Legal information

This page explains how Mockuuups Studio protects your data. It is written for customers and security reviewers. For contractual terms, see our Privacy Policy and Data Processing Agreement.

Local-first design processing

Mockuuups Studio on the web, desktop app, and plugins processes your imported designs on your device. We serve the mockup gallery from our servers; the contents of your imported files are not uploaded for normal use.

Analytics may include which mockup you used and the file extension—not the filename or image contents.

Optional features that use our servers

• Share links: only when you choose to create a share; the shared asset is uploaded for that purpose.
• Server-side rendering (planned): if local rendering fails (for example WebGL issues), we may offer a server fallback. This is not the default path and is not live yet.

Account data

We store account information needed to run the service (such as email, authentication data, subscription and billing metadata, and preferences). This is separate from designs that remain on your device.

Encryption and infrastructure protections

• Data in transit is protected with TLS 1.2+.
• Stored account data is encrypted at rest.
• Public traffic is served through Cloudflare, including DDoS mitigation and web application firewall protections.
• Production is isolated from development and staging environments.
• We monitor service health and application errors and alert our operations team.

Providers and regions are listed on our List of Subprocessors.

Authentication

You can sign in with magic link emails, Google, Apple, or GitHub. Optional passwords are available; see our Help Center password policy. Team plans support SAML SSO.

Access to account data

Access to production systems and account data is limited to the company founders who operate the service. They cannot see designs that remain on your device.

Desktop app

The desktop app stores project data locally on your computer. Releases are signed where the platform supports it (macOS signed and notarized; Windows signed).

AI

We do not use your imported designs to train AI models. If we offer on-device assist features in the future (for example classifying a screenshot locally to suggest mockups), that processing would stay on your device and would be opt-in—we would not send that media to us or to third-party AI for training.

Incidents and reporting

If a personal data breach affects your data, we notify you without undue delay and within 72 hours of becoming aware (see our DPA).

Report security issues to [email protected].

Availability

We provide best-effort availability. We do not offer contractual uptime, RTO, or RPO guarantees.

Deletion

You can delete your account in account settings. Per our DPA, we delete account data within 30 days of termination or request. Billing records may be retained by our payment provider as required by law.

Contact

Questions about this page: [email protected] or our contact form.