Privacy Policy

Account information: your name, email address, password (stored only as a bcrypt hash), two-factor settings, organization name and role, preferences such as language and theme, and the date you accepted the Terms. If you sign in with Google, we receive your name, email address, and Google account identifier from Google and nothing else.

Project content: everything you create or upload in a workspace, including schematics, PCB layouts, symbol and footprint libraries, bills of materials, design documents, imported files from other EDA tools, manufacturing outputs, comments, reviews, version history, and your conversations with Resin AI.

Usage and diagnostics: which features you use and when (for example that a project was opened or a checkout started), your browser and operating system, IP address, and error reports. Product events are stored in Resin's own databases hosted on Railway (PostgreSQL and ClickHouse); they contain feature names and outcomes, never design coordinates, net names, file names, or free-form text. On the public site, Resin counts page views by page and by where the visit came from: the referring site's domain and any campaign tags in the link (utm_source, utm_medium, utm_campaign). These counts are anonymous: they are stored without a cookie, an IP address, or any identifier, so they cannot be tied to a person. Server logs record requests with a correlation ID. There are no third-party analytics or advertising scripts on the site or in the app.

Billing information: your plan, paid-user count, invoices, and payment status. Card details are entered on Stripe's hosted checkout and never reach Resin's servers; we store only the Stripe customer and subscription identifiers.

Support and security records: emails you send us, in-app support requests, and a log of sign-in attempts (email address, IP address, time, and outcome) kept to detect account abuse.

We use this information to run the service: authenticate you, store and render your projects, let collaborators work together, answer Resin AI requests, generate exports, bill your workspace, send transactional email (verification, invitations, receipts, security notices), respond to support, and detect abuse. We also use it to find and fix bugs and to see which parts of the product need work.

We may use aggregated or de-identified usage data, such as how many boards were routed last month, to measure product health. We do not sell personal information, do not share it with data brokers or advertisers, and do not use it for advertising.

When you use Resin AI, your messages and the parts of the open project needed to answer them (the design document, component and net lists, schematic and board content, and excerpts of component datasheets) are sent to a model provider: Anthropic by default, or OpenAI. When Resin reads a datasheet or generates a symbol from one, the datasheet and the question asked about it may be read by Google's Gemini. The provider returns a response, and any change the AI makes is written into your project as an ordinary edit that you can review and undo.

Resin does not train models on your data. Resin uses Anthropic and OpenAI for Resin AI and Google's Gemini for datasheets, and OpenAI requests are sent with storage disabled. We keep a per-request usage record (operation, model, duration, credits consumed) for metering and reliability, and are rolling out its automatic deletion after 180 days; that record does not contain the text of your prompts or the AI's output. The conversation itself is stored with the project until the project or the account is deleted.

Do not submit information you are not allowed to share, such as third-party confidential material or export-controlled designs, unless your agreements permit it. Part numbers and search terms from part searches you run are sent to the part-data providers listed below; datasheets are fetched from the manufacturer or distributor that publishes them.

We use a small number of service providers (sub-processors) to run Resin. Each one receives only the data needed for its job. The complete list, grouped by what each provider receives, is:

Railway hosts the application, the API, the PostgreSQL database, and the ClickHouse analytics store, in the United States, and so holds your account and project data. Anthropic and OpenAI provide the Resin AI models and receive your messages, design content, and datasheet pages as described in the Resin AI section; OpenAI requests are sent with storage disabled. Google provides Gemini, which may read a datasheet, with the part number and the question asked about it, when Resin reads a datasheet or generates a symbol from one, and Google Sign-In for accounts that choose it. Stripe handles checkout, invoices, and payment records. Resend delivers transactional email and receives your email address and the message content. Part-data providers receive only part numbers and search terms: DigiKey, JLCPCB, LCSC (including its EasyEDA part service), Octopart (Nexar), SamacSys, and You.com; public datasheets are downloaded from the manufacturer or distributor that publishes them, such as Mouser. Have I Been Pwned receives the first five characters of a new password's SHA-1 hash, never the password or your email address, to check it against known breaches. Slack receives an internal notification of each new sign-up (name, email address, and workspace name) and operations alerts that carry internal identifiers only. Where it is configured, S3-compatible object storage may hold the manufacturing packages you generate and database backups. We plan to add Sentry for error monitoring; it will receive error reports scrubbed of passwords, tokens, cookies, and IP addresses, and only after the notice described here. This list is kept current on our security page at resineda.com/security. We announce changes by email to workspace Admins 30 days before a new provider starts receiving data.

