Privacy Policy

Last updated: 24 October 2026 · version 2026-10-24

Flip Kitchen AI ("Flip Kitchen", "we", "us") is a free kitchen design tool operated from Canada — designing costs nothing; paid extras only improve the experience. This policy explains what information the site collects, why, where it is stored, and what control you have over it. We have tried to describe what the software actually does rather than reserve every right a lawyer could imagine.

If you only want the short version: the design tool needs a free sign-in (Google, Apple, a code sent to your email, or a guest session that lives on this device for 7 days); your saved designs are private unless you bring someone into one, send someone its share link (to look at, not to change) or publish it; we keep a copy of the images you render so our team can improve image quality — staff-only, never published or sold, and you can turn it off on the line under any render; and you can get a copy of your data or delete the whole account whenever you want.

1. Information we collect

Account information

Using the design tool requires an account — either a Google sign-in (or Sign in with Apple in the app) or a guest session. Google gives us your account identifier, email address, display name and profile picture, and we never see or store your password. A guest session gives us nothing about you: it is a random identifier plus a secret stored in this browser, created after a short human check (Cloudflare Turnstile) and kept for 7 days after your last visit. In the iOS app the human check is Apple's DeviceCheck instead of Turnstile, and the secret is kept in the device's Keychain rather than a browser: DeviceCheck only confirms that the request comes from a genuine Apple device, and the one thing it keeps for us is a pair of on/off flags Apple holds against that device, which we use to count how many guest sessions it has started this month — we never receive or store a device identifier. Either way, everything a guest saves is deleted with it unless you sign in and keep it. The rest of the site — the home page, the guides, the Learn and Spotlight articles, the showroom — stays open to read with no account.

We ask you to sign in for two honest reasons rather than one: your designs, quotes and renders have to belong to someone in order to come back to you on another device; and the 3D model library and catalogue are the part of this product most worth copying, so we do not serve them to anonymous automated traffic.

Your acceptance of these documents

The first time you sign in, the designer shows you a summary of this policy and the Terms of Use and asks you to accept before you start. We ask once: later revisions do not interrupt you to ask again (see “Changes” at the end). We record that you accepted: which version, the date, your account email, a shortened description of the browser you used, and the network portion of your IP address (for example 203.0.113.0/24, not your full address). That record exists so we can show, if we are ever asked, that you were told what we do with your data. It is deleted with your account.

Design data

When you save a design, we store the design itself: room dimensions, walls, cabinets and SKUs, colours, countertops, appliances, notes and any name you give it. If you use the room-scanning feature, the resulting floor plan measurements are part of that design data. Saved designs are private to your account. The only people who can open one are you, the people you invite into it, a designer or installer you hired through our Community for that project, and Flip Kitchen sales staff, who can open any design to help a customer with it — and anyone at all, if you publish it to the Community gallery yourself. Anyone you send a design's share link to can also look at it — the plan, the elevations, the countertop page and 3D, with measuring and comments — but cannot change it: the link carries a random code instead of the design's ID, leaves out the customer notes and price settings kept with the design, and stops working the moment you make a new one. Designs are not sold or used to train third-party AI models. What the people in a design can see of each other is described under “Designing together” below.

Render Studio images

Render Studio sends a screenshot of your 3D kitchen, plus the design settings behind it (door colour, cabinet layout summaries, and similar), to an AI image provider to produce a photorealistic render. That transfer is necessary to generate the image you asked for.

Separately, we keep a copy of your renders and their settings so our team can review real output and improve image quality. This is on by default. We tell you about it the first time you open Render Studio, and the current state is always shown as a line directly under the render, which you can click at any time to turn it off. Your choice is recorded against your account, not just in that browser, so it follows you to another device and survives clearing your browser data — and so that we can show what you chose if it is ever questioned. While it is on, the render, a thumbnail and the design settings are stored in our archive; once you turn it off, nothing further is kept. Archived renders are only viewed by Flip Kitchen staff, and may be used to evaluate and improve our own rendering pipeline — including as training material for it. They are never published, sold, shown to other users, or handed to a third party for training.

3D Photos (the Blender renders you take with the camera button) are covered by the same setting: while it is on, a reduced-size copy goes into the same staff-only archive, and turning sharing off stops that too. Separately from the archive, the full-resolution image goes into your Album. On a free account, and for guests, it is kept there for about two hours so you can download it, and is then deleted. With a membership, or a Studio or sales account, it is kept in your Album for as long as that account is active — it is not deleted for age — and, if a membership ends, for at least 180 days after it ended, after which it may be deleted automatically. On a Designer account it is kept for 180 days after it was made (photos made before 19 October 2026 stay until you delete them). In its last 60 days your Album shows the date it will be deleted; download it, or move it to Google Drive, to keep it longer; those photos count against your account's storage space, and once that space is 95% full new renders and uploads are paused until you make room. A membership or account type lapsing does not, by itself, delete the photos it kept.

Google Drive (optional)

Photo Studio can save your renders into your own Google Drive, and with a membership, or a Designer, Studio or sales account, you can also move photos from your Album and whole designs there. Nothing happens until you press Link Google Drive and approve it in Google's own window, and nothing is moved until you choose to move it; guest sessions cannot link.

