Privacy

Effective 2 August 2026.

PartMode is a local-first browser CAD application. Anonymous and browser-approved projects, geometry, recovery, and editing history stay in browser storage unless you explicitly download or open a project file. Server-headless agent projects are a separate, opt-in path: when you create an edit key with the headless grant and use it to open a project, PartMode stores that committed document under your account.

Who is responsible

Each hosted PartMode deployment has its own operator. Contact that operator through the privacy channel published by the deployment.

Cookies and analytics

PartMode does not use analytics, advertising trackers, third-party tracking pixels, or analytics cookies. After you make a choice, the browser sets one host-only first-party cookie to remember that you selected essential storage only. If you choose to sign in, PartMode also sets a secure, HttpOnly account-session cookie. Starting Google sign-in sets a separate secure, HttpOnly browser-binding cookie for no more than ten minutes so the callback can be matched to the browser that started it. These cookies do not grant consent to future analytics.

See the cookie details and settings page for its exact name, purpose, duration, and deletion control.

Essential browser storage

PartMode uses localStorage and IndexedDB for local project recovery, application preferences, first-run state, and CAD session continuity. This storage is necessary for the local-first features you request and is not used to track you across websites.

Optional accounts and agent keys

If you create an account, PartMode stores an internal account name, account creation time, hashed web-session tokens, and agent-key metadata such as label, access ceiling, immutable headless-grant choice, creation, last-use, expiry, and revocation times. Passphrase accounts also store a salted password verifier. Raw passwords, raw session tokens, and raw agent keys are not stored. A new agent key is displayed once.

You may instead sign in with Google or explicitly connect Google to an existing passphrase account. PartMode requests only Google's stable account identifier and basic profile, not your email address. It stores the Google issuer and stable identifier plus an optional display-name snapshot. It does not retain Google's authorization code, ID token, access token, or refresh token. Identities are never linked because profile names match.

You can disconnect Google when another sign-in method remains, revoke individual agent keys, sign out, or delete the PartMode account from Agent access. Deleting a PartMode account does not delete the underlying Google account.

Browser-approved agent relay

A normal agent key identifies an agent but grants no CAD access by itself. When you approve a live, project-scoped browser session, PartMode relays that session's typed commands and results through the service over HTTPS. The browser project is not uploaded to account storage. Relay payloads are bounded, held transiently in process memory, and are not written to the account database or an offline queue. The relay is not end-to-end encrypted, so the PartMode service transiently handles those typed payloads.

Server-headless agent projects

Headless CAD requires an edit key created with an explicit headless grant. Enabling it is per-key consent for that key to run CAD on the PartMode server without a browser or per-session human approval. The grant cannot be added to an existing key. For each project opened this way, PartMode stores the account ID, project ID, project name, revision, full document JSON, canonical document hash, creation time, and update time. The document JSON contains the complete committed parametric project and geometry recipe.

Headless execution sessions are temporary, bound to the exact key, and expire in at most one hour. The committed document is durable and survives session expiry, key revocation, service restarts, and deployments so another headless-granted key on the same account can reopen the same project ID. Revoking a key prevents further authentication and closes its live headless sessions, but does not delete durable documents. Signing out closes active browser relay and headless execution sessions while keeping keys and durable records. Those records remain until account deletion. Headless sessions have no visible studio: cad_artifact, cad_ui, and cad_events are unavailable; the dedicated headless artifact export currently produces STEP.

Network requests

The browser CAD application loads its HTML, JavaScript, WebAssembly kernel, styles, and icons from partmode.com. Browser CAD evaluation happens on your device and no account is required. Signed-in browser tabs make bounded long-poll requests so an approved agent can connect. The explicit headless path sends typed MCP requests to PartMode, where a worker-thread CAD runtime evaluates the account's server project. PartMode does not embed Google scripts, frames, or tracking assets. If you choose Continue with Google, the browser navigates to accounts.google.com and Google processes the sign-in request under Google's privacy policy before returning you to PartMode.

As with any website, PartMode and its delivery and security provider, Cloudflare, receive connection metadata such as IP address, user agent, requested URL, and request time as needed to deliver and protect the service.

Retention and your choices

The preference cookie expires after 180 days, the Google browser-binding cookie after no more than ten minutes, and an account session after 30 days unless you sign out earlier. Account, linked-identity, and agent-key metadata remains until you disconnect the identity or delete the account; revoked-key metadata may remain with its revocation time until account deletion. Browser-local CAD projects remain on your device until you delete them in PartMode or clear this site's browser data, and PartMode stores no relationship between the account and those local projects. Server-headless project records remain under the account until account deletion; there is currently no separate per-project deletion control. Deleting the account closes active headless sessions and removes linked identities, credentials, keys, and every durable headless document. It does not remove browser-local projects or the underlying Google account.

You can delete the preference cookie from cookie settings or your browser. For a hosted deployment, you can ask its operator about access, deletion, restriction, portability, or objection. Where applicable, you may complain to your local data-protection authority.

Future optional analytics

If optional analytics are introduced later, they will remain disabled until you make a separate, informed opt-in choice. The current essential-only cookie is not consent for future analytics.

Contact

For a hosted deployment, use the operator's published privacy channel. Source-code security reports can use the repository's private vulnerability-reporting form.