Privacy Policy

• Your pictures, screenshots and designs are processed in your browser. They're never uploaded to us. The one exception is the MCP server for AI agents: when you connect an agent, the screenshots it renders are uploaded, kept private, and deleted automatically.
• Free use needs no account. You only sign in with Google to buy Pro or to use Pro you've already bought.
• When you sign in, we get your name, email address, profile picture and Google account ID. Nothing else from your Google account.
• Payments are handled by Polar, our merchant of record. We never see your card details.
• We use Google Analytics and PostHog to understand how the site is used, including recordings of how the editor is used. They never include your pictures, file names or anything you type. We don't sell your data or show ads.
• Scraping and other automated collection from EZ Mockup are not allowed (see Scraping and automated collection).

The editor runs entirely in your browser. The pictures you add, the mockups you design, and the images, videos and ZIP files you export are created on your device and are never sent to our servers. We can't see them and we don't keep copies. Your work in the editor lives in your browser's memory and is gone when you close or reload the tab.

With Pro, you can connect an AI agent such as Claude Code, Codex or Cursor to our MCP server, which renders mockups on our servers instead of in your browser. Only then do pictures reach us:

• Screenshots your agent uploads go straight to private storage that only our renderer can read. They can be used for 1 hour, and are then deleted within a day.
• Rendered mockups are kept privately for 24 hours, so your agent can download them, and are then deleted within a day.
• Render records: for each render we keep the settings your agent asked for (canvas size, device, colors), the output's size, timing, which agent made it (for example "claude-code") and any error, without the pictures, for 90 days, to enforce fair-use limits and investigate abuse.
• Access tokens: we keep each token's name, a fingerprint (a one-way hash) of it, and when it was created, last used and expires. Never the token itself.

No one looks at your screenshots or mockups, and we never use them to train AI models. Uploads are checked to be real images before anything else happens to them.

• Google account information. If you sign in with Google, Google shares your name, email address, profile picture and a unique account ID with us. We ask only for the basic openid, email and profile permissions, so we can't access your Gmail, Drive, contacts, calendar or any other Google data.
• Account and purchase records. When your account was created; your sign-in sessions (a session token, and the IP address and browser that started each session); and your purchases: order number, what you bought, the price and currency, the date, refund status, when your Pro pass ends, how many export credits you have, and when you used each credit and for what kind of export (still image, ZIP, video or GIF).
• Payment information. Polar processes your payment and handles invoices and sales tax. Polar and its payment processors collect your card details and billing address under their own privacy policies. We receive the order details above, never your card number.
• Usage analytics. Google Analytics and PostHog record the pages you visit, the referring site, your browser, device type and screen size, your approximate location (derived from your IP address), and in-app events: which features, device frames, canvas presets and export settings you used, how long an export took, and errors. These events never include your pictures, file names, colors or anything you type. If you're signed in, PostHog links them to your account ID (not your name or email), so we can see which features lead to purchases.
• Session recordings. PostHog records how the page is used (clicks, scrolling, the controls you change) so we can see where the editor is confusing or broken. The canvas, your pictures, file names, anything you type and your account details are blocked before anything is sent, so recordings never contain them. In the EEA, the UK and Switzerland, we only record after you agree.
• Short surveys. Now and then, one optional question, such as what you're making. We get your answer, if you give one.
• Server and security logs. Our host, Vercel, processes your IP address, browser user agent, the pages and files you request and when you request them, to deliver the site, keep it secure and detect abuse such as scraping, bots and attacks.
• Messages you send us. If you email us for feedback, support or a refund, we get your email address and whatever you write. The "Send feedback" button pre-fills an email with your canvas size, screen size and browser version to help us fix problems; you can edit or delete that before sending.

• To run EZ Mockup: signing you in, keeping you signed in, and showing your name and picture in the account menu.
• To deliver what you bought: linking purchases to your account, applying Pro passes and export credits, restoring purchases and processing refunds.
• To help you: answering feedback, support and refund emails.
• To improve the product: seeing which features are used, finding bugs and deciding what to build next. We look at aggregated analytics, not at individuals.
• To protect EZ Mockup and its users: preventing fraud, payment abuse, account sharing and circumvention of Pro; detecting and blocking scraping, bots and other unauthorized automated access; and enforcing our Terms and Conditions.
• To meet legal obligations, such as tax and accounting rules, and to respond to lawful requests.

We don't sell your personal information, use it for advertising, or make automated decisions about you that have legal or similarly significant effects.

This section covers the information we receive through Sign in with Google.

• What we access: your name, email address, profile picture and Google account ID. Nothing else.
• How we use it: only to create and identify your EZ Mockup account, sign you in, show who's signed in, link your purchases to you, and contact you about your purchases or support requests.
• Who we share it with: we don't sell Google user data, use it for advertising, or transfer it to anyone except (a) the service providers that run EZ Mockup for us, namely our database host, and Polar, which receives your email address and account ID so your purchases are tied to your account; (b) when you ask us to; or (c) when the law requires it.
• No AI training: we don't use Google user data to develop, improve or train AI or machine-learning models. No one reads it except when you ask for support, or when needed for security or to comply with the law.
• Storage and protection: it's stored in our database, encrypted in transit, and only we can access it.
• Retention and deletion: we keep it while you have an account. Delete your account from the account menu, or email us, and we delete it from our database. You can also remove EZ Mockup's access at any time from your Google Account.