• What we can access: only the files and folders Flip Kitchen creates in your Drive (Google calls this permission drive.file). We cannot see, open or list anything else in your Drive.
• What we store: an encrypted refresh token tied to your Flip Kitchen account — the credential that lets us ask Google for short-lived access on your behalf — plus which Google account you linked (its email address and Google identifier), the permission granted, and when you linked it. The short-lived access tokens (valid for about an hour) are never written to our database: our server keeps them in memory only, and your browser keeps the current one so it can save to your Drive.
• What it is used for: so your browser can save your Photo Studio renders into “Flip Kitchen / your design / Photo Studio” in your Drive, and show them back to you in Photo Studio next time; and, when you choose to move them, so your browser can copy photos from your Album, and designs (saved as a .flipkitchen.json file you can open again in the designer), into your Flip Kitchen folders there — after which we ask whether to delete our copy. The files go from your browser straight to Google; they do not pass through our servers. To draw the small previews, our server fetches the thumbnail of a render you saved from Google and passes it to your browser without keeping it.
• Nothing else: we do not use your Drive or anything in it for any other purpose. It is not sold, not shared, not used for advertising, and not used to train AI models.
• Unlinking: in Photo Studio, open the Drive panel and choose Unlink — or remove Flip Kitchen from your Google account at myaccount.google.com/permissions. Unlinking, or deleting your Flip Kitchen account, deletes the stored token. The files already saved in your Drive are yours and stay there until you delete them.

Messages and submissions

If you use the contact form, post in the community section, or submit a design question or problem report, we receive what you send us — including any screenshots automatically attached to a design question (top view, elevations and 3D views of the design you were working on). A design question is delivered into our own team workspace, which runs as a separate application of ours on the same hosting; it does not go to another company.

Messages between members — end-to-end encrypted (beta). On the website in Google Chrome — in Community → Messages and in the Chats panel on the left of the designer, which hold the same conversations — messages, photos, files, design cards and voice messages between members, in one-to-one chats and in groups, are encrypted on your device. Our iPhone and iPad app gets the same encryption in an app update that is still to come: until you have that update, messages you send from the app are not encrypted, and the app cannot read encrypted ones (see “Messages that are not encrypted” below). Your device makes its own keys and keeps the private part to itself (in the iPhone's Keychain, or in the browser's own storage); we only receive the public part, so we cannot read what you send — unless someone in the conversation reports it (see “Reporting a conversation” below). We hold the encrypted text and files for 30 days so they can be delivered, then delete them; the readable copy lives on the devices in the conversation. Translation into the reader's language happens on the reader's device (Apple's built-in translation on iPhone and iPad, Chrome's built-in translation on the website) and is not sent to us. We still see who is in a conversation, when messages are sent and how large they are, but not what they say. Encryption is a beta feature — see section 9 of the Terms.

Reporting a conversation. When you report a conversation, we receive the reason you chose, anything you wrote, who is in the conversation and its last 20 messages as our servers hold them. Because an end-to-end encrypted conversation is unreadable to us, your device also sends us the last 20 messages in it that it can read — who sent each one, when, and its text; for a photo, file or voice message only that one was sent, not the file. We check that each of those messages really exists on our servers from that sender at that time, but we cannot check its text. A report is the one case where messages from an encrypted conversation reach us readable, and only the reporter's own device can send them. We use a report only to review it and act on it, keep it for 90 days (see section 5), and do not tell the people you reported.

Who can message you. One-to-one chats are between people who have each other in their contacts; adding a contact always needs the other person to accept. If you take someone out of your contacts (in our app, Block does this and leaves the conversation), neither of you can message or call the other one-to-one, add the other to a group or invite the other into a design until you are contacts again — and if one of you had invited the other into a design, the invited one leaves that design's chat, unless they can still work on the design.

Messages that are not encrypted. A conversation opened through a quote request stays unencrypted until you engage, so contact details can be checked; so does a conversation in which someone has not yet opened chat in Chrome or in the updated app (it says so at the top — text and voice messages are then sent unencrypted, and photos, files and design cards cannot be sent until they do; a design's own chat, described under “Designing together” below, is the exception: it is always encrypted, and someone in it who has not yet opened chat in Chrome or the updated app only sees the messages sent after they do); so do messages sent from a version of our app that does not have encryption yet; so do the lines our system adds to a conversation — an invitation into a design, and the record of a voice call (only its length and outcome); and so do messages sent before 14 October 2026. Those are stored with us so everyone in the conversation can read them, for about a year. When a reader has chosen to read messages in another language, the text of such a message — not your name or email address — is machine-translated by an AI model (a DeepSeek model, reached through OpenRouter; see the provider table below). The original is always kept, and the translation is cached for about six months. Community help posts are translated the same way for readers of another language. Whether a conversation is encrypted or not, you can delete a message you sent for everyone within an hour of sending it: it is replaced by a note that it was deleted, and our servers delete its photo, file or voice recording and the copy Emma received, if any.

Emma in Messages. Emma only receives what is sent to her: every message in a one-to-one chat with her, an @Emma message in a group, and a message you choose to quote when you ask her. Your device locks a separate copy of exactly those messages to Emma, so our servers can read them; she never receives the rest of a group's conversation. What she received and what she answered is kept for 30 days so she can follow the conversation. Those messages, the display names of the people who wrote them — never their email addresses — and the group's name are sent to the AI model the same way, only so she can write her reply; her reply is then encrypted to the people in the conversation like any other message. In a one-to-one chat with her she may also read your own Emma profile, the list of your saved designs and a summary of a saved design you ask her about, to tailor the answer; in a group she only uses your preferences to adjust how she answers and does not mention them. In a design's own chat she is a member from the start, and when the person asking her can open the design, a summary of the design's last saved version — its walls, cabinets, appliances, windows and doors, and colours — also goes to the AI model with the question.

