Privacy & limits

Updated October 9, 2026.

Photos and previews

Where browser storage is available, room measurements, preferences and selected comparison products are remembered on this device. New room clears that saved setup. Room photos, photo colors, AI descriptions, positioning and generated previews stay only in browser memory and clear on refresh. CeilingFit does not save photos or previews to its servers.

After you consent and choose an AI action, a resized, re-encoded room photo is sent through CeilingFit to OpenAI. A composition also sends the exact selected product image and your approximate placement point. We first check whether the ceiling is visible. Original file metadata is removed. Dimensions and other room preferences are not sent.

Only upload photos you have permission to use. Avoid people, children, private documents and sensitive details. OpenAI API content is not used for training by default unless the account has opted in. Content may be retained for abuse monitoring, generally up to 30 days, with safety and legal exceptions. Requesting store:false for analysis is not Zero Data Retention. OpenAI data controls

Five AI tries per IP each day

Analysis and composition share five attempts per public IP per day, resetting at midnight in America/Los_Angeles. Shared Wi-Fi shares the allowance. Changing networks or a VPN can change the IP; this is not a unique-person limit. A site-wide daily budget can pause AI earlier. Failed or interrupted attempts may count because the provider may already have processed them.

The application reads the hosting edge IP only to create a keyed daily token. It does not store or log the raw IP. Tokens change daily and are removed after three days when another AI request runs. We do not trust a client-supplied X-Forwarded-For value. Missing trusted edge information disables AI.

Random request IDs, timestamps, action types, status, token usage and estimated cost are retained for up to 30 days, cleaned on subsequent requests. Daily budget counters are retained for 180 days; a separate development-test budget counter prevents testing costs resetting across days. Conservative budget reservations are distinct from actual provider charges. Reports are available only through authenticated management tools.

Preview limitations

Manual overlay uses the actual product photograph with approximate background removal. AI rendering can alter product details, finish, dimensions or room geometry. Neither proves installation suitability. Check the real product image, manufacturer specifications and clearances. The pilot image model is automatically disabled before its scheduled retirement; there is no automatic model fallback.

Usage measurement

We count document entries, visible card entries and clicks on official product links. These are events, not unique people, sessions, purchases or conversions. A refresh counts another document entry; leaving and returning to a card can count another card entry. Normal re-rendering and activity heartbeats do not count new card views. Existing engaged-time measurement counts only visible, focused, recently active time.

Application analytics stores normalized page or card paths, catalog product IDs and official retailer product paths without query strings. Sources use coarse categories and domains, without referring paths, search queries or fragments. A missing referrer is direct or unknown, not proof that someone typed the address. Only a small allowlist of UTM source and medium categories is kept; campaigns, terms, content, click IDs and arbitrary values are discarded. Search referrals do not prove organic acquisition.

Country and administrative region codes are used only when available from trusted hosting-edge information. Unknown locations remain unknown. Analytics does not store raw IP addresses, GPS, photos, room inputs, account identifiers, persistent visitor IDs, cookies, fingerprints, session replay or third-party tracking scripts.

Random event receipts and legacy temporary page records expire after 24 hours. Daily aggregates expire after 180 days, cleaned on later collector activity. The new metric version records its own installation and first-event times; older missing metrics are unavailable. Explicit QA, private-test and public-preview traffic is excluded from these public event counts. Known automated clients are excluded best effort. Events may be lost, and context-menu link opens may not be observed, so counts can undercount. A queued beacon does not confirm delivery. Reports remain in authenticated management tools.

Use the measurement control to opt out on this device. Do Not Track and Global Privacy Control are respected.

Other services

The hosting provider may maintain operational logs under its own policies, including network information. Retailer links open Parrot Uncle, where its privacy and purchase policies apply.