Privacy Policy

Last updated: 27 July 2026

Mockbooth is a browser-based device-mockup studio. This policy explains, in plain language, what happens to your screenshots, your projects and your account data — and what does not happen to them.

1. Who we are

Mockbooth ("Mockbooth", "we", "us") is the operator of the Mockbooth studio and this website. We are the controller of the personal data described below. Mockbooth is free to use; there is no paid plan and we do not take payments, so we never collect card or billing details.

2. Using Mockbooth without an account

You can open the studio, drop in a screenshot, frame it and export the result without signing in at all. In this mode the app shows a “Local only” indicator, and it means what it says:

• Your images are decoded and rendered by your own browser. They are not sent to our servers.
• Your current scene and saved projects live in your browser's own storage (localStorage and IndexedDB) on that device only.
• Nothing syncs between devices, and clearing your browser data deletes it permanently — we hold no copy and cannot restore it.
• Product analytics are disabled outright in local-only mode.

3. What we collect, and why

Everything below applies only once you choose to sign in and save to the cloud. The "why" column is our lawful basis in plain English — under the GDPR these map to performance of a contract, your consent, and our legitimate interests in running a secure service.

Account identifiers (via Clerk)

Sign-in is handled by Clerk, our authentication provider. We never see or store your password. When you first sign in, Clerk gives us a verified token containing your user ID, your email address and your display name, and we store those on your account record so we can attach your projects to you and recognise you next time. Why: we cannot provide an account-based service without it.

Projects and uploaded images

When you save a project to the cloud we store the project name you typed, the scene configuration (device, background, padding, shadow, tilt, resolution and similar settings), a small preview thumbnail, timestamps, and the image files you uploaded — your screenshots and any background images. For each image we also keep technical metadata: file type, byte size and pixel dimensions. Why: this is the service you asked us to perform. We use these files only to store, render and return your own projects to you — never to train models, and never to build a profile of you.

Product analytics events

Only if you opt in. See section 4. Why: your consent, which you can withdraw at any time.

Server logs and abuse prevention

Our API writes ordinary request logs: the request method and path, the response status, how long it took, and the IP address the request came from. Authorization headers and cookies are redacted before anything is written. We also apply rate limiting, which counts recent requests per IP address in server memory. Why: our legitimate interest in keeping the service up, debugging failures and blocking abuse. These logs are not used for advertising or profiling.

4. Product analytics (opt-in)

Mockbooth can collect product analytics through PostHog to understand which parts of the studio people actually use. This is strictly opt-in:

• Nothing is captured until you press Allow on the consent banner. The analytics SDK is not even downloaded before that.
• Your choice is tied to the account that made it. If a different account signs in on the same browser, that account is asked again rather than inheriting your answer.
• Choosing Reject costs you nothing — every feature works exactly the same.

When analytics are on, we record product events in these categories:

• Session and account — the studio was opened, a sign-in started, a sign-out finished, a consent choice changed.
• Adding an image — that an image was added and how (drop, browse or paste), its format, and its size and megapixels as coarse buckets (for example "1–5 MB"), plus upload failures and a reason code.
• Editing — which device, orientation, viewpoint preset, background kind, aspect ratio or resolution was chosen, and the name of a control you adjusted (tilt, shadow, zoom and so on).
• Projects — created, saved, loaded, renamed, deleted, or a save failed, along with whether the save went to the cloud or stayed local.
• Exports — the export dialog opened, an export finished (format, bucketed dimensions, how long it took) or failed.
• Limits — that a storage or project-count limit was reached, and which one.
• Errors — that an error message was shown, identified by a fixed code, or that the 3D renderer crashed.
• Server-side — two events sent by our API: a request was rejected for exceeding a limit, and an upload was registered (with a bucketed size). These are sent only while your consent is active; the app tells the API your choice with every request, and no signal means no capture.

PostHog stores analytics state in your browser's localStorage, not in cookies. PostHog processes these events on our behalf on servers in the United States and, like any web service receiving a request, sees the originating IP address.

