NULLSHAPE

Privacy policy

Last updated 21 October 2026

In short: we keep as little as possible — your email address, the projects you save online, and whether you have Pro. Your music never leaves your device or your own Google Drive. No ads, no tracking cookies, no selling of data.

Who is responsible

Elias Borenstein (Nullshape), Denmark, is the data controller. Contact: hello@nullshape.com.

What we store, and why

• Your account — email address, and your name if you sign in with Google. Needed to sign you in and link your projects and Pro to you.
• Projects you save online — the project, a small preview image, and any images that are part of it. Stored so you can open them on any device. Projects you only download as a file are never sent to us.
• Recipes you save — the effect steps and their settings, the start graphic (shapes and text, never photos) and a small preview image. Stored in your account so you can use them on any device.
• Which days you used Nullshape while signed in — only the date, nothing about what you did, deleted after 35 days. Used to count how many people use it each day, week and month.
• Your plan — whether you have Pro, which plan, until when, and the Stripe customer reference for your purchases.
• A sign-in cookie — one cookie that keeps you signed in for up to 60 days. It's needed for the service to work; there are no advertising or analytics cookies.

The legal basis is that this is needed to provide the service you asked for (GDPR art. 6(1)(b)), and, for payment records, legal obligations.

What stays with you

• Music stays in your browser, or in your own Google Drive. If you add music from Drive, Nullshape only gets access to the files you pick (Google's “drive.file” permission), reads them in your browser, and never uploads them to our servers.
• Work in progress is kept in your browser's storage on your device until you save it online.

Who helps us run Nullshape

• Cloudflare — hosting and storage of accounts and saved projects.
• Stripe — payments, as the seller of record. Stripe handles your card and billing details under its own privacy policy; we never see your card.
• Resend — sends sign-in emails (from servers in the EU) and, if you sign up for updates by email, the newsletter.
• Google — only if you choose to sign in with Google or add music from Google Drive.
• Feedback — if you send feedback from the app, we keep your message, the email you give (if any) and a few technical details (browser, screen size, plan, the project's size) for up to a year, to answer you and fix bugs.
• Updates by email — only if you sign up: we keep your email address (with Cloudflare, and in the mailing list of Resend or MailerLite, an EU company) to send the occasional newsletter. You confirm your sign-up by email first, and every email has an unsubscribe link. Nothing else is done with it.

Some of these companies may process data outside the EU; they do so under the EU's standard contractual clauses or similar safeguards. We don't sell or share your data with anyone else, and we don't use it for advertising.

How long we keep it

As long as you have an account. Deleting your account (⋯ → Account → Delete account) removes your account, your projects and recipes saved online and your plan from our storage straight away. Stripe keeps payment records for as long as the law requires.

Your rights

You can ask to see, correct, export or delete your data, or object to how it's used — write to hello@nullshape.com. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or the authority in your country.

Changes

If this policy changes, the date at the top changes too, and important changes are announced in the app.