MeshPit

Privacy policy

What personal information MeshPit keeps, why we keep it, who else handles it and your rights under the Protection of Personal Information Act (POPIA).

Last updated 7 October 2026

Who is responsible

MeshPit is the responsible party for the personal information described here. Our information officer is [Information officer name], and you can reach them at meshpit@meshpit.co.za. Our address and phone number are on the contact details page.

Most of MeshPit never sees your files

MeshPit Desktop runs on your computer and sends nothing to us. It reads your model files where they are and keeps its library on your computer.

In the browser, STL repair, the Lithophane Maker, PNG to SVG, Pipe Connectors, the Light Box Maker and the Cake Topper Maker build their files on your computer. Your models, photos and pictures are not uploaded unless you choose to save a design to My projects. You can use these tools without an account.

What we collect

When you sign in

You sign in with Google or GitHub. They send us your name, email address, profile picture and an account id. We never see your Google or GitHub password.

When you use the paid tools or save a design

  • Your free exports, credits and subscription, and a record of each export: which project or file it was, what it cost and when.
  • The designs you export or save to My projects. A saved cake topper keeps the SVG picture you opened for it. A light box keeps only the name of a font you opened, never the font file.
  • For Surface Features, the model you export is sent to our server, which adds the features and sends the file back. We keep the file name, the features you added and a fingerprint (a SHA-256 hash) of the model, but not the model itself.

When you pay

Paystack handles the payment. We receive your email address, the amount, the payment reference and a Paystack customer code. We never receive or store your card number.

When you contact us

The contact form sends us your email address and your message, and the desktop app adds its version and operating system if you send feedback from there. Help and feedback sent from inside a tool also includes your account email, your export balance and the settings you had open, but never your photo or model. To stop spam we count messages per IP address, storing the address only as a keyed hash that can't be turned back into it, and run a Cloudflare Turnstile check, which looks at your browser.

When you visit the site

Google Analytics records the pages you visit, how you reached the site, and your browser, device and rough location. It uses cookies to tell visits apart. We use this only to see which pages and tools people use. The site also stores a few settings in your browser, such as whether you closed the desktop app offer, and Firebase keeps you signed in the same way.

Why we use it

  • To sign you in, keep your projects and give you the exports you have paid for.
  • To take payments, keep accurate financial records and stop fraud.
  • To email you receipts and messages about your subscription, such as a failed payment or access ending. We don't send marketing email.
  • To answer your questions and fix the bugs you report.
  • To keep the site secure and understand how it is used, so we can improve it.

We process your information because it is needed to give you the service you asked for, because the law requires it (tax and accounting records, for example), or because we have a legitimate interest in running a secure and working service. We don't sell personal information, and we don't use it for advertising.

Who else handles it

These companies process personal information for us, under their own security and privacy terms. Some of them store it outside South Africa, in countries such as the United States and Ireland. POPIA allows this when the recipient is bound by laws or agreements that protect it to the same standard, and these providers commit to that in their data processing terms.

  • Google Firebase, for sign-in and the database that holds accounts and projects.
  • Amazon Web Services, which runs our server.
  • Paystack, which takes card payments and subscriptions.
  • Resend, which sends our emails.
  • Cloudflare, for the spam check on the contact form.
  • Google Analytics, for visitor statistics.
  • Render, which hosts the website.
  • Google and GitHub, when you sign in with them.

We share information with anyone else only if the law requires it, for example a court order.

How long we keep it

We keep your account, projects and export history while your account is open. When you ask us to delete your account we delete your projects and profile. We keep payment records for five years, as tax law requires, and then delete them. Contact messages stay in our mailbox for as long as we need them to help you. Google Analytics keeps its data for up to 14 months.

How we protect it

Everything travels over encrypted connections (HTTPS). Only our server can read the database, and it checks your sign-in on every request. Payments go through Paystack, which is certified to the card industry's PCI DSS standard. If we learn that someone has got hold of your personal information without permission, we will tell you and the Information Regulator as POPIA requires.

Your rights

Under POPIA you may:

  • ask whether we hold personal information about you, and ask for a copy of it,
  • ask us to correct information that is wrong, or delete information we no longer need,
  • object to us using your information, including for analytics,
  • withdraw your consent where we rely on it, and
  • complain to the Information Regulator.

To use any of these rights, or to have your account deleted, email meshpit@meshpit.co.za from the address you sign in with. We reply within 30 days and don't charge for it. You can block Google Analytics with your browser's privacy settings or Google's opt-out add-on, and the tools still work.

Children

MeshPit is not meant for children under 18 to sign in or pay without a parent or guardian. If you think a child has given us personal information without consent, email us and we will delete it.

Complaints

Please tell us first, and we'll try to fix it. You can also complain to the Information Regulator of South Africa at POPIAComplaints@inforegulator.org.za, through inforegulator.org.za, or at JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

Changes

When this policy changes we update the date at the top of this page. If a change affects how we use information we already hold, we email account holders before it takes effect.