Privacy Policy — Fusion 360 Add-ins

• Autodesk user ID (app.userId) — your Autodesk account’s internal identifier.
• Autodesk account email (app.currentUser.email).
• Application ID — the Add-in’s Autodesk App Store identifier.
• Activation passcode — only if you voluntarily type one into the Add-in’s “Info” dialog.
• Licensing abuse counters — for a validly formed access or manual grant check, our server may derive up to two project-scoped SHA-256 document keys: one from the connection IP address, and one from the Autodesk user ID plus Application ID pair. Each counter record contains only the 10-minute and 24-hour window start times and counts, plus its last-update time. It does not contain the raw IP address or the raw combined user-ID/Application-ID value. The account and application identifiers may still appear separately in the licensing records described above.
• Update check (add-ins with the update feature; currently Steel Frame & Weldments and Auto Backup & Export) — the Application ID and your platform (Windows or macOS) only; no account data is sent when the Add-in looks for a newer build.
• Download request — only when you click “Download latest version” in the Add-in’s “Info” dialog, or use the download form on this website: your Autodesk user ID and account email (website: the email you type), the Application ID, the platform, and your browser’s user-agent string when the file is fetched.

Hole Series & Fasteners uses this same licensing flow: Autodesk user ID, account email and Application ID (plus an activation passcode only if you enter one) are processed as described here. Its feature specifications and model attributes remain inside your Fusion design (including its normal Autodesk cloud versions) and are not sent to us or our licensing service.

Sheet Metal & Press Brake uses the same licensing flow. Its bend sheets, flat DXFs, bend-program and Punch Map CSVs and other exports are written only to the folder you choose, and its press brake library, form tool library and test-bend calibrations stay on your computer. None of them, and no model geometry, is sent to us or our licensing service.

Auto Backup & Export uses the same licensing flow. It copies the designs and files your Autodesk account can open to the backup folder you choose, on your own computer or storage; it does not send designs, file contents, file or project names, or backup paths to us or our licensing service.

We do NOT collect machine or hardware IDs, retain your raw IP address (beyond its inherent processing while an HTTPS request is received), file names or paths, or the content of your designs/models. The licensing, feedback, and website-download controls use one-way hashes of the IP address for rate limiting as described in this policy.

• Verify your purchase/entitlement through Autodesk’s official Entitlement service (apps.autodesk.com).
• Record activations (which Autodesk account activated which app) for license bookkeeping.
• Grant a 3-day free trial, validate an activation passcode, or apply a manual access grant.
• Tell you when a newer build is available and deliver it to licensed users (Autodesk Entitlement, or an access grant on our records) through a short-lived (15-minute) download link.
• Record each download (user ID, email, app, version, time, user-agent) for support and statistics.
• Send product update emails about your add-in. You can unsubscribe using the link in these emails; unsubscribing does not change your license.

• Autodesk — your user ID and App ID are sent to Autodesk’s Entitlement endpoint to confirm ownership. When Hole Series & Fasteners runs a linked-file workflow, it also asks Fusion to save new versions in your Autodesk cloud project; Autodesk processes that CAD data as part of the Fusion service, not as licensing data sent to us. Likewise, an .f3z backup made by Auto Backup & Export is built by Fusion’s own cloud export service from designs already in your Autodesk cloud, and its Restore to Fusion and Restore version (Backup Status) upload backup files, when you run them, only to the Autodesk account signed in to Fusion.
• Your cloud storage provider (Auto Backup & Export only) — if you choose a backup folder synced by Google Drive, OneDrive, Dropbox or another service, that provider’s own app uploads the backup files under your account and its terms. The Add-in does not sign in to or communicate with these services, and we do not receive the files.
• Our licensing server, hosted on Google Firebase / Google Cloud (region us-central1) — receives your user ID, email, App ID (and a passcode if you enter one) to perform activation, trial, or grant, and the download request data above to issue and log a download. Google acts as our hosting/processing provider.
• Brevo — processes the email addresses selected for product update notifications, their add-in mailing lists, delivery information and unsubscribe preferences. Activation passcodes, Autodesk user IDs and CAD data are not included in this email integration.

We require any such third party (Autodesk; Google; Brevo) to protect your data to at least the standard described here; Google processes it under its own security and privacy commitments. We do not sell your data and do not share it with any other third party, advertiser, analytics or ad network.

Steel Frame & Weldments also keeps your section library and settings in %APPDATA%\VanThanBK\Weldments\ (Windows) or ~/Library/Application Support/VanThanBK/Weldments/ (macOS); Tube & Pipe Routing keeps its pipe library inside the add-in folder. Hole Series & Fasteners keeps settings.json and metric_fasteners.json in %APPDATA%\VanThanBK\HoleSeriesAndFasteners\ (Windows) or ~/Library/Application Support/VanThanBK/HoleSeriesAndFasteners/ (macOS). These libraries and settings contain no account data and are never transmitted. You may remove library or settings files while the relevant add-in is stopped; do not remove Hole Series & Fasteners recovery data while a cross-file job is active or still needs diagnosis.

