Your photo stays yours.

Last updated October 28, 2026

CarveKin is operated by FriendMachine Labs, LLC, a Michigan limited liability company doing business as CarveKin. This policy explains what we collect when you use carvekin.com, why, who helps us, and how long we keep it.

The short version

Your photo is private. It is never shown publicly or used to advertise CarveKin.
We delete your original photo and working images after 24 hours.
Your finished pattern stays until you delete it, if you paid for it or saved it to an account. Unpaid, unsaved previews are deleted after 7 days.
We don't sell your information or use it for targeted advertising.

What we collect

Photos and patterns. The photo you upload, your crop and choices, the images made while creating your design, and your finished pattern files. We remove location and camera details from photos when you upload them.
Email address. If you create an account, buy a pattern, recover a purchase, ask to be emailed when a pattern is ready, or enter a recipient for a shared PDF.
Feedback. Your rating of a pattern, the reasons you tick, and any comment. If you tick "keep a copy" after a thumbs-down, we keep your photo and that pattern for 180 days so our team can study what went wrong.
Carving photos. If you send a photo of your carved pumpkin, we keep it until you ask us to remove it. We show it publicly only if you allowed that, and only after we review it.
Purchases. What you bought, the amount, and its payment status. Stripe collects your card details; we never see or store your full card number.
Technical information. Our servers and hosting provider record IP addresses, browser type, and request details for security and troubleshooting. For abuse protection we keep short-lived, one-way hashed counters rather than raw IP addresses.
Usage statistics. Google Analytics records which pages you visit and steps such as "photo chosen" or "PDF downloaded", with your browser, device type, and approximate location. It also measures purchased packs, amounts, discounts, and refunds using a separate transaction reference that cannot open your purchase or pattern, and which free gift codes are claimed. When server reporting is enabled and Google's browser tag provides visit identifiers, we use them to associate a confirmed payment with that visit, even if you leave checkout before returning. If the tag is blocked or runs without cookies, a confirmed payment, refund, or free gift claim is still counted under an anonymous reference for that order, with no visit attached, so our totals are complete. If you use Google's opt-out add-on, your orders are not reported at all. We remove private pattern, order, and link details from page addresses before they are sent, and never send your photo, email, or card details.
Product measurement. Outside the European Union, usage measurement is on by default unless you turn it off. In the EU, it starts only after you allow it. PostHog records the same kinds of steps, approximate location, device and browser details, and confirmed purchase amounts under an anonymous browser identifier. We do not identify you by email or account. Recordings of public pages show public text, example images, creation controls, clicks, scrolling, and navigation. Typed values, uploaded photos, filenames, and private content are hidden; private link parameters are removed. Private account, checkout, recovery and pattern pages are excluded from recordings. We do not record console messages, network request contents, canvases, or card details.

How we use it

To make, check, and deliver your pattern; to process payments and refunds; to send sign-in codes, receipts, recovery links, and ready notices you ask for; to send one "how did it go?" email a couple of days after your paid pattern is ready, which you can unsubscribe from; to provide support; to prevent abuse; and to understand, in aggregate, which parts of CarveKin work. We only email you about your patterns and purchases unless you separately agree to more.

If someone uses "Email this pattern," we send the printable files to the address they enter through our email provider. Shared copies contain no source photo or account-access link, and recipients are not added to a mailing list. We remove the recipient from our delivery queue after sending or a terminal failure. Unsent requests expire after 24 hours and are removed from active delivery during maintenance. We keep a keyed hash and request status for abuse protection for up to seven days. Copies already delivered to an inbox cannot be recalled by deleting the pattern.

Who helps us

We share information only with providers that run CarveKin for us, under contracts that limit how they can use it:

Google Cloud hosts the website and stores photos, patterns, and our database in the United States.
OpenAI receives your cropped photo to create the design. It may keep submitted images for a limited time under its own API data policy, for example to monitor abuse.
OpenAI Ads measures which ads lead to paid purchases. When ad measurement is allowed, we retain the ad-click reference and send that reference with a unique purchase-event reference, purchase time, currency, and amount after Stripe confirms payment. We do not send photos, email addresses, card details, or private pattern links through this integration. We opt these events out of future user-level personalization.
Stripe processes payments.
Mailgun sends sign-in codes, receipts, and notices.
PostHog provides product analytics and protected public-page recordings in its US cloud. This is on by default outside the EU, requires opt-in in the EU, and can be turned off everywhere.
Google Analytics and Google Ads measure site use and which ads lead to paid purchases. When ad measurement is enabled, Google can use advertising cookies and ad-click identifiers together with the confirmed purchase amount, currency, and a transaction reference that cannot open your order. We send a Google Ads purchase event only after our service confirms payment. Ad measurement starts by default in the US and requires permission elsewhere. Google signals, remarketing, ad personalization, and automatic customer-data matching remain off. Your photos, email address, and card details are never sent to analytics.