Online and last seen. The last time you used Messages — which includes having the designer open in front of you while you are signed in, because it checks for new messages and calls — is shown to people who have you in their contacts, in one-to-one chats and small groups. You can turn this off with Show my last seen in Community → Messages, or in a conversation's menu in our app (the designer's Chats panel does not have this switch); if you do, you also stop seeing other people's.

We never send a voice message to an AI as audio; what can be translated is the written transcript that came with it. A transcript is made when you record: in our iPhone or iPad app by Apple's speech recognition, and in the designer's Chats panel by your browser's own speech service as you speak (in Chrome that is Google's). A voice message recorded in Community → Messages on the website has none. The transcript travels with the voice message — inside the encryption when the chat is encrypted.

“Need a human?” / “Talk to the team”. When you ask Emma for a person, we receive your question, the email address or phone number you leave so we can reply, and the recent part of your chat with Emma, so the team has the context. That request is filed in our internal Notion workspace (listed below) and kept there as a support record, the same way as contact-form messages. Because it is filed under the email or phone number you gave rather than under your account, deleting your account does not reach it on its own — email us and we will delete it.

FlipKitchen Support. Signed in, you can also message our team from FlipKitchen Support at the top of Contacts, in the designer and in Community. It is a one-to-one conversation in Messages with our team's account, which is shown to you only as FlipKitchen Support, so the rules above apply to it as to any other conversation: on the website it is end-to-end encrypted unless it says at the top that it is not encrypted yet (what you send from our app before its encryption update is not), and it is kept for the same time (see section 5). Our team reads it on its own devices. It has no voice calls, and Emma is not in it.

Designing together

A saved design can be worked on by more than one person at a time. You can invite people from your contacts into a design you own; a designer or installer you hired through our Community can open the project they were hired for; and Flip Kitchen sales staff can open any design to help a customer with it. When two or more of these people have the same design open, a live session starts. One person operates and the others watch.

• What the others in the design see of you, while you are in it: your account name — or the email address you signed in with, if your account has no name — and, for someone you invited, the name you saved them under in your contacts; the colour you are shown in; which view you are looking at, what you have selected and where your 3D camera is; and your mouse or pointer as you move it. None of this is kept once you leave (see section 5).
• Invitations. Inviting a contact sends them a line in your conversation in Messages, with a link to the design and its name, and a notification. Our system writes that line, so it is not end-to-end encrypted, even in an encrypted conversation. The link lets them in for 30 minutes; once they are in, it lasts while they stay.
• Talking while you design together. Each saved design can have its own chat in Messages, shown under This design at the top of the designer's Chats panel while the design is open, and it is always end-to-end encrypted (see “Messages between members” above). Nobody is added to it just by opening the design: one of the people who can work on the design starts it, and the others join only if they choose to, from the design in Chrome, signed in: its owner, a designer hired through our Community, our sales staff and the contacts the owner invited, without having to be each other's contacts (an installer, who can only look, cannot join). Emma is in it from the start (see “Emma in Messages” above). Anyone in it who does not have you in their contacts sees you by your Community name — the nickname you chose, or the one we make up for your account — and your part in the design (its owner, our sales staff, a hired designer, or invited), never by your email address, and you see anyone who is not in your contacts the same way. From the list of people in it you can ask any of them to be your contact; they see your email address in the request, and you see theirs only if they accept. Someone who joins sees only the messages sent after they joined. People stay in it, even once they can no longer open the design (when an invitation runs out, for example), until they leave or the design's owner removes them. Only the design's owner can add people to it: their own contacts, who then see the design's name and picture and what is said there but get no access to the design itself. When the owner and someone they invited or added stop being contacts — either of them takes the other out of their contacts — that person leaves the design's chat, unless they can still work on the design. An account that is deleted leaves every group it was in; what it wrote stays for the others. When you are not in a design's chat — because you left it, for example — the panel offers your own chats with the people in the design instead; to tell which of them are your contacts, the page asks our server, which answers only for people already in your own contacts. The chat each design had before 16 October 2026, which was not end-to-end encrypted, is shown read-only, folded, at the top of the design's chat when it is opened from the design, to whoever can work on the design now; what was written in it stays stored with the design — its latest 500 lines, until a year after the last one, and the recordings of its voice messages for 30 days — and is deleted with the design. Deleting the design also deletes the design's own chat, for everyone in it.
• Voice calls. A call in a design connects the browsers taking part directly, encrypted, with up to six people. We never record or store the audio. As with any internet call, the browsers in a call learn each other's network addresses in order to connect; when a direct connection is not possible, the audio is relayed through Cloudflare's relay service, which passes it on without being able to listen to it. The short-lived connection details are deleted within minutes. A one-to-one call from a chat in Messages — in our app, or on the website in Community → Messages or the designer's Chats panel — works the same way between the two devices: encrypted, direct when possible and otherwise through the same relay, never recorded. Our servers pass on its set-up messages, which expire within about two hours, and the conversation keeps a line with the call's length and outcome, or that it was missed. A call in a design is encrypted, but not end-to-end encrypted the way Messages are: the browsers in it do not yet check the set-up details our servers pass between them, so someone in control of our servers could, in principle, listen in. A one-to-one call between two Chrome browsers that both have encrypted chat set up is end-to-end encrypted: each device signs the keys of its connection with its chat key, and the other device checks that signature against that person's devices in your conversation, so set-up details changed on the way are caught and the call is hung up; the call shows End-to-end encrypted when that check passed. As with Messages, this relies on our servers listing each person's real devices. Our iPhone and iPad app signs and checks its one-to-one calls the same way from an app update that is still to come; until you have it, a one-to-one call with the app is encrypted but not checked this way. Mouse and pointer movements are passed between the people in a design through our servers and the same relay.
• Comments and the to-do list. Comments pinned to a design — text, a voice note or a screenshot of the spot — are stored with the design and visible to the people who can open it, including anyone the owner sends its share link to (they see names as community nicknames, not email addresses); they are not shown to visitors of a design you published. While you record a voice note, what you say is also typed into the comment — by your browser's own speech service where it has one (in Chrome that is Google's, in Safari Apple's), or by the speech recognition in our app. A comment's voice note and screenshot are kept for 14 days; its text stays. Deleting a comment hides it and deletes its own voice note and screenshot; its text is removed when the design is deleted.
• The design's photo album. Renders and photos added to a saved design are kept in its album, for the people who can open the design. On the website you find the ones you added under Load → Album, and you share a render with someone by sending it in a chat — right after a render, an open encrypted chat offers to send it, and nothing is sent unless you press Send. Each one counts against the storage space of the person who added it. With a free account a design's album holds up to 5 images — when it is full, new ones are refused rather than replacing older ones; otherwise it keeps the newest 300. 3D Tour videos are saved there too, for accounts that have storage space. Each image follows the Album rules of the person who added it: with a membership, or a Studio or sales account, it is kept while that account is active; otherwise it is kept for 180 days after it was added (images added before 19 October 2026 stay until they are deleted) and may then be deleted automatically. The person who added an image, or the design's owner, can delete it.
• What you write in someone else's design stays with that design, like a message in someone else's conversation: your comments there remain, under your name, until that design is deleted, and so do any lines and voice messages you wrote in its chat before 16 October 2026 (until the design is deleted or that chat expires) — deleting your own account does not remove them. What you send in a chat stays in that conversation like any other message (see “Messages between members” above).

