DESIGNCODE IO PTE. LTD., Singapore, runs Shape and is responsible for your personal data in it. This is what we collect, why, and what you can ask us to do with it.
Last updated 3 November 2026
Your Google account’s name, email address, profile photo and account ID, when you sign in.
What you’ve bought: your plan, its dates and status, and the Stripe customer and subscription IDs. Stripe handles your card details; they never reach us.
Your credit balance and a log of each Composer drawing: the model, the tokens it used and what it cost.
What you ask Composer for, and the icons and illustrations it draws for you, so your drawings are there on any device.
The technical details any web server sees, such as your IP address and browser, which our host keeps in its logs for a short time.
To sign you in, check your membership, take payments, count credits and keep your drawings: that is, to provide Shape to you. If you bought the earlier Shape, we look up your email in its Stripe account to honour that purchase.
We don’t sell your data, show ads, or use analytics or tracking cookies.
Shape sets only the cookies it needs to sign you in: shape_id and shape_rt hold your session and can’t be read by scripts, shape_in tells pages you’re signed in, and shape_flow lasts the ten minutes of a sign-in. Signing out removes them.
Your browser also keeps a few settings locally, such as the app’s theme and Composer’s last model and style.
Google: Firebase Authentication for sign-in, and Firestore for your account, credits and drawings.
Stripe: payments, receipts and the billing portal. Netlify: hosting the site and its servers. Anthropic: Composer’s requests, to draw with Claude. Mailgun: sending account emails. Google Fonts: the site’s fonts load from Google’s servers, which see your IP address.
These companies process data only to provide their service, and may do so outside Singapore, including in the United States. We use providers that protect it to a standard comparable to Singapore’s Personal Data Protection Act.
Your account data stays while your account is open. When you ask us to delete it, we remove your account, credits and drawings within 30 days. Payment records stay with Stripe, and in our records, as long as tax and accounting law requires.
You can ask for a copy of your data, to correct it, or to delete your account, by emailing support@designcode.io from the address you sign in with. If you’re unhappy with how we handle your data, tell us first; you can also contact Singapore’s Personal Data Protection Commission, or the authority where you live.
If we change this policy in a way that matters, we’ll say so on the site or by email before it takes effect.