EZ Mockup's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share personal information only with service providers that help us run EZ Mockup, and only what each one needs:

• Vercel: hosting and server logs, and private storage for the MCP server's files.
• Google: Sign in with Google and Google Analytics.
• PostHog (posthog.com): product analytics, session recordings and surveys, stored in the United States.
• Polar (polar.sh): our merchant of record, which sells Pro to you and handles payments, invoices, sales tax and refunds, using payment processors such as Stripe.
• Our database provider: managed PostgreSQL hosting for account and purchase records.
• Ko-fi: the Ko-fi button image loads from Ko-fi's servers, which see your IP address and browser. Ko-fi gets more only if you click through to it.

We may also disclose information to comply with the law or a valid legal request; to protect the rights, property or safety of EZ Mockup, our users or others, including to investigate and act against fraud, scraping, unauthorized access and other breaches of our Terms; or as part of a merger, acquisition or sale of EZ Mockup, in which case this policy keeps applying to your information.

• Sign-in cookie: keeps you signed in. It's strictly necessary and only set when you sign in.
• Analytics cookies and storage (Google Analytics' _ga and _ga_*, PostHog's ph_*): tell visits and visitors apart. To opt out, use Cookie settings, the Google Analytics opt-out add-on, or block cookies or trackers in your browser. The editor works the same either way.
• In the EEA, the UK and Switzerland, we ask first. Until you agree, Google Analytics sets no cookies, and PostHog counts visits without cookies or storage and records nothing. Your answer is kept in local storage; change it any time with Cookie settings.
• Region cookie (ez-consent-region): tells the page whether to ask for consent where you are. It's strictly necessary and holds nothing but that.
• Checkout: Polar's checkout may set its own cookies under Polar's policies.
• Local and session storage: remembers preferences such as performance mode, and whether you've already seen the support message this session. It stays on your device and is never sent to us.

• Account information: until you delete your account. Sign-in sessions expire on their own within 30 days.
• Purchase records: while you have an account. Deleting your account deletes them from our database; Polar keeps its own order records for as long as tax and accounting law requires.
• Analytics: Google Analytics data for at most 14 months; PostHog events for at most 1 year, and session recordings for at most 30 days.
• Server logs: for a limited period set by Vercel.
• MCP server: screenshots your agent uploads are deleted within a day of expiring (1 hour after upload), rendered mockups within a day of expiring (24 hours after rendering), and render records after 90 days. Tokens are deleted with your account.
• Emails: as long as needed to handle your request and any follow-up.

• Contract: your account, sign-in, purchases and support.
• Legitimate interests: keeping EZ Mockup secure, preventing fraud and abuse (including scraping and automated access), server logs, and understanding usage to improve the product.
• Legal obligation: tax, accounting and responding to lawful requests.
• Consent: where the law requires it, for example for analytics cookies and session recordings in the EEA, the UK and Switzerland. You can withdraw consent at any time with Cookie settings.

Wherever you live, you can ask us to:

• Access or export the personal information we hold about you.
• Correct it. Your name and picture come from your Google account.
• Delete your account and its data, from the account menu or by email.
• Object to or restrict some processing, such as analytics.

Email elianrichards@gmail.com to make a request. We'll reply within 30 days and may need to confirm the request comes from you. If you're in the EEA or UK, you can also complain to your local data protection authority. If you're in California: we don't sell your personal information or use it for targeted advertising, and we won't treat you differently for exercising your rights.

We and our service providers process information in the United States and other countries, which may have different data protection laws from yours. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

EZ Mockup is served only over HTTPS. The sign-in cookie is HTTP-only and secure, database access is restricted, and payment details never touch our servers. No system is perfectly secure; if a breach affects your information, we'll notify you as the law requires. To report a vulnerability, email elianrichards@gmail.com.

You may not use bots, scrapers, crawlers, scripts, headless browsers, AI agents or other automated means, or manual bulk copying, to collect anything from EZ Mockup, including other people's personal information and the device frames, 3D models, images and other assets on the site. Section 7 of our Terms and Conditions sets out the full rules, including the narrow exception for search engines that follow our robots.txt.

To detect and stop this, we and Vercel analyze request data such as IP addresses, user agents, request rates and access patterns, and may rate-limit, challenge or block traffic. We do this on the basis of our legitimate interest in protecting EZ Mockup and its users. Information collected in breach of this policy or our Terms is collected without authorization, and we may take legal action against whoever collects it.

EZ Mockup isn't directed to children under 13, or under the minimum age for consenting to data processing in their country (up to 16 in parts of the EEA), and we don't knowingly collect their personal information. If you think a child has given us personal information, email us and we'll delete it.

When we update this policy, we change the date at the top. If a change is significant, we'll give notice on the site, and email signed-in users, before it takes effect.

EZ Mockup (ezmockup.app) is made and run by elianrichard, an independent developer, who is responsible for your information under this policy. Questions or requests: email elianrichards@gmail.com.