Emails we send you

We send two kinds of email to the address on your account, both from noreply@flipkitchen.ca (a send-only address — write to info@flipkitchen.ca instead):

• Account emails — such as sign-in codes, the welcome email when you first sign in, replies to your messages, and Team Up match notices. These are part of running your account and are sent whatever you choose below.
• Product update emails — now and then, news about new features of Flip Kitchen and reminders about offers you already have with us (for example, welcome GH Coin you have not redeemed yet). You get these because you have an account; every one of them carries an Unsubscribe link that works without signing in, and your email app may also show its own unsubscribe button. You can switch them off or back on at any time in Settings → Privacy & data.

To send each email in the language you use the site in, we keep the display language you last chose (English, 中文 or Français) against your account. For product update emails we also keep whether you unsubscribed and when, and which ones we have already sent you, so nobody gets the same email twice. Every email names us and our mailing address: Flip Kitchen, Unit 4-250 Don Hillock Dr, Aurora, ON L4G 0G9, Canada.

To learn which product update emails are useful, each one contains a tiny invisible image and its links pass through flipkitchen.ca first. That tells us whether the email was opened, which links were clicked, on what kind of device (phone, tablet or computer) and whether the click reached our site; our email provider (Resend) also tells us whether it was delivered, bounced or reported as spam. We use this only to improve these emails, to stop emailing addresses that no longer work, and to stop emailing anyone who reports one as spam. It is kept for up to two years and deleted when you delete your account. Your email app can block the image by not loading pictures; account emails such as sign-in codes are not tracked.

Purchases

Pro membership and GH Coin are optional — a complete design costs nothing. If you do buy something, the payment itself is handled by PayPal on the website and by Apple in the app: card numbers and banking details never reach us. What we keep is the record we need to give you what you paid for — the transaction reference, what was bought, when it renews or expires, and your coin balance and its history.

The FlipKitchen iOS and Mac app

The app is the same account and the same design store as this site, with two things a browser cannot do. Camera and LiDAR: scanning a room runs entirely on your device — the camera feed is never uploaded, and what leaves the app is the measured floor plan (walls, openings, appliance positions), which becomes design data exactly like a design you drew by hand. Photos: if you photograph a kitchen for Modify Photo, that photo is sent to our AI provider to produce the edited image you asked for, and renders you choose to save are written to your photo library. The app asks for camera and photo access the first time it needs each, and both can be revoked in iOS Settings at any time.

Flea-market 3D scan: if you scan an item in 3D for a flea-market listing, the app uploads the photos it took while you walked around the item, where the phone was for each one, and the box you drew around the item. On iPhones and iPads with a LiDAR sensor (the Pro models) it also uploads the depth the sensor measured for each photo — how far each point in the picture was from the phone. These go to private storage that only our own computer reads, are used only to build the 3D model, and are deleted as soon as it is made, or as soon as making it fails; an upload you start but never finish is deleted after a day. What becomes public is the 3D model, cut down to the box you drew, and the listing photos you publish — the rest of the room you scanned in is never published.

