1. Scope
This policy explains how Custom War Minis, operated by Barista Labs ("Custom War Minis," "we," or "us"), handles information when you use the Apple-platform app, this website, and the War Forge service.
2. Information we handle
- Source images and generated model files. Photos you submit, temporary GLB or OBJ output, previews, and transfer data needed to complete a forge.
- Installation and account data. A one-way hash of a random installation identifier, rank, credit balance, subscription expiration, and account timestamps. We do not persist the raw installation identifier.
- Forge metadata. Project title, capture mode, status, timing, failure details, and provider request correlation.
- Purchase records. Product and App Store transaction identifiers, purchase and expiration dates, and the Apple transaction environment used to prevent duplicate grants and manage entitlements.
- Support correspondence. Information you choose to send when you contact support.
3. How we use information
We use this information to generate and deliver your model, maintain credits and ranks, verify purchases, enforce service limits, diagnose failures, prevent duplicate transactions, answer support requests, and protect the service.
4. Photo and model retention
Our objective is zero cloud retention of your photo and model bytes after a successful device transfer. Source images are deleted after completion, failure, or project deletion. Generated output is deleted from our transfer storage after the app confirms that the files were saved locally. A one-day storage lifecycle is the fallback for abandoned transfers.
This does not mean we retain no data. Operational account, credit-ledger, purchase, security, and forge-status metadata may remain for the periods needed to operate the service, prevent fraud, meet accounting obligations, and resolve disputes.
5. Service providers
Cloudflare provides edge compute, database, queue, and temporary object storage. Fal receives source images to generate 3D geometry; requests are configured to disable provider storage, but Fal still processes the images and output. Apple provides App Store distribution, StoreKit purchases, and transaction verification. These providers handle data under their own terms and privacy commitments.
6. Device-local files and exports
Final model files and the reference image are stored inside the app's sandbox on your device, excluded from app-managed cloud backup, and protected by Apple platform data protection. They remain until you delete the relic or app data. The random account credential may synchronize through iCloud Keychain when that Apple feature is enabled so the same service account can be recognized on another device. When you export a file through the share sheet, Files, MakerWorld, a slicer, or another destination, that recipient's policies apply.
7. Tracking and advertising
Custom War Minis does not use advertising trackers and does not sell personal information. The app's privacy manifest discloses photos, generated content, service identifiers, purchase history, product interaction, and diagnostic data used for app functionality; none is declared as tracking. Operational platform logs may contain limited request and error information needed to run and secure the service.
8. Security
Traffic uses HTTPS. Model storage is private, access links are narrowly scoped, signed, and time limited, uploads and provider output are validated, and service endpoints are rate limited. The app relies on Apple's sandbox and platform data protection for local files. No system is perfectly secure, so export important files and protect access to your device.
9. Your choices
Deleting a relic removes its local files and requests deletion of its forge record and any remaining temporary objects. The Armory also provides an in-app account-deletion control that removes all relics, local model files, forge history, credits, and active rank from the account. Limited one-way security identifiers, credit-ledger entries, and App Store purchase records may be retained to prevent duplicate grants and fraud, meet accounting or legal obligations, and document the deletion. Deleting the account does not cancel an App Store subscription; subscriptions are managed in Apple Account settings. Contact us for an access, correction, deletion, or privacy request.
10. Children
The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
11. Changes
We may update this policy as the service changes. We will post the revised policy here and update the effective date.
12. Contact
Questions or requests can be sent to support@baristalabs.io.