Privacy Policy

Duo Fitting Room · https://duo.stacklet.app

Effective and last updated: October 24, 2026

The short version

• No cookies, no ads, nothing sold. This site sets no cookies, shows no ads, and never sells your personal information or shares it for advertising.
• Visit counts without cookies. Page views and a few usage events (such as which case you try on) are counted with Vercel Web Analytics. It uses no cookies and doesn't tie what it records to your IP address. You can turn it off.
• Feedback. If you send feedback, I keep it for 2 years. Adding your email is optional, and I use it only to reply.
• Error reports. If something breaks, the page sends an automatic error report. I keep these for 90 days.
• Security logs. Like any website, the services that host this site briefly log requests, including your IP address, to deliver and protect it.
• Store links. They go to each brand's own store. Some may be affiliate links. After you click, the brand and its affiliate network may set their own cookies.
• Your rights. Email privacy@stacklet.app to see, correct or delete what I have about you. These rights apply wherever you live.

Who runs this site

Duo Fitting Room is a free, unofficial, independent 3D tool for trying iPhone Duo cases and MagSafe accessories. It is run by Nick Neely, an individual based in Iowa, USA. I decide how personal information on this site is used, so under EU and UK law I am the "controller".

Contact: privacy@stacklet.app, for privacy questions, requests and anything else.

I haven't appointed a data protection officer or a representative in the EU or UK. Please contact me directly.

This policy covers the website at duo.stacklet.app, including its feedback form and automatic error reports. An offline copy of the viewer (a saved viewer.html file) sends nothing at all: no analytics, feedback or error reports. Its store links still open the brands' sites.

What I collect, why, and for how long

The sections below give the details.

1. Visit statistics (Vercel Web Analytics)

When a page loads, and when you use certain features, your browser sends Vercel Web Analytics:

• The page address. This includes the part after "#", which describes your setup (phone color, case, accessory and view), and any query string. The setup contains no personal information.
• The referrer. This is the site that linked you here, if you came from another site.
• Usage events, each with at most two details:
  • which case, accessory, phone color, pose and view you choose;
  • which features you open, such as Compare specs, Fit details or Shop this setup;
  • when you click a store link: which product, and which store;
  • whether you shared or saved an image: the method only, not the image or who you shared it with;
  • whether feedback was sent: its kind only, not its content;
  • how long the 3D view and its files took to load, whether loading failed, and whether files had to come from the main site instead of the file server;
  • which app's built-in browser you're using, if any (for example, Instagram);
  • if you're using an iPhone Duo, that you are, and whether it's folded or open and which way it's turned (so the layout fits it).

From each request, Vercel works out your approximate location (country, region and city) and your device's operating system, browser and device type.

No cookies or device storage. Vercel Web Analytics stores nothing on your device. It recognizes a visit by a hash created from the incoming request and discards it after 24 hours. Vercel says this data isn't tied to your IP address.

What I see. I see only totals in a dashboard. I don't put personal information in events.

How long. The dashboard covers the last 12 months. Vercel says it may keep data longer. For details, see Vercel's analytics privacy page.

Turning it off. Switch off Count my visits in About (open it from the Unofficial button or the More menu), or turn on Global Privacy Control in your browser. Either way, your browser sends no page views or usage events from then on. The switch is saved in your browser (see Cookies and browser storage). A content blocker that blocks the analytics script works too.

Analytics runs only on the live website, not on local or offline copies.

2. Feedback you send

Use Send feedback to report an inaccuracy or a problem, request a case or accessory, or share an idea.

Why: to read and act on your feedback, reply if you asked, and stop spam. The setup, browser and screen details help me see what you saw. I don't sell your feedback or share it for advertising.

What the form sends:

• what your message is about, and the product you're requesting, if any;
• your message;
• your email address, only if you add one. I use it only to reply to you;
• with Include my current setup on (it starts on): your setup link, your browser and device details (the "user agent"), your screen size, and your browser's language. Switch it off to leave these out. The form shows exactly what's attached;
• always: the site version, and how long the form was open (to filter out bots).

What the server adds:

• the time it arrived, a record number and a request ID;
• your country, worked out from your IP address;
• a short code made from your IP address with a secret key (a "salted hash"). It lets me spot repeated spam without saving your IP address, which is never stored with your feedback.

The server adds these even with the switch off.

Where it goes. Feedback is stored in a private Vercel Blob store in Washington, D.C., USA. It is also emailed to me through Resend. The email includes:

• your message;
• your email address, as the reply-to;
• the product, setup link, screen size, browser, language and country;
• the site version, the time, and the record number.

The email doesn't include the salted hash. The server logs record that feedback arrived (its record number and kind), but not your message or email.

