Privacy Policy

Last updated 6 September 2026

Vessel Studio is made by MCY Limited, a company registered in New Zealand. This page explains what we collect when you use the Vessel Studio app or this website, and why. We have tried to write it the way we'd want it explained to us.

The short version

Vessel Studio runs on your own computer. Your projects, sketches, and rendered images live only on your disk — we never see them and never store them. Your Gemini API key lives only on your computer, encrypted by your operating system. The only thing we hold on our servers is your email address and whether your account is on the Free or Pro plan.

What we collect

Account information

To sign in, we store your email address and your plan (Free or Pro). If you sign in with a password, we never see or store that password — it is verified by our authentication provider, Supabase, and only a securely hashed form is ever kept. If you sign in with Google, we receive your email address from Google and never see your Google password.

Your Gemini API key

Vessel Studio asks you for your own Google Gemini API key so that rendering has no cost to us and no middleman. That key is encrypted and stored only on your device, using your operating system's own secure storage (Windows Credential Manager or macOS Keychain). It is never sent to our servers, never included in error reports, and never written to a project file.

Your projects and renders

A Vessel Studio project is a folder on your own computer. Sketches, line drawings, screenshots, and rendered images stay there. When you ask for a render, the image and your prompt go directly from your computer to Google's Gemini API, using your own key — that exchange is between you and Google, under Google's own terms, and we never see or store it.

This website

We do not run analytics or advertising trackers on vesselstudio.io. Our hosting provider (Vercel) may keep standard technical logs — such as IP address and browser type — as part of running any website; we don't use those logs to identify or track you individually.

Who we share data with

Your account email and plan are stored with Supabase, our authentication and database provider. When you use Google sign in or the Gemini API, Google processes that data under its own privacy terms. We do not sell your data, and we do not share it with advertisers. Nobody else touches it.

How long we keep it

We keep your account information for as long as your account exists. If you delete your account, we delete your email and plan record. Your projects are on your own computer, so deleting them is entirely up to you — uninstalling Vessel Studio does not touch your project folders.

Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete your account and everything tied to it, at any time. Write to support@vesselstudio.io and we'll act on it. If you are in the European Economic Area or the UK, these are your rights under the GDPR; if you are in New Zealand, under the Privacy Act 2020. We aim to honour requests within 30 days regardless of where you are.

Children

Vessel Studio is a professional tool for naval architects and yacht designers. It is not directed at children, and we do not knowingly collect information from anyone under 16.

Security

Your refresh token is encrypted on your device before it touches disk. Our database enforces row-level security so your account row is only ever readable by you. No system is perfectly secure, but nothing here is an afterthought.

Changes to this policy

If this changes in a way that matters, we'll update the date at the top of this page and, for material changes, email account holders directly.

Contact

MCY Limited, New Zealand. Questions about this policy: support@vesselstudio.io