Records we keep of what happened

Three things leave a record, kept in our file storage rather than the database, and none of them keeps the thing itself:

• Images the AI generated for you. We keep the date, the feature, the model, and a fingerprint of the image — a one-way checksum of the exact file we handed you. Not the picture. That fingerprint is what lets us confirm, later, whether a particular image came from us; it is also why we do not stamp a visible mark on your renders.
• Typed conversations with Emma, our assistant — what was asked and what it answered. This includes conversations from visitors who are not signed in: those are filed under a random number that identifies the browser, not you, and we keep them for a shorter time — about 90 days — precisely because there is no account that could ever ask us to delete them. Talking to Emma by voice is not recorded at all: the audio goes straight from your browser, or from the app, to the speech provider (Google's Gemini Live) and never reaches us, and we do not ask for a transcript of it.
• What our own staff do to accounts — adjusting a coin balance, locking an account, changing a membership, deleting a design. The staff member is named; the customer they acted on is stored as a one-way digest rather than an address, because this record exists to hold us accountable, not to be a second copy of our customer list.

Usage analytics

We record coarse usage events ourselves: page views, which buttons and catalogue items get clicked, saves and exports. A small script of ours posts them to our own server — there is no third-party tag in this part — and each event carries a random per-tab identifier that is discarded when you close the tab, the page path, and a short label for the thing acted on (a button name, a catalogue item, the visible text of what was clicked). Those rows land in the internal record listed under Notion in the provider table below.

How people move through the site. So we can see where the designer is hard to use — the step where people stop, the button that does not respond, the error just before someone leaves — a second small script of ours records, on our own website, the order in which you visit pages and use features. Each entry is a time, the page path (without anything after the ?, so no shared-link or project codes), and the name our code gives the button or control you used — never its visible text, nothing you type, and none of your design, customer or message content. It also notes which minutes you were active, that an error happened (the first words of the error message), the kind of device and browser, and roughly where you came from (for example “Google” or “email”, never the full address). So we can tell people apart from automated visitors and AI agents, it also counts how input arrives — for example how many clicks landed without the pointer travelling there first, how long a button was held down, whether a click hit the exact centre of a button, and whether text arrived without key presses — as counts only: it never records where you moved the pointer, which keys you pressed or what you typed. Visits that announce themselves as a crawler or an AI agent, and browsers that report being driven by automation software, are recorded the same way and labelled as such, so they are kept out of the counts of people. When those counts or labels show a program or AI agent operating the 2D / 3D designer or the 3D showroom and tours — which our Terms of Use do not allow — we block access automatically. The same happens when the Learn videos above the beginner level, which are for signed-in members, are fetched by software that identifies itself as a crawler, script or AI agent, by an account flagged that day as an AI agent in these counts, or several different ones within seconds (for that last check we keep, for under a minute, which of those videos one account — or, signed out, one network — opened, filed under a one-way hash). The visit's IP address, the random identifier this script keeps in your browser and, if you are signed in, your account go on a block list, together with the time, what it was flagged as and why, the page, the browser, the account email and the approximate location (city); a cookie holding only the block's code is set in that browser. While a block is in place the site shows a notice with that code instead of the page, and signing in, starting a guest session and playing or downloading the Learn videos are refused. If the same browser or account comes back from a new IP address, that address is added to the block. Our team is also sent an alert in our own messaging with the same details. A block lasts until we lift it — if you think it is a mistake, email us the code — and a lifted block is deleted 30 days later. Because a block has to survive the account being deleted, deleting your account removes your email from the block record but keeps the block; blocks that concern your account are listed in your data export. The IP address goes only into that alert and the block record, never into these entries; alerts are kept for up to a year, and the ones that name your account are deleted with it and listed in your data export. A random identifier kept in your browser's local storage groups one browser's entries together; while you are signed in, the entries are linked to your account, so we can see one person's path even across two devices. Our own team reads these in an internal daily summary. To help us read it, a summary of counts across everyone — how many people reached each step, which steps tend to follow which — may be passed to an AI model (Anthropic's Claude); one person's entries, their account or email never are. Individual entries are deleted after 14 days; after that only day-by-day totals with no person in them are kept, for 60 days. They are deleted with your account, included in your data export, never sold, and never used for advertising. This script does not run inside our iOS app, on our staff pages, or at all if your browser sends a Global Privacy Control or Do Not Track signal — and you can object at any time by emailing us.

Measurement by our host. Two small scripts from Vercel, who host the site, also run on every page: Vercel Web Analytics, which counts page views, and Vercel Speed Insights, which measures how quickly the page loaded and responded for you. Both are served from our own domain, neither of them sets a cookie, and what they record is coarse and technical — the page and its route, the site you came from, approximate location worked out from the request (country, and no finer than city), browser, operating system and device type, connection speed, and page-timing figures. Vercel identifies a visit by a hash it derives from the request rather than by storing your IP address, and discards that identity after 24 hours, so what comes back to us is counts and averages rather than a trail of one person. We do not get an individual-level export of either, and neither feeds anything else we do.

We do not use advertising cookies, we do not build cross-site profiles, and we do not sell any of this.

