What happens to your data.

Struq is a trade name of Roy Heilbron, based in the Netherlands. He is responsible for the personal data processed through this website, struq.app, and through the Struq product behind it: your account, the library, your saved items and the Struq MCP.

For questions about privacy, or to see, correct or delete your data, write to [email protected]. For anything else about your account, Pro or the MCP, write to [email protected].

You can read the whole site, browse the library and download the photos without an account.

• Visit counts. We count visits with Cloudflare Web Analytics. It sets no cookie and stores nothing in your browser. It records the page, the referring site, your country, the kind of browser and device, and how fast the page loaded. Cloudflare states that it does not use your IP address or browser details to recognise you across visits, so we see totals, never a person.
• Fonts and files. Every font, image and script of our own pages comes from struq.app. The site does not load Google Fonts, so your browser does not contact Google when you visit.
• Browser storage. The site keeps one note in your browser’s session storage, that you have seen the opening animation, so it does not play on every page. It is gone when you close the tab.
• Delivery and security. Like any website, the servers that deliver it see technical request data: your IP address, your browser’s user agent and the time. Cloudflare and our host use it to deliver the pages and to keep out abuse.
• The showcase. Some of the demo sites in the showcase load their animation libraries from public code hosts, cdnjs.cloudflare.com and unpkg.com, which see the same technical request data as any web server.

The Struq skill needs no account and its installer sends nothing. While it builds, its image script downloads the photos it picks from Struq’s photo library, so our servers see the same technical request data as for a page visit. The docs list every download the skill makes.

When you connect the Struq MCP, the AI tool you connect, such as Claude or Cursor, receives only what it asks Struq for, within the permissions you gave it. Struq never reads your code: the check runs on your side. What that tool does with the answers falls under its own terms.

The website sets no cookies. Once you sign in, the product uses the cookies it needs for your session, for signing in and for security.

Product analytics start only after you agree to them. They run on PostHog’s European hosting, with session recording and automatic click tracking switched off. If you decline, nothing is measured. Your choice is kept in a first-party cookie and in local storage, so we do not ask every time; clear them in your browser and we ask again.

Without an account, saved assets and a recipe can be kept locally in your browser. When you create an account, they can move to it. The public library holds no personal account data.

We never sell personal data. We share only what Struq needs to work, with the providers that host and run it:

• Railway, for hosting, the database and media storage.
• Cloudflare, for delivering and protecting the site, and for the cookieless visit counts.
• PostHog, for product analytics after you agree.
• Stripe, for payments and subscriptions.
• Google and GitHub, when you choose to sign in with them.
• The AI tool you connect through the MCP, as described above.

These providers process data under their own terms and their agreements with Struq. Where data is processed outside the European Economic Area, we rely on the safeguards the GDPR requires for that.

• Account data and saved items: as long as your account is active, unless the law requires longer.
• Subscription and invoice data: as long as bookkeeping, disputes and legal retention duties require.
• MCP access: an access token for one hour, a refresh token for sixty days, and both only until you revoke the connection.
• MCP tool calls: one year. Since 8 November 2026 Struq no longer writes build plans; plans from before that date, without your brief, stay in the database until we delete them.
• Product analytics: as long as the retention period set for our PostHog project.
• Security and server data: as long as needed to investigate incidents and prevent abuse.

Once data is no longer needed, we delete or anonymise it. Backups can still hold a copy for a while, until they are overwritten in the normal cycle.

You can ask to see, correct or delete your data, to restrict its processing or to receive it in a portable form, and you can object to processing based on a legitimate interest. You can withdraw your consent for analytics at any time. We may ask for enough information to confirm who you are, so we never hand data to the wrong person.

Send your request to [email protected]. We aim to answer within one month; if a request is complex, we tell you why we need longer.

If you are not happy with our answer, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

We use appropriate technical and organisational measures, such as hashed passwords, access control, rate limiting, encrypted connections where the provider offers them, and separate access rights for account and payment data. No internet service is free of risk. If there is a data breach, we inform you and the regulator when the GDPR requires it.

When Struq changes, this policy can change with it. This page always shows the current version and the date of its last change. The agreements for using Struq are in the terms.