Auto Backup & Export keeps settings.json (backup folder, formats, backup mode, kept versions, selected project and folder IDs and names), its activity log (logs/), its signed license cache (license/) and temporary work files (work/) in %APPDATA%\VanThanBK\AutoBackupExport\ (Windows) or ~/Library/Application Support/VanThanBK/AutoBackupExport/ (macOS). The log contains the names of your designs, projects and folders and the backup file paths; it stays on your computer unless you attach it to a support request. Inside the backup folder you choose, a manifest (.autobackup/manifest.json) records each backed-up cloud file: its ID, name, hub, project and folder names, version, the backup files written and the last error of a failed attempt. Updating or uninstalling the Add-in leaves these folders, the manifest and your backups in place.

Cross-file Hole Series & Fasteners jobs also keep a durable JSON journal in that user-data folder. A linked Assembly Cut temporarily stores one tamper-evident cutter-body snapshot there so the job can continue after the parent document closes. Successful jobs normally archive their JSON journal and remove the cutter snapshot. If exact cleanup cannot be verified, the completed journal and snapshot remain active for diagnosis and a later safe cleanup retry; stopped or partial jobs can likewise retain recovery data.

Hole Series & Fasteners stores editable feature specifications and tracking metadata as document/entity attributes under VanThanBK_AssemblyPilot inside your Fusion design; generated native features and bodies also carry attributes. Linked workflows save CAD versions through Autodesk Fusion cloud, but Hole Series & Fasteners has no path that sends your model geometry to us, our licensing service, telemetry, advertisers, or analytics providers.

Sheet Metal & Press Brake keeps its press brake library (press-brake-library.json: machines, punches, dies, materials and test-bend calibrations), its form tool library, settings and signed license cache in %APPDATA%\VanThanBK\SheetMetalPressBrake\ on Windows. The press-brake setup and bend order of a part and its form records are stored as attributes inside your Fusion design; Apply Bend Rule creates or updates a sheet-metal rule in that design.

The retention target for licensing accessAbuse counter records is 30 days after their last update. During valid access/manual-grant requests, each warm server instance attempts cleanup no more than once every 6 hours. Each attempt deletes at most 200 records whose last update is more than 30 days old. Because cleanup is opportunistic and does not use a scheduler or Firestore TTL, physical deletion can occur later if there is no licensing traffic, a large cleanup backlog, or a temporary database error. The stored 10-minute and 24-hour counters stop affecting access after their respective windows; retention of the hashed record does not extend a rate-limit window.

• Revoke consent: stop using or uninstall the add-in (it then sends nothing further), and delete the folders named in section 5.
• Access or delete your data: email support@vanthanbk.com and we will action it.

We comply with applicable data-protection laws, including the GDPR and CCPA, and act as an independent data controller for the data described here.

• The email address you type — used to reply and to match your reports when you sign in to My Reports with that verified email. It is never published, sold, or added to a mailing list.
• The report itself — the type (bug or feature), your summary and message, and the add-in version you optionally type in.
• A salted hash of your IP address and your browser’s user-agent string — kept only to rate-limit and clean up spam. The IP address itself is never stored; the hash is a short pseudonymous identifier for the connection, readable only by the publisher and never published or shared.
• Files you choose to attach — screenshots, one Fusion design file and one short video. They are used only to look into that report, are kept in a private Google Cloud Storage bucket. The publisher and the verified report owner can access them through authenticated downloads. They are deleted automatically 90 days after upload (sooner if the report is deleted).

Reports are stored in Google Firebase (Firestore). The publisher can read them; My Reports shows the verified owner their own reports, status, replies and fixed versions. Internal administrative notes are not shown. Ask at support@vanthanbk.com and your report and its files will be deleted. Nothing on that form is required except the email address, the summary, and the message — please do not include anything confidential in it, and attach a design file only if you are free to share it.

My Reports uses Firebase Authentication with Google sign-in or email and password. Firebase manages the account identifier, email, verification status and sign-in credentials. Email/password accounts verify their email before accessing reports. The website remembers your sign-in in browser storage until you sign out or the session becomes invalid. We do not ask for your Autodesk password. Contact us to delete your website account.

• Check the email address you type against our license records (App Store purchases reported by Autodesk, activations, and access grants issued by the publisher). The address is not stored unless a download is issued.
• Issue a one-time download link valid for 15 minutes, and record the download (email, app, version, time, browser user-agent string) for support and statistics — the same record an Add-in’s own “Download latest version” button creates where that feature is available.
• Rate-limit the form with a one-way hash of your IP address that is kept only in an abuse counter and never stored with your data.

If the address is not on record, nothing is stored and you are pointed to the App Store page instead.