How long:

• in the private store: 2 years, then deleted automatically;
• Resend's copy of the email: 30 days;
• the copy in my inbox: until I delete it, and no longer than 2 years.

Your IP address is also used, in memory only, to limit how often one connection can send. It is never written to the store. It does appear in server logs (section 4).

Please don't include sensitive information (such as health details) or other people's personal information in a message.

3. Automatic error reports

The page sends an error report when something goes wrong: a script error, a 3D file that won't load, the graphics stopping, the browser stopping the page, a resource the site's security policy blocked, or the file server failing so files come from the main site instead.

What a report contains:

• the type of error and its message;
• technical details: the stack trace and source file, with any query string or "#" part removed from web addresses;
• how long the page had been open;
• your setup link, browser and device details, screen size, and the site version.

A report never includes anything you typed into a form. The server adds the time, a record number, a request ID, your country and the salted hash described above. Each page view sends at most 10 reports.

Where it goes. Reports are stored in the same private Vercel Blob store and also written in full to the server logs (section 4). They are never emailed.

How long: 90 days in the store, then deleted automatically. Log copies are kept as section 4 describes.

4. Server, network and security logs

Loading the site means requests to the services below. Each logs technical details so it can deliver and protect the site.

• Vercel hosts the site and runs its server functions.
  • What it logs: your IP address, your browser (user agent), the page address with any query string, the referring page, your region, and the firewall's decision.
  • Rate limits: Vercel's firewall limits how many requests one IP address can send to the feedback and error-report endpoints within a few minutes.
  • How long: I can see these logs for 1 day.
• Axiom stores a copy of Vercel's logs so I can look into problems.
  • What the copies hold: your IP address, browser, page address, referrer, and connection details used to spot attacks (such as a TLS fingerprint).
  • How long: 30 days.
• Cloudflare delivers the 3D files from duo-assets.stacklet.app.
  • What it sees: your IP address, your browser, and the address of the page that asked for the file (https://duo.stacklet.app/). It sets no cookies.
  • How long: Cloudflare keeps its logs for limited periods under its privacy policy.
  • Failure reports: if a file fails to load, Chromium-based browsers (such as Chrome and Edge) may send Cloudflare a short network-error report: the failed address, the timing and the error. Cloudflare says it stores no personal data from these reports and keeps IP data only for the duration of the request.

Every page and file is served over HTTPS. The site loads no third-party scripts, fonts, tracking pixels or embedded content. The analytics script is served from this site's own address.

5. Emails you send me

Cloudflare Email Routing forwards email sent to privacy@stacklet.app to my Gmail inbox. Cloudflare doesn't store the content of forwarded emails.

I use your email address and message only to answer you and deal with your request. I keep them until your request is handled, then for 2 years as a record of what was asked and done, then delete them.

Cookies and browser storage

This site sets no cookies, and neither does Vercel Web Analytics. The page saves a few small items in your browser's own storage so it works the way you left it. They stay on your device and are never sent to me.

To remove them, clear this site's data in your browser's settings (usually under "cookies and site data"). Session storage clears itself when you close the tab.

Store links and affiliate links

Store links open each brand's own store in a new tab (an affiliate link may pass through its network's tracking link first). The phone link goes to apple.com.

Affiliate links. Some store links may be affiliate links. If you buy through one, the brand may pay me a commission, at no extra cost to you. Affiliate links are labeled "Paid link". See the Affiliate Disclosure.

What this site passes on: nothing personal.

• Your browser tells the store only that you came from https://duo.stacklet.app/.
• Your setup, in the part of the address after "#", is never sent.
• This site loads no affiliate-network or advertising tags, pixels or cookies, and does no interest-based advertising.

After you click. An affiliate link may take you through the network's tracking link before the brand's store. The network and the brand may then set cookies or use similar tracking (such as a click ID in the link) to record that your visit came from this site and to credit any sale. Some networks keep this data for years and link activity across sites and devices. This happens on their sites, under their policies:

Your choices. You can block third-party cookies or clear cookies in your browser, use a private window, or contact a network through the links above. You can also go to a store directly instead of through a link here.

When you click a store link, you choose to visit that store. Under California law that is your own interaction with the store, not this site selling or sharing your information.

Who processes your information

I don't sell, rent or trade your personal information, and I don't share it for advertising. These service providers process it for me, only to provide their services:

Each provider uses its own sub-processors (Vercel, for example, runs on Amazon Web Services), which it lists in its data processing terms.

My inbox. Feedback notifications and emails to privacy@stacklet.app arrive in my Gmail inbox. Google provides Gmail under its own terms and privacy policy, in the United States.

I may also disclose information if the law requires it, or to protect the site, its visitors or my legal rights.

