Privacy notice

Your land data should remain understandable and removable.

Effective May 31, 2026

Local analysis first

Terrain calculations run in your browser. Drawing a boundary does not by itself create an account. Browser-only projects and interface preferences stay in your browser storage until you remove them or clear that storage.

Saved projects and uploaded terrain

When configured Cloudflare storage is available and you save a project, TopoDesigner stores the project JSON in D1. If you select a GeoTIFF, the file is analyzed locally first and may also be stored in R2 so an authorized shared view can reproduce the analysis. Stored uploads use opaque identifiers and hashed object capabilities.

Sharing choices

Private editor and viewer links contain separate unguessable capabilities. Treat those links as secrets. A public project can be opened by anyone with its URL, and viewers can retrieve a referenced uploaded DEM through the project. The upload capability itself is not returned to public or read-only viewers.

Operational counters and external sources

A configured deployment stores expiring, hashed-client quota counters in KV to limit abusive use of upstream services and storage. Terrain, climate, soil, map and location-search requests may reach the public or deployment-selected data providers described in the project documentation. Those providers apply their own terms and privacy practices.

Accounts, billing and analytics

Free terrain analysis does not require an account. If you request a sign-in link, TopoDesigner stores your email address, expiring login token and session records in D1 and sends a transactional message through Cloudflare Email Sending. If you upgrade, Stripe processes payment details and TopoDesigner stores Stripe customer, subscription and entitlement status identifiers in D1. A configured deployment may enable Cloudflare Web Analytics for privacy-first page-view and performance measurement.

Delete your data

An editor can delete a saved project from the workspace. TopoDesigner verifies editor authority, removes any legitimately owned stored GeoTIFF, removes the D1 project row and forgets the browser copy. You can clear browser-only projects by deleting them in the workspace or clearing browser storage. A signed-in Free or canceled account can also be deleted from the account page; TopoDesigner removes its account-owned projects and verified stored uploads. Cancel an active subscription in the billing portal first.

Contact

Questions about a hosted TopoDesigner deployment should be directed to its operator. For the reference deployment, contact hello@hello.topodesigner.com.