Legal information

This page explains how Mockuuups Studio protects your data. It is written for customers and security reviewers. For contractual terms, see our Privacy Policy and Data Processing Agreement.

Local-first design processing

Mockuuups Studio on the web, desktop app, and plugins processes your imported designs on your device. We serve the mockup gallery from our servers; the contents of your imported files are not uploaded for normal use.

Analytics may include which mockup you used and the file extension—not the filename or image contents.

Optional features that use our servers

• Share links: only when you choose to create a share; the shared asset is uploaded for that purpose.
• Server-side rendering (planned): if local rendering fails (for example WebGL issues), we may offer a server fallback. This is not the default path and is not live yet.

On a team plan, the owner can turn these cloud features off in Manage Account.

Account data

We store account information needed to run the service (such as email, authentication data, subscription and billing metadata, and preferences). This is separate from designs that remain on your device.

Encryption and infrastructure protections

• Data in transit is protected with TLS 1.2+.
• Stored account data is encrypted at rest.
• Public traffic is served through Cloudflare, including DDoS mitigation and web application firewall protections.
• Production is isolated from development and staging environments.
• We monitor service health and application errors and alert our operations team.

Providers and regions are listed on our List of Subprocessors. Team owners can subscribe to subprocessor change notices in team settings. We send notices at least 30 days before an addition or replacement, except in an emergency.

Authentication

You can sign in with magic link emails, Google, Apple, or GitHub. Optional passwords are available; see our Help Center password policy. Team plans support SAML SSO.

Access to account data

Access to production systems and account data is limited to the company founders who operate the service. They cannot see designs that remain on your device.

Desktop app

The desktop app stores project data locally on your computer. Releases are signed where the platform supports it (macOS signed and notarized; Windows signed).

AI

We do not use your imported designs to train AI models. If we offer on-device assist features in the future (for example classifying a screenshot locally to suggest mockups), that processing would stay on your device and would be opt-in—we would not send that media to us or to third-party AI for training.

Incidents

If a personal data breach affects your data, we notify you without undue delay and within 72 hours of becoming aware (see our DPA).

Reporting a vulnerability

Email [email protected] with the affected URL or component, steps to reproduce, and what an attacker could do with it. We aim to reply within 3 business days.

We don't run a bug bounty program and don't pay for reports. If you report a valid issue, we'll fix it and, if you'd like, credit you on this page.

When testing:

• Use only accounts you own. Don't access, change, or delete other people's data.
• No denial-of-service, spam, or high-volume automated scanning.
• No social engineering or phishing of our team or customers.
• Give us reasonable time to fix the issue before you disclose it publicly.

We won't take legal action against good-faith research that follows these rules.

Out of scope unless you show a working exploit with real impact:

• SPF, DKIM, DMARC, or other email DNS settings
• Missing security headers or cookie flags
• Clickjacking on pages without sensitive actions
• Software version or banner disclosure
• Missing rate limits
• Self-XSS and logout CSRF
• Automated scanner output without a proof of concept
• Issues in third-party services on our List of Subprocessors (report those to the vendor)

Availability

We provide best-effort availability. We do not offer contractual uptime, RTO, or RPO guarantees.

Deletion

You can delete your account in account settings. Per our DPA, we delete account data within 30 days of termination or request. Billing records may be retained by our payment provider as required by law.

Contact

Questions about this page: [email protected] or our contact form.