Account and service data
Google is the only sign-in provider. Better Auth stores the resulting account and session records in Cloudflare D1; Trellis 3D does not receive your Google password. D1 also stores the verified email address, account profile, credit wallet, immutable credit ledger, generation history, payment-order records and security rate-limit data needed to operate the service. Administrator access is restricted by a server-side email allowlist.
Cloudflare runs the application and hosts its D1 database and private R2 object storage. For session security and authentication rate limits, the service may store an IP address, browser user-agent and authentication route alongside timestamps and counters. Cloudflare Turnstile checks new-account introductory-credit claims for automated abuse. The claim system keeps a keyed, non-reversible Google-account marker to prevent repeat rewards and temporarily stores a separate HMAC of the connection address or IPv6 network prefix for rolling network limits. It does not store the raw Turnstile token or raw address in the promotion ledger. Operational logs may contain request identifiers, status information and sanitized errors, but credentials, session tokens and private callback query strings must not be logged.
Image generation files
When you start a hosted generation, the selected image is placed in private Cloudflare R2 storage. A short-lived, unguessable Worker URL lets fal.ai retrieve that input for TRELLIS.2 inference. After a valid result is confirmed, the Worker copies the GLB into private R2 and serves it only to the signed-in account that owns the task. fal.ai may temporarily process or cache inputs and outputs under its own service terms even after the application copy is removed.
Do not upload sensitive images or files you do not have the right to process. Production operators should review fal.ai's current privacy, security and data-processing terms before accepting public uploads.
Payments
Stripe Checkout processes purchases. Trellis 3D stores the order identifier, package, amount, currency, status and Stripe references required to reconcile credits, refunds and disputes. Full payment-card details are entered with and handled by Stripe, not stored in this application database.
Local browser tools
Tools labeled local-first inspect selected GLB or image files in the active browser tab. Those files are not sent to the hosted generation endpoint unless you explicitly submit a generation request.
Retention, deletion and your rights
Account, ledger and order records are retained for service integrity, fraud prevention and financial reconciliation. Session, IP-address, user-agent and request-rate-limit data should be retained only for the operator's published security period. Signup-reward network HMAC records are automatically removed after 45 days in the implemented policy. Generation inputs, generated R2 objects and their database history may follow different retention periods. A production operator must publish its legal entity, contact address, jurisdiction-specific retention schedule, account-deletion process and applicable privacy rights before launch.