Local storage on your device

The designer keeps a lot of state in your own browser — your current design, preferences, language, keyboard shortcuts, your sign-in session, recent Render Studio images and, if you use Chats, this browser's encryption keys and the messages it has unlocked. This lives in your browser's local storage and IndexedDB, not on our servers, and clearing your browser data clears it. If you turn on "Auto-save to folder", renders are written as ordinary image files into a folder on your computer that you pick; we cannot read that folder or anything else on your device.

Design check, the button on the 2D tool strip that looks a design over for problems, runs entirely in your browser and sends nothing to us; its results are not saved with the design and do not go into an exported PDF. The only thing it keeps is a note, in that tab's session storage, of the findings you chose to go past with Start anyway before a 3D Tour, and that note is gone when you close the tab.

Cookies

We set a small number of first-party cookies and no advertising or cross-site tracking cookies at all. One remembers that your browser may load our 3D model files once you have signed in. One is set if you use Emma without signing in — by voice or by typing — and holds nothing but a random number, so that the free allowance we give visitors each day cannot simply be taken again and again from the same browser. What we keep on our side is a one-way hash of that number and a one-way hash of your IP address, both deleted within 48 hours; separately, the short-term counter that stops one visitor flooding the service holds the address itself for up to an hour. That same random number, hashed again and differently, is also what files a signed-out conversation with Emma under one browser rather than in a common pile — it is how the record above is organised, and it is linked to nothing else we hold. Page scripts cannot read either of those two cookies, and clearing your browser data clears them. If our systems block a browser for AI or automated use (see “Usage analytics”), a cookie named fk_ban holds the block's code so the block is recognised on the next visit; it is only sent to our own server, page scripts cannot read it, and it does nothing once the block is lifted.

The home page sets one more, fk_ab. We are running two versions of the home page against each other to see which one people get on better with, and this cookie holds nothing but which of the two you were shown — the single word showroom or daylight. It exists so that you keep getting the same home page instead of a different one on every visit, which would be worse for you and would make the comparison meaningless. It lasts 180 days, carries no account and nothing else we hold, and goes to no one but us; the same word is also kept in your browser's own storage. Clear your browser data and it goes with it — you are simply assigned again on the next visit.

2. Why we use it

• To run the designer and give you back the design, quote or render you asked for.
• To save and reload your work, and to keep you signed in for a session.
• To answer your messages, quotes and support questions.
• To email you about new features and about offers you have with us — until you unsubscribe.
• To understand which features get used, so we know what to improve.
• To improve render quality — only using renders you have agreed to share.
• To keep the service working and to prevent abuse.

3. Service providers

Flip Kitchen is a small operation built on third-party infrastructure. These providers process data on our behalf:

Each provider listed above may use your information only to provide its service to us, and is bound — by its contract or data-processing terms with us, or, for a model reached through OpenRouter, by OpenRouter's terms with that model's provider — to give it the same or equal protection as this policy does.

If you use an export feature to send a design to your own Google Drive or Notion workspace, that transfer happens because you asked for it and lands in an account you control.

Because these providers operate in the United States and elsewhere, your information may be processed outside Canada and may be subject to the laws of those countries.

4. What we do not do

• We do not sell your personal information.
• We do not publish your saved designs or show them to other users — the exceptions are the people you choose to invite into a design or hire through our Community, anyone you send a design's share link to (they can look at it, not change it), and anyone, if you publish a design to the gallery yourself. Our sales staff can also open any design, so that they can help with it; they are our staff, not other users. People the design's owner adds to its chat in Messages see the design's name and picture there, but that gives them no access to the design itself.
• We do not use your designs or renders to train third-party AI models.
• We do not run advertising trackers or share data with ad networks.

