Privacy Policy
This document is a draft and has not yet been reviewed by legal counsel. It will be finalized before general availability. It describes our current practices accurately, but its wording is not final.
The short version
Your projects never leave your browser. The ModOne web playground runs entirely on your device. You can use it without an account, and we do not collect analytics or crash reports unless you explicitly turn them on. If you choose to create a free account to use the optional AI assistant, we additionally process the data described in sections 3 and 4.
1. Data stored on your device
Projects, circuits, ladder programs, and editor preferences are stored locally in your browser (IndexedDB and localStorage). This data is not transmitted to us. You can remove it at any time by clearing site data for this domain in your browser settings.
2. Data we collect only with your consent
- Usage analytics (off by default). If you enable analytics in the app settings, we receive anonymous usage events (for example, which features are used) through Aptabase. These events contain no account identifiers and no project content.
- Crash reports (off by default). If you enable crash reporting in the app settings, technical error information such as error messages, stack traces, and app version is sent to Sentry to help us fix bugs. Crash reporting is configured not to include your IP address, and local file paths are stripped before sending. We do not intentionally include project content in crash reports.
We process this data on the basis of your consent (GDPR Art. 6(1)(a)). Both settings can be changed at any time in the app settings; turning them off stops further collection and counts as withdrawing your consent, without affecting the lawfulness of processing before withdrawal. Crash reports are retained for up to 90 days; analytics events are kept only in anonymous, aggregate form.
3. Account data (only if you create an account)
You can use the playground without an account. An account is required only for the optional AI assistant. If you sign up, we process your email address, your password (stored only in hashed form), and basic account metadata such as sign-up and last sign-in times. Accounts are managed by Supabase, which acts as a processor on our behalf. We use this data to authenticate you and to enforce the monthly AI usage quota, which is necessary to provide the AI features you request (GDPR Art. 6(1)(b)). We also use it to protect the service against abuse, based on our legitimate interest in securing the service (GDPR Art. 6(1)(f)); sign-up and sign-in are additionally protected by Cloudflare Turnstile, which processes technical connection data to distinguish humans from automated abuse. Account data is kept until your account is deleted; you can request deletion through the contact channel in section 12.
4. AI assistant requests
When you submit a request to the AI assistant, the instruction you type and the project context needed to fulfill it (for example, the current ladder program or circuit state) are sent to our AI proxy server and forwarded to Anthropic, the AI model provider, to generate a response. This happens only when you explicitly submit an AI request — never in the background.
- We do not store the content of AI requests or responses on our servers. They are processed transiently to serve your request. We store only usage counters (how many requests you have made in the current month) to enforce the quota, for as long as your account exists.
- Anthropic processes the request content under its own terms and privacy policy.
- Your own API key (optional). If you register your own Anthropic API key, it is stored encrypted and used only to make the AI calls you initiate. The key is never written to logs. You can delete it at any time in the app settings, which removes it from our systems.
This processing is necessary to provide the AI features you request (GDPR Art. 6(1)(b)).
5. Server logs
The site and app are served through Cloudflare, which acts as a processor on our behalf. Like most web infrastructure, Cloudflare processes standard connection data (such as IP address and browser user agent) to deliver and protect the service. This processing is based on our legitimate interest in operating and securing the service (GDPR Art. 6(1)(f)). We do not use this data to identify or profile you, and it is retained only for the short periods needed for security and operations.
6. Cookies
We do not use tracking cookies. The app uses browser localStorage for functional purposes only, such as your theme, whether you have completed the onboarding tour, and — if you create an account — your sign-in session.
7. Third-party services
- Cloudflare - hosting, content delivery, the AI request proxy, and Turnstile bot protection at sign-up and sign-in.
- Supabase - account authentication, AI usage quota, and encrypted storage of your own API key, only if you create an account.
- Anthropic - AI model provider; receives the content of your AI requests, only when you use the AI assistant.
- Aptabase - anonymous usage analytics, only if you opt in.
- Sentry - crash reporting, only if you opt in.
8. International data processing
The third-party services above may process data on servers outside your country, including the United States and the European Union. In particular, if you use the AI assistant, account data and AI request content are processed on servers in the United States (Supabase and Anthropic). Where required, such transfers rely on recognized safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
9. Children
The service is not directed at children under 14, and we do not knowingly collect any personal information from them.
10. Your choices and rights
- Use the playground without an account and without opting into anything: no account data, no analytics, no crash reports.
- Delete all local data by clearing site data in your browser.
- Withdraw consent for analytics or crash reports at any time in the app settings.
- Delete your registered API key at any time in the app settings.
- Request deletion of your account through the contact channel in section 12.
Depending on your jurisdiction, you may also have the right to access, correct, delete, or port personal data we hold, to restrict or object to processing, and to lodge a complaint with your supervisory authority (in the EU, your local data protection authority; in Korea, the Personal Information Protection Commission). Note that analytics events are anonymous and cannot be linked back to you, so we may be unable to locate data specific to you.
11. Changes to this policy
If our practices change, we will update this page and adjust the effective date. Material changes will be announced on the landing page in advance where feasible.
12. Contact / data controller
The data controller for this service is WK Labs, Republic of Korea. A dedicated privacy contact channel and privacy officer details will be published together with the final version of this policy before general availability.