SuperNX / Privacy
Privacy policy
Operator. SuperNX is operated by Poetical Engine LLC, a New Mexico limited liability company, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. “We”, “us” and “SuperNX” in this document mean Poetical Engine LLC.
SuperNX is a tolerance-chain analysis tool for Siemens NX parts, operated from nxtolerance.com. This policy covers the product and this site. The short version: we collect what the service needs to run, we delete uploaded part files on a fixed schedule, and we never sell or train on your data.
What we collect
- Account data. Email and display name via Google Firebase authentication when you sign in.
- Sign-up verification. For email and password sign-ups we keep only a SHA-256 hash of the 6-digit code we email you, deleted when you verify or at most 52 hours after the code expires; the copy of that email in our mail log has the code blanked out. We also keep a salted SHA-256 hash of your IP address (for IPv6, its /64 prefix) for at most 52 hours, to count verification emails per network and stop sign-up abuse.
- Free-trial claim signals. When you claim the free first month of Pro we record the class of your email domain (corporate, free mail or disposable), a salted SHA-256 hash of your IP address (for IPv6, its /64 prefix) and a salted hash of a browser fingerprint. Details and retention are in the next section.
- Feedback. Your first-run survey answers and whether you agree to be contacted, thumbs up or down on KC results, and the reason you give when cancelling a subscription.
- Billing identifiers. For paid plans, the Creem customer and subscription identifiers and your billing period. Card details never reach us.
- Sign-up and payment records. A short record tied to your account when you start a checkout (the plan, and whether Creem created the checkout or why not), when Creem notifies us about your payment or subscription (the notification type, its Creem event ID and what we did with it), when your subscription status changes, and when an account email to you or a file upload fails. Email addresses are removed from these records. Deleted after 180 days.
- Uploaded content. NX .prt files you choose to analyze, and the analysis outputs they produce (report, toleranced model). The rendered views of the part created during an analysis are kept with these outputs.
- Email with us. Messages you send to any nxtolerance.com address, copies of the email we send you, and Team plan inquiries (name, email, company, plan, message).
- Product telemetry. First-party usage events via our own beacon: page views and session duration, plus product actions (opening sign-in, creating an account or signing in, starting a demo run, starting an upload) and answers to the optional two-question survey on our tool pages (which CAD you use and what you are working on; one click each, not tied to an account) — no third-party advertising trackers.
- Operational logs. Request metadata (IDs, sizes, timings, status codes) for reliability and abuse prevention.
Free trial, feedback and billing data
Free-trial anti-abuse signals
Claiming the free first month of Pro is limited to prevent repeated claims. At claim time we store the class of your email domain (corporate, free mail or disposable), a salted SHA-256 hash of your IP address (for IPv6, its /64 prefix) and a salted hash of a browser fingerprint. We never store the raw IP address or the raw fingerprint, and we use the hashes only to limit repeated trial claims. They are deleted automatically after 90 days. This is separate from the sign-up verification hash above, which is kept for at most 52 hours. The claim dialog can also show a Cloudflare Turnstile challenge to tell people from bots; Cloudflare is already one of our sub-processors.
Feedback
If you answer the first-run survey, vote on a KC result or give a reason when you cancel, we store it tied to your account: the survey answers and whether you agreed to be contacted, your up or down votes, and the cancellation reason. We keep it while your account exists and use it to improve the analysis and to decide follow-ups. We contact you about it only if you agreed to in the survey.
Billing
Paid plans are sold by Creem, our merchant of record, which handles your card details, taxes and receipts. We store only your Creem customer identifier, your Creem subscription identifier and the subscription’s billing period, plus the sign-up and payment records above (deleted after 180 days). We never see or store your card number.
What we use it for
- Running the tolerance analysis you asked for, and returning your report and model.
- Account management and workspace continuity.
- Account and service email: a 6-digit verification code when you sign up with email and password, one welcome email when you first sign up (for email and password: after you verify), automatic acknowledgements of mail to support@, privacy@ and security@, and our replies to your messages and inquiries. No marketing email, no newsletter.
- Keeping the service reliable and preventing abuse.
We do not use uploaded parts or analysis content for advertising, profiling, or training machine-learning models.
Sharing
Only the sub-processors listed on Security & data handling ever touch your data: Cloudflare (hosting, storage and email), Google Firebase (sign-in), and Anthropic (AI inference on model-derived data, under API terms that prohibit training). We do not sell data, and we do not share uploaded content with anyone else. The one separate party is payment: when you buy a paid plan, Creem acts as merchant of record and handles your card details under its own terms; we do not give it your parts or analyses.
Retention
Uploaded source files are deleted automatically when the analysis completes, and the compute node's working copies are wiped at the end of every run; reports, toleranced models and the rendered part views kept with them persist until you ask us to delete them; operational logs age out within 30 days; account data persists until you ask us to delete the account; free-trial anti-abuse hashes are deleted automatically after 90 days; feedback is kept while your account exists; Creem identifiers and billing period are kept for as long as you have a subscription record with us; sign-up and payment records are deleted automatically after 180 days. Email with us — your messages and the email we send you — stays in our mail log, a Cloudflare D1 database, and Team plan inquiries are kept with it (and in the product database, also D1). There is no automatic expiry: it all stays until you ask us to delete it, and an account-deletion request deletes it too. The full retention table is on the security page.
Your rights
You can access, export, or delete your data: email privacy@nxtolerance.com to delete specific analyses or the whole account. Deleting the account removes account data, stored outputs and our email history with you, Team plan inquiries included. Depending on your jurisdiction you may have additional rights (access, portability, objection) — the same address reaches us.
Cookies
Essential cookies only — authentication and session state. No advertising or cross-site tracking cookies.
Videos
Some Learn articles include one of our videos hosted on YouTube. Nothing is loaded from YouTube until you press play. When you do, the player loads from youtube-nocookie.com, a Google service, and Google’s privacy policy applies to that playback. Links marked “Watch on YouTube” take you to youtube.com.
Changes
If this policy changes, the effective date above moves and material changes are noted on this page. October 17, 2026: named the operator, Poetical Engine LLC. October 11, 2026: added sign-up and payment records (checkout attempts, Creem payment notifications, subscription status changes, failed account emails and uploads), tied to your account and deleted after 180 days. October 10, 2026: added the YouTube video player on Learn articles, which loads only when you press play. October 9, 2026: rendered part views created during an analysis are now kept with your other outputs until you ask us to delete them. October 9, 2026: added the free-trial anti-abuse signals (email-domain class and salted hashes of IP address and browser fingerprint, deleted after 90 days), feedback data tied to your account, and the billing identifiers we keep for Creem payments. October 8, 2026: added email — what you send us, what we send you, and how long we keep it. Also corrected how analyses are deleted: by email to privacy@nxtolerance.com. October 8, 2026: added email verification for email and password sign-ups — the code we email you, and the hashes we keep to check it and to stop sign-up abuse.
Contact
privacy@nxtolerance.com · security issues: security@nxtolerance.com