Privacy policy
Updated 9 September 2026.
What SketchMason collects, what it is used for, and how long your work is kept.
Who this is for
This page describes how SketchMason (https://www.sketchmason.com) handles information. Questions go to hello@sketchmason.com.
What we collect
An account is an email address and a password, or whatever the sign-in provider sends us. An address left on the waitlist goes on the launch list and nothing else.
A project holds the sketches, references, generated screens and history you make. A design you publish to Explore is a copy of one screen and the sketch behind it, offered to the public on purpose.
The site records ordinary request logs and, through DataFast and Ahrefs, page views on sketchmason.com. If PostHog is configured, product events go there too. Errors may be sent to Sentry so a crash can be fixed.
If you paste an Anthropic API key into the canvas, it is held in that browser tab only, sent with the generation request, and gone when the tab closes. SketchMason never stores it.
What we use it for
To run the product: generate a design, save a project, take a payment, send a receipt.
To email people who asked for the launch list or the newsletter, and to reply if you write to us.
To keep the canvas usable: rate limits exist so one visitor cannot empty the product for everyone else.
How long we keep it
An account and the projects on it stay until you delete them, or until we have to close the product.
Payment records are kept for as long as the payment provider and the tax rules require.
Who else sees it
Generation is sent to the model provider (Anthropic, unless you brought your own key). Stock photographs may be fetched from Pexels. Payments go through Polar. Auth, storage and the database run on Convex. Hosting is Vercel. Analytics is DataFast and Ahrefs, and PostHog when a project key is set. Error reports may go to Sentry.
We do not sell your information. We do not use a generated design as advertising unless you published it to Explore or shared the link yourself.
Cookies
The auth cookie is how a session survives a closed tab. It lasts thirty days. Without it you would sign in again on every visit. There is no advertising cookie.