Privacy Policy
Updated November 14, 2026
This policy explains what personal data DXF World ("we", "us") at dxfworld.com collects, why, and what you can do about it. We keep it short and specific: if something is not listed here, we do not collect it.
Contact for anything privacy-related: [email protected]
The short version
- You can browse, search and use the box generator without an account. We set no cookies for that.
- An account is needed to download files and to publish your own. It stores your email, your name and what you did on the site.
- We do not sell or rent your data, we do not show third-party ads and we use no third-party analytics or tracking pixels.
- You can ask us to delete your account at any time.
What we collect
When you just browse
- Visit statistics without cookies. To count visitors we compute a daily code from your IP address, browser name, the date and a secret key. The code changes every day, cannot be turned back into your IP address and cannot follow you from one day to the next. Alongside it we store the page language, the type of source that brought you (for example "search" or "Pinterest") and words typed into the site search.
- Server logs. Like every web server, ours writes technical logs (IP address, time, requested address, browser name, response code). They are used only to keep the site working and secure and are deleted after 14 days.
- Your saved list. The "Saved" list for visitors who are not signed in lives only in your browser (local storage). It never reaches our server.
When you create an account
- Email sign-up: your email address, the name you enter and your password. The password is stored only as a salted scrypt hash; we cannot read it.
- Google sign-in: from Google we receive your name, email address, whether Google has verified that email, and a Google account ID. We do not get your Google password, contacts or any other Google data.
- Activity on the site: files you downloaded and when, files you liked or saved, generator presets you saved, reports you sent and the language you use the site in.
- A sign-in cookie (
dw_s). It keeps you signed in for up to 60 days and is removed when you sign out. It is strictly necessary for the account to work, so it needs no consent banner.
When you publish a file
The files, photos and texts you upload, the category and parameters you fill in, and the moderation status and our reasons if a file is rejected. Published files are shown publicly under the CC0 1.0 licence, as explained in our Terms of Use. Your email address is never shown publicly.
When you report a file
The file, the reason you chose, the details you write and, if you are signed in, your account. We use reports only to review the file.
Why we use it (legal bases)
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Running your account, downloads, uploads, likes and presets | account and activity data | performance of a contract |
| Keeping the site secure: rate limits, preventing abuse, logs | IP address, logs | legitimate interest |
| Counting visitors and searches to improve the catalogue | daily visitor code, page and search data | legitimate interest |
| Handling reports and copyright notices | report data | legal obligation and legitimate interest |
| Answering your emails | your message and email address | legitimate interest |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
Who else processes your data
We do not sell or share your data with advertisers. The following service providers process data on our behalf, only as needed to run the site:
- netcup GmbH (Germany) hosts our server. The server is located in the United States (Manassas, Virginia).
- Cloudflare, Inc. (United States) delivers the site, protects it from attacks and provides its HTTPS connection. Every request passes through Cloudflare.
- Google LLC (United States), only if you choose "Continue with Google", for the sign-in itself.
Some of these providers are in the United States. Transfers are covered by the EU–US Data Privacy Framework where the provider is certified, and otherwise by the European Commission's Standard Contractual Clauses.
We may disclose data if the law requires it, for example in response to a valid court order.
How long we keep it
- Account and activity data: while your account exists. After you ask us to delete it, we delete it within 30 days.
- Published files: until you or we remove them. Removed files can stay in backups for up to 14 days.
- Server logs: 14 days. Backups: 14 days.
- Daily visitor codes and search statistics: up to 24 months, then deleted or aggregated.
- Reports and copyright notices: up to 3 years, to handle repeat infringements and legal claims.
Your rights
Depending on where you live (for example under the GDPR in the EU and UK, or under US state privacy laws such as the CCPA), you can:
- get a copy of your data, or have it exported in a common format;
- correct it (you can change your name on the Account page yourself);
- delete your account and data;
- object to processing based on legitimate interest, or restrict it;
- complain to a data protection authority in your country.
To use any of these rights, email [email protected] from the address of your account. We answer within 30 days and do not charge for it. We will never treat you differently for using your rights.
Children
DXF World is not directed at children under 16, and you must be 16 or older to create an account. If you believe a child has given us personal data, write to us and we will delete it.
Security
The site works only over HTTPS. Passwords are hashed, the sign-in cookie cannot be read by scripts, downloads and uploads are stored outside the public part of the server, the server accepts administrative access only with a cryptographic key, and its software is updated automatically. No system is perfectly secure, but if a breach affects your data we will tell you and the authorities as the law requires.
Changes
If we change this policy, we update the date at the top. If a change materially affects how we use your data, we will also announce it on the site or by email before it takes effect.