Privacy Policy
Updated October 8, 2026.
Your account
TextPuppet uses Google to sign you in. We store your Google account identifier, name, email address, account plan, and sign-in dates. We do not request access to Gmail, your contacts, or Google Drive. Session cookies keep you signed in.
Your mockups
Unsaved drafts and uploaded pictures stay in your browser, separately for each signed-in account on this device. When you choose Save to account, the full editable project, including its images and imported fonts, is stored privately in Cloudflare with your account. Subsequent edits autosave to that project. You can reopen saved projects on another device while your plan is active. Saved projects do not expire automatically. Removing one hides it from your library, offers an immediate undo, and schedules its stored content for deletion after 30 days. Deleting your account deletes its saved projects. Interrupted saves are backed up in this browser when storage is available. Clearing browser storage removes local drafts and pending edits, but does not remove projects already saved online. Project files remain an optional backup.
When you export, your mockup is sent to our Cloudflare-hosted service to generate the image or PDF. Standard mockup exports are not stored in our account database. Temporary rendering data is discarded after processing. We keep export counts and short-lived locks to manage capacity.
Assistant connections
When you connect an assistant through our MCP, it can create, read, revise, and export only the API and MCP mockups stored with your account. It can use images you explicitly supply. It cannot read your browser drafts, email, or Chrome tabs. MCP mockups and uploaded images are stored privately in Cloudflare for up to 30 days after creation or revision; expired objects are removed during periodic cleanup. Export links expire after 15 minutes. Anyone with an export link can download it while it is valid. Images embedded in a saved mockup remain part of that mockup even if the original upload is removed. You can delete saved objects through the connected assistant, disconnect an app at Connections, or delete your account to remove its stored content. Your assistant provider processes the descriptions and images you share under its own policies. All customer MCP connections use the hosted service. An active TextPuppet plan is checked on every request, including export downloads. Downloaded setup files contain no credentials or offline renderer.
Developer API
API keys can create, read, revise, delete, and export the API and MCP mockups and images stored with your account. They cannot access billing, browser drafts, or Chrome tabs. We show a new key once and store only its hash, masked prefix, name, creation time, last-use time, and revocation time. Key records remain until you delete your account. Revoke a key at API keys to stop its access. Every request requires an active plan or trial. Saved API mockups and images use the same private storage and 30-day retention as MCP objects. Direct API renders return the file without saving it; API requests are not sent to an assistant provider by TextPuppet.
Saved profiles
Profiles you choose to save, including their photos, names, company details, bios, usernames, and email addresses, are stored privately with your TextPuppet account in our Cloudflare-hosted database. This lets you reuse them across templates and devices. They are not public or shared with other users. Applying a profile copies its details into your draft; later profile edits do not change older drafts. Removing a profile hides it from your library and offers an immediate undo. Deleting your account also deletes its saved profiles.
Website imports and extension
When you explicitly choose Import visible page, the extension sends the visible-page screenshot and detected text/image region information to your private TextPuppet account. Captures may contain personal information visible on the page. They are accessible for 24 hours, then removed during periodic cleanup; save to your account or download a project file to retain a copy. Imports do not include cookies, credentials from browser storage, or website scripts. The extension stores a sign-in token locally and checks account access while editing. Normal page edits stay in your browser.
Billing
Stripe processes payments. We store your Stripe customer identifier and purchase/subscription status to manage access; we do not store card numbers. Stripe may retain payment records under its own policies.
Service providers
Google handles authentication. Cloudflare hosts the website, account database, and rendering service and may process network information and operational logs. TextPuppet does not sell your personal information or include advertising trackers.
Account removal
You can remove TextPuppet’s connection from your Google Account’s third-party connections settings. This revokes the Google connection but does not by itself erase TextPuppet’s account record. Account deletion is available from the editor’s Account settings.