We may also disclose information if the law requires it, to protect people from harm, or as part of a sale or reorganization of the business, where this policy would continue to apply.

How long we keep it

Original photos and working images: deleted after 24 hours. A storage safety rule removes anything missed within two days.
Unpaid, unsaved pattern previews: 7 days.
Paid or account-saved patterns and print files: until you delete them.
Email addresses given only for a ready notice: 7 days.
Photo and pattern copies you let us keep after feedback: 180 days, or until you delete the pattern. Deleting a pattern also deletes your comments; only the bare rating stays in our counts.
Carving photos: until you ask us to remove them or delete the pattern.
Payment and order records: as long as tax, accounting, and fraud rules require.
OpenAI ad-click references: up to 30 days in browser storage and our order records, or until you withdraw measurement permission. Queued purchase events retry for at most seven days; their ad-click reference is removed when delivery finishes or stops. OpenAI retains received events under its own conversion data terms.
Analytics visit identifiers associated with orders and event records: up to 14 months. Google Analytics is also configured to retain event data for 14 months.
PostHog public-page recordings: 30 days. Product analytics follow our PostHog project's event retention settings.

Deleting a pattern removes it from our service right away and its files shortly after. Backups and provider-side copies can take longer to expire, and we can't recall files you already downloaded.

Cookies and browser storage

CarveKin's own cookies keep track of your guest session and keep you signed in. Your browser also remembers your current crop and choices for that tab so you don't lose them. Google Analytics sets its own cookies (named _ga) to count visits when usage measurement is enabled. Usage measurement starts by default outside the EU and only after your permission in the EU. Google advertising cookies and Google ad-click identifiers are enabled by default in the US unless you opt out, and require permission elsewhere. Turning off ad measurement stops both Google and OpenAI ad measurement. We remember that choice in this browser for 180 days; use "Ad measurement settings" in the footer to change or withdraw it at any time. Withdrawing stops future ad measurement; it does not recall data already sent. You can also block Analytics with your browser settings or Google's opt-out add-on.

We use our hosting provider's approximate country lookup to decide whether to ask for permission; we do not guess from your language or timezone. In the EU, Google Analytics and PostHog stay off until you choose "Allow usage measurement". Outside the EU, they start automatically, with no opt-in prompt. If location is unavailable, they stay off until you explicitly allow measurement in settings. Use the footer's "Usage measurement settings" anywhere to turn usage measurement off or on. This choice is independent of ad measurement and is remembered for 180 days. PostHog uses browser storage to connect steps in that browser. Withdrawing stops new collection and clears its stored identifiers; previously collected data and requests already being delivered may remain. We also respect Do Not Track and Global Privacy Control for usage measurement.

Your choices and rights

Google and OpenAI ad measurement start by default for visitors located in the United States, unless you have opted out or your browser sends Do Not Track or Global Privacy Control. They require opt-in elsewhere, including the EU, UK, and Switzerland. Use "Ad measurement settings" in the footer to allow or turn off ad measurement. Turning it off also clears the saved OpenAI ad-click reference and cancels undelivered purchase events associated with your current browser or signed-in account. Requests already in flight or data already delivered cannot be recalled by this switch.

You can delete a pattern from its page and sign out of every device from your account. You can also email us to see, correct, export, or delete your information. We'll respond within 30 days and won't treat you differently for asking. Some records, such as payments, may need to be kept for legal reasons.

Children

CarveKin is not directed to children under 13, and we don't knowingly collect their information. Parents are welcome to make patterns from family photos. If you think a child has given us information, contact us and we'll delete it.

Security

Photos and patterns are stored privately, transferred over encrypted connections, and available only to their owner or through short-lived links you choose to share. No system is perfectly secure; if something goes wrong that affects you, we'll tell you as the law requires.

Changes and contact

We'll update the date above when this policy changes and tell account holders about significant changes by email. Questions or requests: support@carvekin.com.