We will disclose information if the law requires it, to protect the rights and safety of Resin, our users, or others, or as part of a merger, acquisition, or sale of the company, in which case this policy will continue to apply to the transferred data.

People in your workspace can see your name, email address, and profile, plus the project content, comments, version history, presence, and edits their role allows. Viewers can read, comment, and export; Designers, Leads, and Admins can edit.

Workspace Admins manage members, roles, billing, and workspace settings, and can delete the organization, which erases everything in it after a 30-day grace period. If you were invited into an organization's workspace, that organization's Admins control the projects in it.

All traffic to resineda.com and the API is encrypted in transit with HTTPS. Passwords are hashed with bcrypt. Two-factor authentication (TOTP) is available to every account, with encrypted secrets and hashed backup codes. Sessions use short-lived tokens with an HttpOnly, Secure cookie for refresh. Sign-in is rate limited and every attempt is logged. More detail, including every provider that processes your data, is on the security page.

No online service can guarantee absolute security. If we learn of a breach affecting your data, we will tell you by email without undue delay and within 72 hours of confirming an incident that affects your data, and explain what happened and what we are doing about it. If you find a security problem, email hello@resineda.com; we aim to acknowledge reports within 2 business days.

Account and project data are kept for as long as your account or organization exists. When a paid plan ends, your projects remain available to view and export; they are not deleted because a subscription lapsed.

We are rolling out automated deletion so that product analytics events are kept for no more than 400 days and AI usage records for no more than 180 days. Temporary export bundles are removed 24 hours after they are generated. Projects you move to the trash can be restored for 30 days; after that they may be permanently deleted. Sign-in attempt records (email address, IP address, time, and outcome) are kept for one year. Security audit records, which include the email address and IP address of the person who acted, are kept for seven years, including after the account is closed. Server logs are kept only as long as needed for debugging. Invoices and payment records stay with Stripe for as long as tax and accounting law requires.

You can delete your account, or an organization you administer, from Settings at any time without contacting us. Deleting an organization archives its workspace for a 30-day grace period, during which the organization's owner can restore it. After that, Resin permanently erases the workspace's projects, files, repositories, library content, conversations with Resin AI, and generated artifacts. Closing your account removes your identity (your name, email address, and sign-in details) and, if you choose, erases the workspaces you solely own in the same way; projects in workspaces you share stay with your teammates. A record that the deletion happened is kept in the audit log, and backup copies expire within 89 days. Our hosting provider takes daily database snapshots kept for 6 days, weekly snapshots kept for 27 days, and monthly snapshots kept for 89 days, so every backup copy expires within 89 days. We are establishing regular restore tests; results are available on request.

In the product you can update your profile, change your password, turn two-factor authentication on or off, export any project in full (KiCad or Altium files plus manufacturing outputs), leave a workspace, and delete your account.

Depending on where you live, you may also have the right to access, correct, port, restrict, or object to processing of your personal information, and to complain to a data protection authority. Email hello@resineda.com from the address on your account and we will respond. We may need to verify your identity, and some requests involving an organization's workspace must come from one of its Admins.

Resin sets a session cookie to keep you signed in and stores preferences such as theme, language, and unsaved drafts in your browser's local storage. When you first arrive on the site, your browser also keeps a short note in local storage of where you came from: the referring site's domain, any campaign tags in the link, whether it was a referral link, the first page you saw, and when. The note is kept for up to 30 days. It is sent to Resin only when you sign up or sign in with Google, and it is stored, with your account, only when that creates the account, so we know which channels bring people to Resin. After you sign up or sign in with Google, the note is deleted from your browser; otherwise it expires on its own. If your browser sends Global Privacy Control or Do Not Track, the note is not kept (the anonymous page counts are still recorded). We do not set advertising or third-party tracking cookies, so there is no cookie banner. Clearing site data signs you out and discards local drafts that have not been saved to the server.

Resin is hosted in the United States, and our providers process data in the United States and in the other locations where they operate. If you use Resin from elsewhere, your information is transferred to and processed in those locations, which may have different data protection laws than your own. Where the law requires a transfer mechanism, we rely on our providers' standard contractual terms.

We will update this policy as the product changes, for example when a provider is added. The date at the top shows the current version. For material changes we will tell you in the product or by email before they take effect.