International transfers

I'm in the United States. Stored data and logs are kept in the United States, though a request may first be handled at a provider's location near you (Vercel and Cloudflare run worldwide networks). If you're in the EU, UK or Switzerland, your information is handled in the United States.

• Data Privacy Framework: Vercel, Cloudflare, Resend and Google are certified under it.
• Standard Contractual Clauses: Vercel, Cloudflare, Resend and Axiom include the European Commission's clauses, and their UK equivalents, in their data processing agreements.

Legal bases (EU and UK)

Where the GDPR or UK GDPR applies, the table at the top gives the legal basis for each use:

• Legitimate interests: running and securing the site, counting visits in total, finding and fixing errors, and reading and replying to feedback. I keep this light: no cookies, no IP addresses in stored records, and short log periods.
• Consent: for the email address you choose to add to feedback. You can withdraw it at any time by asking me to delete it.
• Legal obligation: for handling privacy requests, and anything the law requires me to keep.

Is any of this required? You don't have to give me anything to use the site. Logs and error reports happen automatically when you use it, and so do visit statistics unless you turn them off. To send feedback, you need to write a message or name a product. Your email is optional, but without it I can't reply.

I don't make automated decisions about you or build profiles.

Your right to object

You can object at any time to my use of your information based on legitimate interests, on grounds relating to your situation. Email privacy@stacklet.app. I'll stop unless I have compelling legitimate grounds that override your interests, or I need the information for legal claims. To stop visit statistics yourself, switch off Count my visits in About, or turn on Global Privacy Control (see Visit statistics).

Your rights

Wherever you live, you can ask me to:

• Access: tell you what personal information I have about you, and give you a copy in a portable format;
• Correct: fix it;
• Delete: erase it;
• Restrict or object: limit or stop how I use it;
• Withdraw consent: stop using the email address you gave me.

EU and UK. These are your rights under the GDPR and UK GDPR. You can also complain to a data protection authority, for example where you live or work:

• EU: list of authorities
• UK: the ICO

I'd welcome the chance to put things right first. If you complain to me at privacy@stacklet.app, I'll acknowledge it within 30 days and tell you what I find and do.

United States, including California. You have the right to:

• know what personal information I collect, use and disclose;
• delete it;
• correct it;
• opt out of its sale or sharing (there is nothing to opt out of, because I don't sell or share it);
• limit the use of sensitive personal information (I don't collect or use any);
• not be treated differently for using these rights.

How to make a request:

• Where: email privacy@stacklet.app. Requests are free.
• When: I'll reply within one month.
• Checking it's you: I don't keep names or accounts. To find what you sent, I may ask for the email address you used, or roughly when you sent it and what it said. I ask only for what I need and use it only for your request.
• Analytics and logs: these aren't linked to individuals, so I usually can't find one person in them. If you give me extra details that would identify your records, I'll use them.
• Someone acting for you: an authorized agent can make a request on your behalf. I may ask for proof that you authorized them.

Using your rights never changes how the site works for you.

California privacy notice

These are the categories of personal information collected in the past 12 months, named as the California Consumer Privacy Act names them:

A message can also contain anything else you choose to write. I handle it as feedback, as described above. Google receives information only as my email provider (see My inbox); the others are service providers.

• No sale or sharing. I do not sell or share personal information, and I haven't in the past 12 months. I have no actual knowledge of selling or sharing the personal information of anyone under 16.
• No sensitive information. I don't collect or use sensitive personal information to infer anything about you.
• Retention: each category is kept for the periods in the table at the top of this policy.

Do Not Track and Global Privacy Control

• Do Not Track: there is no agreed standard for these browser signals. This site works the same way whether or not it receives one.
• Global Privacy Control: I don't sell or share personal information, so every visitor is already opted out of that. I also treat the signal as a request not to be counted: with it on, your browser sends no visit statistics or usage events.
• Tracking across sites: while you use this site, no third party collects personal information about you across other websites through it. If you click an affiliate link, the network and brand can collect information on their own sites under their own policies (see Store links and affiliate links).

Children

This site is for a general audience and isn't directed to children under 13. I don't knowingly collect personal information from children under 13. If you think a child has sent me personal information, email privacy@stacklet.app and I'll delete it.

If you're under 16 and live in the EU, please ask a parent or guardian before you send feedback that includes your email address.

Security

The site uses HTTPS everywhere. Feedback and error reports are kept in a private store that only I can read, IP addresses are never saved with them, and the forms have spam and rate limits. No system is perfectly secure; if you find a security problem, please email privacy@stacklet.app.

Changes to this policy

When I change this policy, I'll update the date at the top. If a change is significant, I'll also say so at the top of this page for at least 30 days.

Contact

Nick Neely · Iowa, USA · privacy@stacklet.app