5. How long we keep things

• Saved designs: until you delete them or ask us to close your account. When you delete your account, your saved designs and cloud projects are kept for 30 days in case the deletion was a mistake, then erased for good.
• Backups of saved designs: every night we copy saved designs and cloud projects to backup storage that we own and keep in Canada, and keep each copy for 30 days. So something you delete is gone from our backups within 30 days too.
• Guest sessions and everything saved under them: deleted 7 days after your last visit, unless you sign in first — signing in keeps the designs and turns the guest into your account. A guest can keep at most 2 saved designs.
• Sign-in sessions: on the browser you signed in with, renewed each time you use the site and ended after 30 days without a visit. Guest sessions are shorter.
• Shared renders: kept while they are useful for improving the product; you can ask us to delete yours at any time.
• 3D Photos, Room Rendering sets and 3D Tours (your Album): on a free account, or as a guest, a 3D Photo is kept for about two hours, then deleted — download the ones you want to keep, or link Google Drive to have Photo Studio save them there. With a membership, or a Studio or sales account, everything in your Album is kept while that account is active — nothing is deleted for age; only your storage space limits it — and when a membership ends, it is kept for at least 180 days after it ended and may then be deleted automatically. On a Designer account, everything saved to your Album from 19 October 2026 — and on a free account, paid Room Rendering sets and 3D Tours saved from that date — is kept for 180 days after it was made and may then be deleted automatically; things saved before then stay until you delete them. In the last 60 days before something is deleted, your Album shows the date on it. Download things, or move them to Google Drive (with a membership, or a Designer, Studio or sales account), to keep them longer. Images generated by our own staff accounts are kept as training material. Deleting your account deletes all of it.
• Flea-market 3D scans: the photos, phone positions and LiDAR depth you upload are deleted as soon as the 3D model is made (or fails), and an unfinished upload after a day. The 3D model and the listing photos stay on the listing until you remove it or delete your account.
• Google Drive link: the encrypted token is kept until you unlink Google Drive or delete your account, and is deleted by either. Renders saved in your Drive stay in your Drive, under your control.
• Contact messages and support tickets: kept as business records. If you delete your account, your contact messages go with it, and your support tickets keep only their text — your name and any screenshots you attached are removed, so the defect history other people worked on survives without you in it.
• “Need a human?” requests: kept as support records in our Notion workspace, like contact messages. They are filed under the email or phone number you left, not your account, so email us to have yours deleted.
• Records of generated images and Emma conversations: about 13 months, and deleted with your account. Conversations from visitors who were not signed in are kept about 90 days and then deleted; no account is attached to them, which is also why we cannot pick your rows out of them on request.
• Reports and suspensions: a report — the reason, who reported it, who was in the conversation, its last 20 messages as our servers held them and, for an encrypted conversation, the messages the reporter's device sent with it — 90 days; an account suspension for its term, or until we lift it. Both are kept if an account in them is deleted, so neither can be wiped by deleting the account. When a report comes in we email our own team its number and reason only — no message content and no member's email.
• Records of staff actions: about 13 months. These outlive a deleted account, holding only the one-way digest described above.
• Designer command log: what you typed at the design assistant is kept for 180 days and then deleted. It carries no account and only a one-way hash of your address, which is also why we cannot pick your rows out of it on request.
• Usage events: kept in aggregate reporting; individual rows are not tied to a named person.
• How you moved through the site (the page-and-feature trail described under “Usage analytics”): 14 days, and deleted with your account; after that, day-by-day totals with no person in them for 60 days.
• Blocks for AI or automated use (described under “Usage analytics”): until we lift the block, then 30 days. Deleting the account removes the email from the record but keeps the block, so it cannot be sidestepped by signing up again; the fk_ban cookie holding the block's code lasts 400 days, and clearing your browser data clears it.
• Home-page comparison: the fk_ab cookie lasts 180 days in your browser, and clearing your browser data ends it sooner.
• Your acceptance of this policy: for as long as the account exists, then deleted with it.
• Your email choices: your display language, whether you unsubscribed from product update emails, and which ones we sent you — for as long as the account exists, then deleted with it.
• Messages you send other members, or FlipKitchen Support: end-to-end encrypted messages, with their photos, files and voice messages, 30 days on our servers, then deleted — after that they exist only on the devices in the conversation. Messages that are not encrypted: about a year from the last message in that conversation, and only the latest 300 in each conversation; the recordings of their voice messages, 30 days. What Emma received and answered: 30 days. Translations made on our side: about six months. The set-up messages of a one-to-one voice call: about two hours.
• Designing together: the live working copy of a design, including changes nobody saved, 7 days after the last change; who is in a design, a minute or so after they leave; mouse and pointer positions, about 10 minutes; the connection details of a call in a design, about 2 minutes; an invitation, 2 days (the line it sent in Messages follows Messages); the design chat used before 16 October 2026 (now shown read-only at the top of the design's own chat), its latest 500 messages, until a year after the last one (the recordings of its voice messages, 30 days); comments, for as long as the design exists (their voice notes and screenshots, 14 days); the design's photo album, for as long as the design exists — each picture counts against the storage of whoever made it and follows the same rules as their Album: kept while their membership, or Studio or sales account, is active, and otherwise for 180 days after it was added (pictures added before 19 October 2026 stay until they are deleted), after which it may be deleted automatically. Translations of those chat lines and of comments are cached for about six months. Deleting the design deletes all of it, and the design's own chat in Messages with it, for everyone in that chat; while the design exists, that chat follows the rules for messages above.
• In-app notifications: about six months.
• Purchase and coin records: kept as financial records for as long as tax and accounting rules require.

6. Your choices and rights

• Render sharing: turn it on or off any time from the line under the render in Render Studio.
• Product update emails: click Unsubscribe at the bottom of any of them, or switch them off in Settings → Privacy & data; switch them back on in the same place. Account emails such as sign-in codes still arrive.
• AI features: in the iOS app you are asked before your data is first sent to an AI provider, and told which one and what goes to it. You can withdraw that permission at any time in Settings › AI features & data sharing; afterwards the app's AI features stop sending your data, and everything else in the app keeps working.
• Delete a design: from your saved designs or projects list. This also deletes everything that belongs to it: its comments with their voice notes and screenshots, its photo album, its live-session data and invitations, the chat it had before 16 October 2026 with its voice messages, the cached translations of that chat and of its comments, and the design's own chat in Messages, for everyone in it. Your other conversations in Messages are not deleted with it.
• Delete your account: on the website, go to Settings → Privacy & data → Delete my account; in the app it is Settings → Delete account. Either way you type DELETE to confirm, and it happens immediately — you do not have to ask us and wait. This erases the account itself along with your saved designs, cloud projects (each with its comments, photo album and any design chat from before 16 October 2026), renders, archived photos, records of the images we generated for you, your conversations with Emma and your sign-in sessions — on our servers and on the device. Your saved designs and cloud projects are the one exception: they are kept for 30 days in case the deletion was a mistake — email us within that time and we can put them back — and then erased for good, including from our nightly backups. Your contact messages go too, and your support tickets keep their text with your name and attachments stripped out. Questions and answers you posted in the community stay up with your name removed, so replies other people wrote are not destroyed with them.
• …including copies other people hold. Your details do not only sit in your own records. A designer who made a kitchen for you has your address on their copy of the project; anyone who added you to their address book has your name and email in it; a Team Up room carries your display name on every message you sent. Deleting your account clears you out of those too — the designer keeps the design and the quote, and loses your contact details; the room keeps the conversation, and loses your name; every group in Messages you were in loses you as a member and keeps what you wrote for the others. We tell you how many such records were cleared when it is done. Can't sign in, or would rather we did it? Email us and we will do the same thing.
• Get a copy of your data: email us and ask, and we will send it to you — within 30 days, at no charge. You get a machine-readable file containing your account record, your saved designs and projects, your preferences, your coin history, your community posts and your acceptance record — everything we hold that is about you.
• Access, correction, deletion: email us and we will retrieve, fix, or delete the information we hold about you.
• Local data: clearing your browser's site data removes everything the designer kept on your device.