5. Where your data is stored

• Local-only data — in your browser, on your device. It never reaches us.
• Accounts and projects — in a managed PostgreSQL database hosted on Supabase, reached over an encrypted connection.
• Uploaded images — in a private S3-compatible object store. The bucket is not public. Your files sit under a prefix belonging to your account, and the app can only read them through short-lived signed links (about an hour) that our API issues to you and no one else. Uploads use a separate authorisation that expires within minutes.
• Analytics — with PostHog, in the United States, if you opted in.

Our providers may process data in the United States and elsewhere. Where personal data of people in the EEA or UK is transferred, we rely on our providers' standard contractual clauses and equivalent safeguards.

6. How long we keep it

• Projects — until you delete them. Deleting a project removes its record immediately.
• Images — an uploaded image is removed as soon as the last project referencing it is deleted (or once you replace it in the only project that used it). The file is then deleted from object storage. If two projects share an image, deleting one keeps the file for the other.
• Account record — kept while your account exists. See section 9 for deletion.
• Server logs — kept only as long as they are useful for operations and security, then discarded. Rate-limit counters live in memory for minutes.
• Analytics events — retained by PostHog under our project's retention settings; withdrawing consent stops all further capture.

7. Who else processes it

We keep the list of third parties deliberately short:

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We may disclose data if the law requires it, or to protect the rights and safety of our users and the service.

8. Cookies and browser storage

Mockbooth sets no advertising or tracking cookies of its own, and our API sets no cookies at all. What the app does use is your browser's own storage:

You can clear all of this at any time through your browser's "clear site data" controls. Clearing it removes any locally saved projects, which we cannot recover.

9. Your choices and rights

Depending on where you live — including under the GDPR in the EEA and UK, and the CCPA/CPRA in California — you have rights over your personal data. We extend the same handling to everyone:

• Withdraw analytics consent — the fastest route is your browser's site-data controls for Mockbooth, which clears the stored consent flag; the studio then asks again on your next visit and you can choose Reject. You can also write to us and we will switch it off for your account. Capture stops as soon as consent is gone, in every open tab.
• Access and portability — ask us for a copy of the data associated with your account. Your projects can also be exported from the studio at any time.
• Correction — ask us to fix inaccurate account details.
• Deletion — you can delete individual projects yourself in the app, which also deletes the images they hold. To delete your whole account and everything in it, email us; there is no self-service account-deletion button yet, and deleting your Clerk login on its own does not remove data held here.
• Objection and restriction — you can object to processing based on our legitimate interests.
• No sale, no sharing — we do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of.
• No discrimination — using any of these rights never degrades the service you get.

Write to the address in section 15 to use any of these. We will respond within the time your local law allows, and we may need to confirm the email address on the account first. If you are in the EEA or UK you may also complain to your data protection authority.

This policy describes what we do; it is not a claim to hold any privacy certification, seal or third-party audit.

10. Advertising

Mockbooth shows no ads today. No advertising network is loaded and no ad-targeting data is collected. If we introduce advertising in the future, we will update this policy and tell you before it starts, and any personalised advertising would be subject to a separate consent choice you can reject.

11. Children

Mockbooth is a design tool for a general audience and is not directed at children under 13 (or the equivalent minimum age where you live). We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we will delete the account and its contents.

12. Security

Traffic to the site and the API runs over HTTPS, and the database connection is encrypted. Uploaded images live in a private bucket reachable only through short-lived signed links scoped to your own account. Passwords are never handled by us — Clerk holds them. No system is perfectly secure, so we cannot guarantee absolute security; if a breach affects your data we will notify you as the law requires.

13. Changes to this policy

We may update this policy as Mockbooth changes. The "last updated" date at the top always reflects the current version. For material changes — a new category of data, a new purpose, or the introduction of advertising — we will give notice in the app before the change takes effect, and where the law requires it we will ask for your consent again.

14. Governing law

This policy is governed by the laws of the United Arab Emirates, without regard to its conflict-of-laws rules. Nothing here removes rights you have under the mandatory law of the country you live in.

15. Contact

Questions about privacy, or a request about your data? Write to us and say which email address your account uses.

Contact: support@mockbooth.com

See also our Terms of Service.