Privacy
& cookies.
Your artwork is processed on your device. Remembering your project between visits is your choice.
This notice covers BoxMockup.com and its current 3D editor. We have no advertising trackers, analytics scripts, accounts, checkout or AI image processing. The site still needs ordinary network information to deliver and protect it.
1. Who is responsible
BoxMockup is operated by Bryan Gehrke, a sole trader trading as BoxMockup, who is the data controller for the personal data described in this notice.
ClogheraneLauragh, Killarney
Ireland
Privacy contact: bryan@croaudits.io
2. What we process and why
Artwork and projects. Images you choose, box dimensions, scene settings and camera positions are used in your browser to create mockups. PNGs, GIFs and project files are generated locally. The current editor does not upload your artwork, project contents or exports to us, Cloudflare or an AI provider. They remain in browser memory while you work unless you choose to save a file or enable local autosave.
Website requests. Your browser sends technical information needed to request the website, including an IP address, requested URL, request time, browser information and any referrer supplied by your browser. Cloudflare processes delivery, performance and security information to serve pages, prevent abuse and keep the service available. This is separate from advertising or behaviour-tracking scripts.
Privacy choices. When you accept or reject optional storage, we record the choice, notice version and time in a first-party preference cookie. It contains no artwork, email address or randomly assigned visitor ID.
Contact messages. If you email us, we receive your email address, message and anything you choose to attach. We use these to handle the enquiry or exercise of your rights. Our email service providers process that correspondence to deliver and store it.
3. Legal bases
We rely on legitimate interests (Article 6(1)(f) GDPR) to provide the editing service you request, secure this website and respond to ordinary enquiries, balancing those interests against your rights. Artwork stays on your device to limit the information we handle. Optional storage between visits relies on your consent (Article 6(1)(a) and applicable ePrivacy rules). Handling statutory data protection requests may also be necessary to meet a legal obligation (Article 6(1)(c)).
The limited storage needed to remember and respect your privacy choice, and strictly necessary delivery or security technologies, are used under the applicable ePrivacy exemptions. We do not treat continued browsing, scrolling or closing the settings window as consent.
4. Cookies and browser storage
Optional project storage is disabled by default. “Accept optional” enables it; “Reject optional” keeps it off and removes the autosaved project. The editor and manual file downloads work with either choice. “Manage settings” lets you select the project-storage option explicitly.
| Technology | Purpose | Choice & lifetime |
|---|---|---|
boxmockup_consentFirst-party cookie | Remembers your privacy choice, version and timestamp. Host-only, SameSite=Lax, and Secure on HTTPS. | Essential; set only when you choose. Expires after 180 days without renewal. We then ask again. |
boxmockup-projectIndexedDB on your device | Keeps the last studio project, including custom artwork and a save timestamp, for a later visit. | Optional; accessed only with current consent. Expires 30 days after the last save, checked when the studio next accesses it. Withdraw consent or delete the saved copy to remove it sooner. |
Browser cache and, if a challenge is required, Cloudflare security storage such as cf_clearance | Delivers assets efficiently and protects the service. Security storage is controlled by Cloudflare. | Necessary for delivery/security. Browser cache follows browser controls. Our current challenge-passage setting is 30 minutes; see Cloudflare’s notice for its security-cookie details. |
Cloudflare’s security-cookie documentation describes cookies it may use when protection is triggered. The current site has no optional analytics, marketing, tracking pixels or third-party embedded content.
Open in the website footer or studio sidebar to change or withdraw consent. Turning project storage off stops future reads and writes and deletes the autosaved copy. This does not close the current project or remove files you already downloaded. If another tab prevents deletion, we display instructions to close it and finish clearing the data.
5. How long information remains
The consent cookie lasts 180 days from your last choice. Optional autosaves expire after 30 days without a save and are removed when next checked with storage enabled; browsers may retain an expired copy while the site is not being used. Browser eviction, clearing site data, withdrawal or “Delete saved project” can remove it earlier. Downloaded files are under your control. Data in an open editor is normally released when that page is closed or reloaded.
Contact correspondence is kept for as long as needed to resolve and follow up the request and meet relevant legal requirements or handle related claims. Cloudflare’s delivery and security information follows the retention criteria in its privacy policy, including service operation, security needs and applicable legal obligations. We do not operate an additional application database or custom request-log archive for this beta.
6. Service providers and international processing
Cloudflare, Inc. provides hosting, content delivery and network security. It processes technical request information globally, including outside the EEA. Cloudflare acts as a processor for customer logs and content covered by its data-processing terms, and as a controller for some network and service data as explained in its policy.
Cloudflare describes its international-transfer safeguards, including the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses, in its privacy policy and Data Processing Addendum. Contact us for information about the safeguards relevant to our service. This browser-based editor does not send your project files through those services.
Information may also be disclosed where a legal obligation requires it or to protect legal rights. We do not sell personal data. If we later add accounts, payments, cloud saving, analytics or AI rendering, we will update this notice and obtain any new consent required before enabling the relevant processing.
7. Your data protection rights
Where applicable, you can request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You can withdraw consent at any time; withdrawal does not affect earlier lawful processing. Email bryan@croaudits.io to make a request. We respond without undue delay, normally within one month, subject to lawful extensions. We may request proportionate information to verify your identity.
We cannot retrieve artwork or project copies held only on your device. You can remove those through Cookie settings or your browser’s site-data controls. We do not make solely automated decisions about you that have legal or similarly significant effects.
You may complain to Ireland’s Data Protection Commission, using its contact and complaints form, or to a supervisory authority in the EEA where you live, work or consider an infringement occurred.
8. Keeping this notice current
We will revise this page when the service or its processing changes. A materially changed optional purpose will require a new consent choice. You can contact the controller above about this notice or any privacy concern.
Updated 18 October 2026 · Privacy choice version 1.
Back to the studio