Privacy Policy

Deutsche Fassung · In case of doubt, the German version applies.

Grab3D is a library of free 3D models. You don't need an account to view or download models, and we process as little personal data as possible. This policy explains which data is processed when you visit this website, why, and what rights you have.

1. Controller

Grab3D
Alexander Popov
Harzburger Straße 19
30419 Hannover
Germany
Email: info@grab3d.com

2. Hosting and server log files

This website is hosted by ALL-INKL.COM (Neue Medien Münnich), Hauptstraße 68, 02742 Friedersdorf, Germany. Whenever you access a page, the web server automatically processes data sent by your browser and stores it in server log files:

IP address of the requesting device
date and time of access
requested page or file, HTTP status code and amount of data transferred
referrer URL (the previously visited page, if transmitted)
browser type and version and operating system (user agent)

This data is required to deliver the website, keep it stable and secure, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website. Log files are only kept as long as necessary for these purposes and are then deleted automatically. We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR.

3. No cookies without consent, local browser storage

We do not set any cookies unless you have explicitly consented. For some features we store settings in your browser's local storage (localStorage), for example:

the contents of your asset basket,
your language choice, or that you dismissed the hint about another language version,
your decision in the consent banner,
only with your consent: a random visitor and session ID for our own statistics (see Section 6.2),
wishes and votes on the request board stored locally, and work in progress in our browser tools.

Our browser games (/games/) store savegames, high scores and game settings in your browser (IndexedDB and localStorage). Some games also keep their game data there so the next start is faster. The games do not send any of this to us or to third parties, a backup only leaves your device if you export it yourself as a file. For our statistics we count game starts and the active play time (see Section 6).

This data stays on your device and is not transmitted to us. The only exception are the statistics IDs under Section 6.2. Storing it is technically necessary for the features you request (Section 25(2) no. 2 of the German TDDDG). Any further processing is based on Art. 6(1)(f) GDPR. You can delete this data at any time in your browser settings.

4. Fonts and 3D libraries

Fonts, the 3D viewer and the decoders it needs are served directly from our own server. We do not use Google Fonts or external content delivery networks (CDNs), so no data is sent to third parties for these resources.

5. Request board, showcase and download counter

On the request board you can suggest models and vote for wishes. On the showcase page you can submit a project (title and link). Please do not enter personal data there. As long as these features do not run on our server, wishes and votes stay in your browser only (see Section 3). Once they run on our server, the following applies:

We never store IP addresses in plain text. A hash value is derived from the IP address with a secret key (HMAC-SHA256). Only this value is stored, and it cannot be traced back to the IP address without the key.
Abuse protection: to limit the number of requests per time period, we store this hash together with the type of action (for example a vote) and the time. These entries are deleted automatically after 24 hours.
Votes: so that everyone can vote only once per wish, the hash is stored with each vote for as long as the wish is stored by us. If a wish is rejected or deleted, we delete its votes. If two identical wishes are merged, the votes are carried over without duplicates.
Submitted wishes and showcase entries are stored with the text or link you entered and the time. They only appear after we have reviewed them and remain stored until we delete them. Your submission automatically counts as your first vote.
Download counter: we count how often a model was downloaded in which format. So that repeated clicks are not counted several times, we store the hash together with the model, format and date for no longer than 48 hours. The counts themselves contain no personal data.
To protect against automated submissions, your browser receives a short-lived security token when these features load. It is not stored on your device or in our database.

We do not set cookies for these features. Only the administration area, which is used exclusively by us as the operator, uses a technically necessary session cookie after login. Visitors of the website never receive this cookie.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is operating these features, counting votes and downloads honestly and protecting them against abuse.

6. Web analytics

We want to know which models, tools and games are used, so we can improve Grab3D and give partners or sponsors aggregated reach figures. For this we use our own statistics, which run on our server at ALL-INKL.COM. Partners only receive aggregated figures (for example visitors per month or shares by country), never individual data.

6.1 Our own statistics without consent

Without your consent we only count anonymously. Nothing is stored on or read from your device for this (no cookie, no localStorage, no device properties such as the screen size). A small script sends the following to our server:

the page you open (without search parameters), the referring page and campaign parameters (utm) from the address,
how long the page was visible,
clicks on download files (model and format), actions in our browser tools (for example an export) and search terms of the internal search,
for browser games: the start, the active play time (every 30 seconds, only while the tab is visible) and the input method used (keyboard, mouse, touch or gamepad).

From the request our server derives the country (with a database on our own server, the IP address is only used briefly in memory for this), the device class, the browser and operating system family from the user agent and the browser language. To tell visitors apart within one day, we create a shortened hash from the IP address, the user agent and a random key. The key is created anew every day and deleted with the first request after midnight. Backups of our host may still contain it for a few days. After that the hash cannot be linked to anyone, not even across days. We do not store IP addresses, not even shortened ones.

Search terms are stored without any link to a person. Terms that look like email addresses, links or long numbers are discarded. Requests from bots and unusually many requests in a short time are filtered out. For this limit we additionally count, per minute, a hash of the IP address and the same daily key. These counters are deleted after 10 minutes.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a privacy-friendly measurement of reach in order to improve and finance the website. If your browser sends "Do Not Track" or "Global Privacy Control", we only count you in this anonymous way.

6.2 Our own statistics with your consent

If you agree in the consent banner (category statistics), we additionally store a random visitor ID (g3d-vid, 13 months) and a session ID (g3d-ses, ends after 30 minutes without activity) in your browser's local storage and record a coarse screen size class. This lets us recognise returning visits, sessions and paths across several pages and days. On our server the IDs are only stored as a hash with a secret key (HMAC). They contain no name, no email address and no IP address.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future by clicking "Cookie settings" in the footer and choosing "Decline". The IDs are then deleted from your browser immediately. If your browser sends "Do Not Track" or "Global Privacy Control", we do not use any ID, not even after consent.

6.3 Retention and recipients of our own statistics

Individual events are kept for 13 months. After that only aggregated daily figures remain, without any link to individual visitors. The daily key for the hash is deleted with the first request after midnight, backups of our host may still contain it for a few days. The data is stored on our server at ALL-INKL.COM (data processing agreement under Art. 28 GDPR). There are no other recipients. Only the operator has access, through a password-protected administration area.

To determine the country we use the "IP to Country Lite" database by DB-IP (licence CC BY 4.0). It is stored on our server, no data is sent to DB-IP.

6.4 Google Analytics

If you agree via the consent banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Without your consent, Google Analytics is not loaded and no connection to Google is made. We use Google's Consent Mode v2 with the default set to "denied".

Google Analytics sets cookies (e.g. _ga, _ga_*, lifetime up to two years) and processes usage data such as pages viewed, time on page, approximate location (country/city), device and browser information, and events such as downloads. According to Google, Google Analytics 4 does not log or store IP addresses. We use the reports to understand which content is helpful and to improve the website.

Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Event data in Google Analytics is retained for a maximum of 14 months.

7. Contact by email

If you email us, we process your details (email address, content of your message) to answer your request. The legal basis is Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if your request relates to a contract. We delete the data once your request has been dealt with, unless statutory retention obligations apply.

8. Your rights

You have the following rights regarding your personal data:

access (Art. 15 GDPR)
rectification (Art. 16 GDPR)
erasure (Art. 17 GDPR)
restriction of processing (Art. 18 GDPR)
data portability (Art. 20 GDPR)
objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Just contact us at info@grab3d.com.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

10. Automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Last updated: October 2026