Privacy policy
Effective 28 July 2026 · Last updated 28 July 2026
This covers both the MockupForge 3D web app at mockup.lukeduff.co.uk and the MockupForge Capture Chrome extension. Both are made by lukeduff.co.uk.
The short version
- Your screenshots and images are processed entirely in your own browser. They are never uploaded, never seen by me, and never stored on any server.
- There is no account, no login and no user profile.
- There are no analytics, no advertising and no tracking cookies on any page.
- The extension makes no outbound network requests at all.
- The only personal data I ever receive is an email address, and only if you type one into the Pro waitlist form yourself.
- Nothing is ever sold, rented or shared for advertising.
The rest of this page is the detail behind those claims, including exactly what each Chrome permission is used for.
The web app
Your screenshots and images
When you drop an image into the studio it is read directly by your browser and drawn onto a canvas element. It is never sent anywhere. The rendering, the 3D device models and the PNG export all run on your own machine, which is why the tool works with your network disconnected once the page has loaded. Closing the tab discards the image.
What is stored on your device
The studio uses your browser's localStorage. Nothing in it is transmitted
to me or anyone else, and you can clear it at any time through your browser settings.
| What | Why |
|---|---|
| Saved looks | So your own presets survive a page reload. Slider values and colour choices only. |
| Waitlist email copy | A local copy of any address you submit, written so a failed network request never silently loses your signup. |
There are no cookies. Nothing in local storage identifies you or is used for analytics.
The Pro waitlist form
This is the one place the site collects personal data, and only when you choose to submit it. If you enter an email address, it is sent through Web3Forms, a form relay service that passes the message on to my inbox. Web3Forms acts as a processor for that delivery and is subject to its own privacy policy.
I use that address for one thing: to tell you when MockupForge Pro is available. It is not added to a marketing list, not used for anything else, and not shared with anyone. Ask me and I will delete it — see Contact below.
Fonts
Pages use Geist and Geist Mono, and both are served from this site rather than from Google Fonts. The font files sit on the same server as everything else, so loading a page sends nothing to Google and no third party learns your IP address or user-agent from a font request.
This changed on 29 July 2026. Before that date the fonts were loaded from Google Fonts, which did mean Google received your IP address and user-agent on every page load. That request no longer happens.
The site now makes no third-party requests at all on a normal page load. Every file a page needs comes from this domain.
Hosting
The site is static and hosted on Vercel, which keeps standard server logs (IP address, timestamp, requested file, user-agent) for security and operational purposes. I do not use those logs to build any profile of you, and I have added no analytics layer on top of them.
The Chrome extension
MockupForge Capture screenshots the tab you are on and hands the image to the studio tab on the same machine. It contains no network code whatsoever — no server, no account, no analytics, no telemetry. Your capture travels from Chrome to your own studio tab and nowhere else.
What each permission is for
| Permission | What it does, precisely |
|---|---|
activeTab |
Captures a screenshot of the tab you explicitly invoked the extension on, at the moment you click. It grants no access to any other tab and no ongoing access after that action. Chrome requires this specific permission for tab capture. |
storage |
Holds your settings (chosen device, backdrop, which studio to open) and briefly holds the captured image while it is handed to the studio tab. The image is deleted from storage as soon as the studio confirms it received it. |
downloads |
A rescue path only. If the studio tab never confirms receipt, the PNG is written to your Downloads folder so your capture is not lost. Nothing is downloaded on a successful handoff. |
alarms |
Times that rescue and expires stale captures. A plain timer cannot be used because Chrome shuts down idle extension workers and cancels their timers. |
debugger |
Used only by Capture Mobile. Chrome's device-viewport emulation is reachable through no other API, and Chrome does not permit this particular permission to be optional, so it is requested at install rather than on first use. It is used solely to set a phone viewport size before taking the picture, it is attached only for the moment a mobile capture runs, and it is detached immediately afterwards. It is never used during a desktop capture, and it reads nothing from any page. |
Site access tomockup.lukeduff.co.uk |
Lets a small script on the studio page receive your capture. Web page JavaScript cannot read extension storage directly, which is the only reason this script exists. It runs on the studio URL and nowhere else. |
What the extension never does
- Read, monitor or collect the content of pages you browse.
- Capture anything without you clicking the button or pressing the shortcut.
- Run in the background, or on any page other than the studio.
- Send your screenshot, your browsing history or anything else to any server.
The published build requests access to the production studio only. A development
build in the public source tree also lists localhost; that entry is
stripped from the packaged extension, and the build script refuses to produce a
package that still contains it.
What I never do with your data
Stated plainly, and these apply to the web app and the extension alike:
- I do not sell or rent your data to anyone, ever.
- I do not transfer your data to third parties except as strictly needed to run the service — which, in practice, means only the waitlist email relay described above.
- I do not use your data to determine creditworthiness or for lending purposes.
- I do not use your data for advertising, retargeting or profiling.
- I do not use your data for any purpose unrelated to the tool's single function: turning a screenshot into a device mockup.
- I do not track you across sites.
Your rights
If you are in the UK or EU, the UK GDPR and GDPR give you rights over personal data held about you: access, correction, erasure, restriction, portability and objection. In practice the only personal data I could possibly hold is a waitlist email address, so exercising any of these is a single message — see below. I will action deletion requests without asking why.
The lawful basis for holding a waitlist address is your consent, given by submitting the form, and you can withdraw it at any time.
Children
MockupForge is a design tool aimed at developers and designers. It is not directed at children, and I do not knowingly collect personal data from anyone under 13.
Changes to this policy
If this policy changes, the "last updated" date at the top changes with it. If a change ever meaningfully affects what happens to your data — rather than just clarifying wording — I will say so on the page rather than quietly editing it.
Contact
Questions about this policy, or want your email removed from the waitlist?
MockupForge 3D is made by lukeduff.co.uk, a sole trader based in the United Kingdom.