies and runs no analytics or advertising trackers.

Account data

When you create an account on ikimotion.app we process:

your email address, and whether you have verified it;
your display name;
your sign-in credentials: the public key of each passkey, or a password stored only as a salted hash (never in readable form);
if you sign in with Google or Discord: the account id they give us, and the name, email address and profile picture you allow them to share;
sessions: a random session token kept in the iki_session cookie (stored by us only as a one-way hash), with how and when the session started, when it was last active, the browser it runs in and the country of the connection, so that you can see and end your sessions under Account settings;
sign-in records: each sign-in attempt with its method, whether it succeeded, the time, the IP address, its country and the browser, to protect accounts against abuse;
account email records: sign-in links, address verification and password reset emails are sent through SendGrid (Twilio), our email processor. For each of these emails we record whether it was delivered, whether it was opened (through a tracking pixel in the email) and when its link was used, to keep sign-in working and to detect delivery problems;
your subscription: the plan, its status, the country of purchase and the last four digits of the card, as reported to us by Paddle (see Payments).

Why: to create and secure your account, sign you in, send messages about your account (verification, sign-in and security notices) and provide the plan you chose. Legal basis: performance of our contract with you, and our legitimate interest in keeping accounts secure.

Payments

Subscriptions are sold by Paddle.com Market Limited (“Paddle”), which acts as our reseller and merchant of record. When you buy a plan, Paddle collects and processes your payment details, billing address and tax information as an independent controller under its own privacy policy. We receive only your subscription status, plan, country and the last four digits of your card. We never receive or store full card numbers.

Project data

Your projects contain what you put into them: imported artwork (PSD files and images), meshes, deformers, parameters, physics, animations, exports you build in the editor, and the project’s history of changes. We store them on Cloudflare’s infrastructure so that the project is saved as you work and is available to the people you share it with.

Who can see a project: its members. The owner invites people as editors or viewers with invite links, changes their roles and removes them. Anyone with a project’s view-only review link can play the model without an account. Share invite and review links only with people you trust.
Collaboration data: while you work in a project, the other people in it see your display name, colour, pointer position and selection. These are shown live and are part of the project’s history of who changed what.
Our access: we access project contents only to operate and secure the service, to help you when you ask us to, or when the law requires it.

Why: to provide the editor and its real-time collaboration. Legal basis: performance of our contract with you.

Help improve Ikimotion (opt-in)

Help improve Ikimotion is a setting of each project, found in the Share panel. It is off by default, and nothing described in this section is recorded or uploaded for a project while it is off. The project’s owner and editors can turn it on; viewers and review links cannot. Turning it on shows a confirmation that explains what is shared, and every person in the project, including reviewers on a view-only link, sees a banner for as long as it stays on. The user manual describes the setting step by step.

What is collected

While the setting is on, the project shares:

every edit, with its values before and after, the time, and who made it, identified by the display name used in the project, the participant number of that connection and an anonymous browser id (a random id kept in your browser’s local storage, not linked to an account);
the PSD files imported into the project (the original files);
snapshots of the project, taken when sharing starts, after each import and export, and every few hundred edits;
tool usage: which tools, commands, undo and redo, and dialogs are used, with their times.

We do not collect email addresses, account ids, IP addresses or browser details with this data.

Why we use it

We use it to find and fix bugs, understand how the app is used, improve features, and develop new ones, including rigging assistance that learns from how rigs are built (machine learning). This means the shared data, including artwork, may be used to train and evaluate machine learning models that help with rigging.

Legal basis: your consent, given by turning the setting on. You can withdraw it at any time.

Turning it off and deleting the data

Turn it off: click Turn off in the banner, or switch off Help improve Ikimotion in the Share panel. It takes effect at once for everyone in the project: nothing more is recorded or uploaded.
Delete the data: in the Share panel, click Delete shared data and confirm. Everything the project shared (edits, PSD files, snapshots and tool usage) is deleted from our storage immediately and the setting is turned off. The project itself is not affected. The project keeps a note of when the data was deleted and by whom.
Retention: shared data is kept until it is deleted this way.

Because the setting belongs to the project, any editor of the project can turn it on, off, or delete the data. If you work in someone else’s project and want your contributions removed, ask the project’s owner, or write to us.

Live input and microphone

Webcam face tracking and microphone lip sync run in your browser. The camera image and the microphone sound are not uploaded to us. A sound file you import into a project as an audio track is project data like any other file.

Website: contact form and early access

Contact form: we receive your name, email address, topic and message, the time, and the country your connection comes from. We keep your message as a support ticket and deliver it to our inbox through SendGrid (Twilio), without tracking. We use it to answer you. The form is protected by Cloudflare Turnstile, which processes technical information about your browser to tell people from bots (Cloudflare’s privacy policy).
Early-access list: if you leave your email address, we store it with the time and the language of the page, and use it only to tell you about new releases and plans. Each email has an unsubscribe link, or write to privacy@ikimotion.com. Legal basis: your consent.
Abuse protection: both forms count requests per IP address for one minute to stop abuse. We do not store those addresses.

Cookies and local storage

Website (ikimotion.com): no cookies, no analytics, no advertising trackers.
Editor (ikimotion.app): one strictly necessary cookie, iki_session, keeps you signed in. The editor also keeps settings in your browser’s local storage: preferences, layouts, keyboard shortcuts, recent projects, your display name, live-input mappings and the anonymous browser id described above. You can clear them in your browser at any time.

Service providers

We use Cloudflare, Inc. to host the website and the editor, store projects and files and run Turnstile, and SendGrid (Twilio Inc.) to send email: account emails (with the delivery, open and link records described under Account data) and contact form messages (without tracking). They process data on our behalf under data processing agreements, and transfers outside your country are covered by the EU Standard Contractual Clauses where they apply. Paddle processes payments as an independent controller, as described under Payments. Google and Discord take part only if you choose to sign in with them.

How long we keep data

Data	Kept for
Account data	While your account exists, then deleted within 30 days of closing it, except records we must keep by law.
Projects you own	Until you ask us to delete them at privacy@ikimotion.com, or until you close your account; deleted within 30 days of either.
Help improve Ikimotion data	Until deleted from the Share panel (see above).
Contact messages and support tickets	24 months after the conversation ends.
Early-access list	Until you unsubscribe or ask us to remove you.
Sessions	Until they expire or you sign out.
Sign-in records and account email records (delivered, opened, link used)	180 days.

Your rights

Depending on where you live, you have the right to access your personal data, correct it, delete it, receive it in a portable format, object to or restrict its processing, and withdraw consent at any time (this does not affect processing before the withdrawal). Write to privacy@ikimotion.com and we will answer within one month. You also have the right to complain to your data protection authority.

Children

Ikimotion Studio is not directed at children under 13, or under 16 in the EEA and the UK, and they may not create an account.

Security

Connections are encrypted (HTTPS). Session tokens and passwords are stored only as one-way hashes. Access to production systems is limited to the people who need it.

Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we tell account holders by email or in the editor before it takes effect.