About Mortise
Mortise is a browser-based woodworking design application operated by Pixel Forty Inc. at https://woodworking.app. This policy describes the information used to provide accounts, save designs, and operate the service.
Information we collect and why
Accounts. We use your email address to identify your account. With Google or Apple sign-in, we receive a provider account identifier, email address, verification status, and available profile information such as your name and picture. We use this information to authenticate you and display your account. We do not receive your Google or Apple password. Magic-link sign-in verifies control of the email address you enter.
The same verified email address links to the same Mortise account across supported methods. Apple's Hide My Email supplies a separate relay address; it is treated as a different address unless it already belongs to your Mortise account.
Designs. Cloud projects include design data, titles, thumbnails, and timestamps needed to save and reopen your work. Preferences and locally saved work can also be stored on your device. Exported files go to the destination you choose.
Community sharing. Publishing a community share makes its design, title, description, and selected pictures accessible to others. Do not publish confidential material or material you lack permission to share. Removing a share does not remove copies others have already saved.
Authentication and security. We store verification records, sessions, and provider account/token records needed for authentication. Our infrastructure processes technical information such as IP addresses, browser information, and request logs to deliver the service, limit abuse, and diagnose failures. Sign-in emails are service messages, not marketing subscriptions.
Analytics. On the production website, Mortise uses PostHog to measure page visits and selected actions, such as creating or exporting a project. The current configuration uses cookieless analytics, disables person profiles and session recording, respects browser Do Not Track, and removes query strings, fragments, and project identifiers from analytics URLs. The application does not send names, account emails, project contents, or uploaded file contents as product-event properties. Network requests still expose technical connection information to the receiving service; cookieless does not mean that no information is processed.
Services that process information
- Convex: account records, projects, application functions, and uploaded images.
- Resend: sign-in emails and delivery information.
- Google or Apple: authentication and the profile information described above, when you select that provider.
- PostHog: the limited product analytics described above; the configured endpoint is US Cloud.
- Netlify: website hosting and operational request logs.
Providers may process information outside your country, including in the United States, where different laws may apply. Each provider also maintains its own privacy terms.
We use Google account information for sign-in and account features. We do not request Gmail messages, Drive files, contacts, or calendars. Google account information is not sold, used for advertising, or used to train general-purpose AI models. Our use of Google API data must comply with the Google API Services User Data Policy, including applicable Limited Use requirements.
Choices, retention, and requests
You can choose email sign-in instead of a social provider, export projects, remove projects or shares using available controls, and manage provider authorization in Google or Apple settings. Revoking provider authorization does not itself delete your Mortise account or projects.
Contact us to request access to, correction of, or deletion of your personal information. We verify that requests come from the account holder. We may retain information when required by law or needed to investigate security incidents; backup copies may remain until the applicable backup cycle expires. Clearing browser storage removes preferences and may remove locally saved work.
We use access controls and other safeguards to protect information. No internet service can guarantee absolute security.
Changes and contact
We will update the effective date and provide appropriate notice of material changes, including obtaining additional consent where required.
Privacy contact: mortisepixelfortycom, Pixel Forty Inc.