Under Canadian privacy law (PIPEDA) and comparable rules elsewhere, you have the right to access and correct your personal information and to withdraw consent. We will act on a request within 30 days, and we do not charge for it.

7. If you are in the European Union or the United Kingdom

The GDPR (and the UK GDPR) give you a specific set of rights, and require us to say plainly why we are allowed to handle your information at all. Our legal bases are:

• Performance of a contract (Art. 6(1)(b)) — running the designer, saving your work, producing your quotes and renders, keeping you signed in. This is most of what we do, and it is not something you opt into separately: it is the service you asked for.
• Consent (Art. 6(1)(a)) — only for genuinely optional things, and only the ones we ask about explicitly: keeping a copy of your renders so we can improve image quality, and sending you push notifications. You can withdraw either at any time without losing anything else, and withdrawing does not undo what was lawful before you did.
• Legitimate interests (Art. 6(1)(f)) — keeping the service up and preventing abuse, understanding which features get used through coarse, non-identifying event counts and page-speed measurement, seeing where people get stuck in the designer from the order in which they used it, and telling people apart from automated visitors and AI agents in it, with an alert to our team and an automatic block when a program or AI agent operates the designer, the 3D showroom or the Learn videos (kept 14 days, see “Usage analytics” — you can object by email, or with your browser's Global Privacy Control / Do Not Track setting), comparing two versions of the home page as described under Cookies, emailing account holders about new features of the service they already use (which you can stop from any such email), and protecting our catalogue and 3D models from bulk automated copying. We have weighed these against your interests; none of them involve profiling you or building a picture of you across other websites.

Your rights: access, rectification, erasure, restriction, portability, objection (including objection to anything we do on the legitimate-interest basis above), and withdrawal of consent. Email info@flipkitchen.ca and we will answer within one month. There is no automated decision-making that produces legal or similarly significant effects about you.

Transfers out of the EEA and UK. Flip Kitchen is operated from Canada and its infrastructure is mostly in the United States, so your information is transferred out of the EEA. Canada holds an adequacy decision from the European Commission for commercial organisations; transfers to our United States providers rest on the Standard Contractual Clauses contained in those providers' data processing terms, which apply to our use of them.

If you think we have got this wrong, you can complain to your national data protection authority (in the UK, the Information Commissioner's Office). We would rather you told us first so we can fix it, but that right is yours regardless.

We have not appointed an EU representative under Art. 27, and the reason is that we do not offer this service in the EU: we price in Canadian dollars, we supply and install in Ontario, and the French on this site is for Quebec. The site loads anywhere, which is not the same thing. If you are in the EU and have used it anyway, the rights above are still yours and the email address above still reaches the person who decides — we would simply rather say what our position is than leave you to guess it.

8. AI-generated images and AI assistance

Renders, photo edits and redesign images produced by Flip Kitchen are generated by AI. They are interpretations of your design, not photographs of a real kitchen, and we say so wherever they are produced. We deliberately do not burn a visible watermark into your images — they are yours to use — and instead keep a fingerprint of each one, as described above, so the question "did Flip Kitchen generate this?" still has an answer. Emma, the chat assistant, is also an AI — you are not talking to a person, and it can be wrong. Nothing either of them produces is a construction document; anything that matters should be checked by a human before you order or build.

9. Security

Traffic is encrypted in transit. Admin tools are restricted to our own accounts and re-checked on the server, not just hidden in the interface. Render archive uploads and downloads use short-lived signed links rather than a public bucket. No system is perfect, and we do not claim otherwise — if a breach affects you, we will tell you.

10. Children

Flip Kitchen is meant for adult homeowners and trade professionals. You must be at least 18 years old to use it, including the iOS app, and it is not directed at anyone under 18. We do not knowingly collect information from people under 18; if you believe someone under 18 has given us information, contact us and we will delete it.

11. Changes

If we change this policy we will update the date and version above. We ask you to read and accept it once — when you first sign in — and we do not ask again every time the policy is revised. Most revisions are operational changes on our side (how something is stored, which provider runs a piece of the service) that do not change what you get from this site, and interrupting your work to re-accept each one would only teach everyone to click through without reading. The version you accepted is recorded against your account and shown on your Settings page, and the version in force is always the one on this page.

12. Contact

Questions, or a request about your data: info@flipkitchen.ca.