Privacy Policy

Last updated October 11, 2026

This page explains, in plain language, what StoneSwap collects when you use it, why, who else sees it, how long it is kept, and what you can ask us to do about it.

Who you are dealing with

StoneSwap.ai is operated by StoneSwap Inc., of 21 King St W Suite 6, Hamilton ON L8P 4W7, Canada. We are the organisation responsible for the personal information described here. StoneSwap is a tool for hardscape and landscape businesses; the people who use it are contractors and their teams, and the photos they upload are usually of a client’s property.

The person responsible for personal information at StoneSwap is our Privacy Officer, Matthew Stubbs (ops@stoneswap.ai). Questions, corrections and complaints go to him; see Contact.

What we collect and why

• Your account. Your email address, your name, and either a password (stored only as a hash) or the identifier Google gives us when you sign in with Google. Sign-in codes we email you are stored hashed and expire in ten minutes. We use these to sign you in and to send the emails the service needs (sign-in codes, receipts, plan changes, a failed payment).
• Your business details. Business name, your first and last name, phone, business email, website, role, country, state or province, city, an annual revenue range and, if you upload one, your logo. Phone, email and website appear on the share links and proposals you send to clients; the rest helps us understand who uses StoneSwap. Country, state or province and city are pre-filled from the approximate location Cloudflare reports for your connection; you can change them before saving.
• Your photos and designs. The photos you upload, anything you draw on them, the products you pick, your written instructions and the settings you choose, the design we generate, and a short automated description of the project. This is the service itself.
• Billing. Your card is handled entirely by Stripe; we never see or store the card number. We keep the Stripe customer and subscription identifiers, your plan, how many designs you have used, your top-up purchases and a record of each charge and refund.
• Technical information. Your IP address, browser and device type, the pages you open and the actions you take, plus the counters we keep to stop abuse (for example how many sign-in codes or designs were requested from an address in the last hour). We keep no device fingerprint.
• Team members. When an account is part of a team, the team owner’s designs and plan are used for every member, and members’ own email addresses are kept so they can sign in.
• Messages you send us. The name, email address and message from the contact form, and any product request you send from the studio, so we can reply.

Your photos and the AI

To build a design, your photo (and, when you drew on it, a guidance copy of your drawing) is sent to the AI models we use through fal.ai, together with the product images and a written prompt built from your choices. The models return the finished image; a text model then writes the one-line project description shown on the design page. These providers process the images to produce your result and do not receive your name, email or business details.

Every request passes an automated check that refuses photos that are not an outdoor property, junk images and instructions that try to misuse the service. A refused request is not sent on and the design is returned to your balance; a request that breaks our Terms may lead us to block the account.

We do not use your photos or designs to train AI models.

Who else sees it

We share information only with the companies that run parts of the service for us, each bound to use it solely for that purpose:

• Cloudflare — serves the site, stores your photos and designs, runs the bot check (Turnstile) on sign-up and contact forms, and reports the approximate location of your connection.
• fal.ai and the AI model providers it routes to — generate the designs and the project description, as described above.
• Stripe — payments, receipts, subscriptions and the billing portal.
• Resend — delivers the emails we send you.
• Google — only when you choose to sign in with Google.
• DigitalOcean — hosts the application and its database.

Share links and proposals. When you create a share link, anyone who has the link can open the before-and-after page. It shows the design, the products in it (unless you switch that off), your business name or logo and the contact details you chose to show. The printable proposal carries the same information and a QR code to the link. Links do not expire on their own; they stop working when you delete your account or ask us to disable one. When you email a design to a client from the share dialog, we send that client one email with your business name and the link.

We do not sell personal information. We disclose it outside the list above only when the law requires it, to protect someone’s safety, or, with notice, as part of a sale or reorganisation of the business.

Cookies and pixels

StoneSwap sets a small number of first-party cookies, all needed to make the service work:

• session_token keeps you signed in for 30 days.
• ss_csrf protects forms and requests against cross-site forgery (deleted when the browser closes).
• ss_pending remembers a design you started as a guest for 7 days so it is waiting for you after you sign in.
• ss_oauth_state and ss_oauth_funnel secure a Google sign-in for ten minutes.
• Your Auto / Light / Dark choice is kept in your browser’s local storage, not a cookie.

On the public site (not inside the app) we also use three measurement tools that load only after you first interact with the page: the Meta Pixel, the Google Ads tag and Microsoft Clarity. They set their own cookies and tell us which pages and campaigns bring contractors to StoneSwap and whether a visit led to a plan. Each provider’s own policy governs how it handles that data. Blocking third-party cookies or scripts in your browser does not affect the service.

Where it is kept

The application and its database run in the United States (New York). Photos and designs are stored with Cloudflare in North America and served through its network. Our service providers may process data in other countries where they operate; wherever it goes, it stays under this policy and our contracts with them.

How long we keep it

• Designs and photos are kept for as long as your account exists. Designs are never deleted automatically, so you can reopen, share or print any of them later. Removing a design from Your Designs hides it from your list; the share link you may already have sent keeps working.
• A design started as a guest that is never claimed is deleted after 7 days.
• Account and business details are kept while the account is open and removed when you delete it (see below).
• Billing records are kept for 7 years after the transaction, as Canadian tax law requires, even after the account is deleted.
• Technical logs and abuse counters are kept for days, not months.
• Sign-in codes expire after ten minutes; expired codes are purged.

Your choices and rights

• See and export. Settings › Account › Download My Data gives you one file with your profile, designs and purchases.
• Correct. Business and account details are edited in Settings.
• Delete. Settings › Account › Delete My Account removes your designs, photos and personal details, ends your plan and signs you out everywhere. Purchase records are kept for the period above, and any remaining designs on the account are forfeited.
• Emails. Sign-in codes, receipts and plan notices are part of the service and cannot be switched off while you have an account. Any news or tips we may send in future can be turned off in Settings or with the unsubscribe link in that email.
• Ask us. You can ask our Privacy Officer what we hold about you, to correct it, or to delete it; we answer within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or the privacy regulator where you live.

StoneSwap is a business tool and is not intended for anyone under 18. The property photos you upload may show other people’s homes; make sure you are allowed to use them.

Security

Everything travels over HTTPS. Passwords and sign-in codes are stored only as hashes, sessions as hashed tokens, and the photos and designs in your account are served to you and to people you share them with, not listed publicly. Access to the servers and the secrets that run them is limited to the people who operate StoneSwap. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the regulator as the law requires.

Contact

Questions about this policy or your information go to the person responsible for personal information:

General questions can also go to contact@stoneswap.ai. The rules for using the service are in the Terms of Service.

When this policy changes, the “last updated” date above changes; if the change matters to you, we will tell you by email or in the app before it takes effect.