PRIVACY POLICY

Your photo stays yours.

Last updated September 28, 2026

CarveKin is operated by FriendMachine Labs, LLC, a Michigan limited liability company doing business as CarveKin. This policy explains what we collect when you use carvekin.com, why, who helps us, and how long we keep it.

The short version

• Your photo is private. It is never shown publicly or used to advertise CarveKin.
• We delete your original photo and working images after 24 hours.
• Your finished pattern stays until you delete it, if you paid for it or saved it to an account. Unpaid, unsaved previews are deleted after 7 days.
• We don't sell your information or use it for targeted advertising.

What we collect

• Photos and patterns. The photo you upload, your crop and choices, the images made while creating your design, and your finished pattern files. We remove location and camera details from photos when you upload them.
• Email address. If you create an account, buy a pattern, recover a purchase, or ask to be emailed when a pattern is ready.
• Feedback. Your rating of a pattern, the reasons you tick, and any comment. If you tick "keep a copy" after a thumbs-down, we keep your photo and that pattern for 180 days so our team can study what went wrong.
• Carving photos. If you send a photo of your carved pumpkin, we keep it until you ask us to remove it. We show it publicly only if you allowed that, and only after we review it.
• Purchases. What you bought, the amount, and its payment status. Stripe collects your card details; we never see or store your full card number.
• Technical information. Our servers and hosting provider record IP addresses, browser type, and request details for security and troubleshooting. For abuse protection we keep short-lived, one-way hashed counters rather than raw IP addresses.
• Usage statistics. Google Analytics records which pages you visit and steps such as "photo chosen" or "PDF downloaded", with your browser, device type, and approximate location. We remove private pattern, order, and link details from page addresses before they are sent, and never send your photo or email.

How we use it

To make, check, and deliver your pattern; to process payments and refunds; to send sign-in codes, receipts, recovery links, and ready notices you ask for; to send one "how did it go?" email a couple of days after your paid pattern is ready, which you can unsubscribe from; to provide support; to prevent abuse; and to understand, in aggregate, which parts of CarveKin work. We only email you about your patterns and purchases unless you separately agree to more.

Who helps us

We share information only with providers that run CarveKin for us, under contracts that limit how they can use it:

• Google Cloud hosts the website and stores photos, patterns, and our database in the United States.
• OpenAI receives your cropped photo to create the design. It may keep submitted images for a limited time under its own API data policy, for example to monitor abuse.
• Stripe processes payments.
• Mailgun sends sign-in codes, receipts, and notices.
• Google Analytics measures how visitors use the site. We turn off Google signals and ad personalization, and we don't share this data for advertising.

We may also disclose information if the law requires it, to protect people from harm, or as part of a sale or reorganization of the business, where this policy would continue to apply.

How long we keep it

• Original photos and working images: deleted after 24 hours. A storage safety rule removes anything missed within two days.
• Unpaid, unsaved pattern previews: 7 days.
• Paid or account-saved patterns and print files: until you delete them.
• Email addresses given only for a ready notice: 7 days.
• Photo and pattern copies you let us keep after feedback: 180 days, or until you delete the pattern. Deleting a pattern also deletes your comments; only the bare rating stays in our counts.
• Carving photos: until you ask us to remove them or delete the pattern.
• Payment and order records: as long as tax, accounting, and fraud rules require.

Deleting a pattern removes it from our service right away and its files shortly after. Backups and provider-side copies can take longer to expire, and we can't recall files you already downloaded.

Cookies and browser storage

CarveKin's own cookies keep track of your guest session and keep you signed in. Your browser also remembers your current crop and choices for that tab so you don't lose them. Google Analytics sets its own cookies (named _ga) to count visits; in the European Economic Area, the UK, and Switzerland it runs without cookies. You can block these with your browser settings or Google's opt-out add-on. We don't use advertising cookies.

Your choices and rights

You can delete a pattern from its page and sign out of every device from your account. You can also email us to see, correct, export, or delete your information. We'll respond within 30 days and won't treat you differently for asking. Some records, such as payments, may need to be kept for legal reasons.

Children

CarveKin is not directed to children under 13, and we don't knowingly collect their information. Parents are welcome to make patterns from family photos. If you think a child has given us information, contact us and we'll delete it.

Security

Photos and patterns are stored privately, transferred over encrypted connections, and available only to their owner or through short-lived links you choose to share. No system is perfectly secure; if something goes wrong that affects you, we'll tell you as the law requires.

Changes and contact

We'll update the date above when this policy changes and tell account holders about significant changes by email. Questions or requests: support@carvekin.com.