Privacy

2by is made by Code House Productions (“we”). This page says what we collect when you use 2by.app, why, who handles it for us, and how to have it removed. We keep it short and we only collect what the product needs.

The demo stays on your device

The models you open or edit in the demo at 2by.app/demo are saved in your own browser’s storage. They are not sent to us. Clearing your browser’s site data removes them.

Your saved designs

When you are signed in and save designs to your account, we store:

• for each design: its name, the model text (the YAML file), and up to its last 20 saved versions, each with when it was saved and a short label (such as “saved”, “restored v3” or the name of a file you imported);
• its working state, if you use them: cut-list ticks, build-log notes and shop prices;
• the drawing we make of each design for the list on “My designs”;
• if you edit them, your copy of the hardware catalog and the lumber stock, and one previous copy of each, so a change made on another device can be undone, with a random code for the browser that saved each copy, so a change from another device can be told apart;
• short-lived counters of how often your account saves designs and catalogs, makes designs and drawings, and downloads and exports them, to stop runaway use: each counts one clock hour and is then deleted automatically (usually within a few days).

All of it is stored with Amazon Web Services in the United States (us-east-1, Northern Virginia) and is used only to show your designs back to you. It is not shared, and our administrators have no screen that shows it.

While you work, the tool also keeps edits you have not saved yet (for example while you are offline) in your own browser, with a few display preferences, so nothing is lost if the connection drops, and that random code, which stays in the browser after you sign out (every account signed in on that browser uses the same one). Once an edit is saved it is removed from the browser. Unsaved edits older than 30 days are removed the next time a saved design is opened there while you are signed in, or when you sign out; newer ones are kept when you sign out, so they can be saved the next time you sign in on it. Clearing the browser’s site data removes them, and the code, at once.

“My designs” also looks in this browser’s storage for demo models you edited before signing in, and offers to save each one. Nothing is sent unless you choose Save as a design; the copy in your browser is left as it is.

Your designs are kept until you delete them. A design you move to the Trash stays there for 30 days, so you can restore it, and is then deleted with all its versions, working state and drawing (automatically, usually within a few days after the 30 days; it is gone from your account straight away). Delete forever in the Trash deletes it at once. Export all on “My designs” downloads every design’s YAML in one file, so you can take your work with you at any time. To get a copy of everything we keep for your designs, or to have it deleted (with or without your account), email hello@2by.app.

The early-access list

When you join the early-access list we store:

• your email address;
• whether you said you are a DIY builder or a contractor, if you chose;
• which form you used and when, and when you confirmed your address;
• a one-way scrambled form of your IP address (a salted hash), used only to stop abuse such as repeated sign-ups; we cannot turn it back into your address.

To stop abuse, we also keep short-lived counters keyed by a scrambled form of your network address and of your email address, for about two days. They are kept even when a sign-up is turned away.

We send one email to confirm the address is yours. Until you confirm, we send nothing else, and unconfirmed entries are deleted automatically after 7 days. Once confirmed, we use your address to tell you about early access and the launch. Every email after you confirm has an unsubscribe link, and unsubscribing stops all further email.

Checking a model for an AI assistant

An AI assistant can send a model to 2by to be checked, or to get a picture of it, through 2by.app/api/ai/validate or the 2by connector at 2by.app/mcp. No account is involved. The model text is checked (or drawn) and then discarded: we do not store it, the picture, or write either to our logs. To stop abuse, we keep short-lived counters of how many checks come from each network, keyed by a scrambled form of the network address (a salted hash), for about two days. Whatever you share with the assistant itself is governed by that assistant’s own terms, not ours.

Connecting an AI assistant to your account

You can connect an AI assistant (such as Claude) to your 2by account, after you are asked and choose Allow. For each connection we store the name the assistant gave itself, the address it returns you to, when you connected and when it was last used, and its access and refresh keys, kept only in a scrambled one-way form (a hash), never as they are. A connection lasts 30 days; it ends sooner when you choose Disconnect under Connected assistants on My designs, when you sign out, or when your account is deleted. To stop abuse we keep short-lived counters of connection requests per network, keyed by the same salted hash of the network address.

Email you send us

Messages to hello@2by.app are received and stored by Amazon Web Services and passed on to the person at Code House Productions who answers them. The stored copy is deleted automatically after 30 days. The forwarded copy is kept in that person’s own email account, with their email provider, and replies may come from that mailbox.

Accounts

Accounts open by invitation. When you sign in we store your email address, your name if your sign-in provider shares it (for example Google), and records of your sign-ins and sessions. Signing in sets one cookie that keeps you signed in for up to 30 days, or until you sign out, plus a few that last only while you sign in (at most 15 minutes, or until you close the browser) to keep the sign-in secure. None is used for advertising or tracking.

When you sign in, we check the email address you enter against the early-access list and our invitations, so we can tell you whether you are invited yet. To stop abuse we keep a short-lived count of these checks, and of sign-in codes entered, per network, keyed by the same one-way scrambled form of your IP address; not per email address.

Who processes it for us

• Amazon Web Services (United States) stores the list, accounts and saved designs, sends and receives our email, and runs sign-in.
• Vercel (United States) hosts the website.
• Cloudflare Turnstile (United States) checks that a form was filled in by a person, not a bot.
• Google, only if you choose to sign in with your Google account.

We do not sell your information, and we do not share it with anyone else for their own use.

How long we keep it

Unconfirmed list entries: 7 days. Confirmed entries and accounts: until you ask us to delete them or you unsubscribe, after which we keep only the email address, why it was added and when, on a do-not-email list so we never mail you again. The list also holds the same address without any +tag (and, for Gmail, without dots), so other spellings of it are not mailed either. An address our email cannot be delivered to, or whose owner marks our email as spam, goes on the same list (with the delivery report’s reference). Models sent to be checked for an AI assistant: not kept at all; their counters, about two days. Connected assistants: 30 days at most, or until you disconnect them or sign out. Messages to hello@2by.app: 30 days. Saved designs: until you delete them, or 30 days after you move them to the Trash (deleted automatically, usually within a few days after). Unsaved edits in your browser: 30 days, removed the next time a saved design is opened there while you are signed in, or when you sign out.

Your choices

Email hello@2by.app to see what we hold about you, correct it, or delete it. We answer within 30 days.

Children

2by is not for children under 13, and we do not knowingly collect their information.

Changes

If we change what we collect or who processes it, we update this page and its effective date first. If a change affects you, we tell you by email before it applies.