Your model never leaves your device
Knurl Bro has no upload. The file you open is read by your own browser and everything happens right there: reading the file (STL, 3MF, OBJ, and STEP through OpenCascade compiled to WebAssembly), finding the surfaces, flattening the one you pick, laying out the diamond grooves, the live preview, building the knurled solid (Manifold, compiled to WebAssembly) and writing the STL or 3MF file, which your browser saves straight to your disk.
Nobody receives a copy: not us, not a cloud service, not an analytics company.
How that is enforced, not just promised
- No server code touches files. Apart from a small payment service, the site is static files, and nothing on the server accepts a model: the payment calls take only a fingerprint (a hash), a product name or a pack code.
- Content-Security-Policy
connect-src 'self': your browser itself refuses to send data to any other website. No third-party scripts, fonts, styles, images or frames. - No analytics, no trackers, no cookies, no CDNs. Every library is served from this site.
- Subresource Integrity: the page only runs its scripts if they match the hashes written into it when the site was built.
- Automated test: before every release, the app is driven in a real browser (open, knurl, pay, export) with every network request logged. The test fails if anything goes to another site, if any request carries more than a payment fingerprint, or if any request contains any part of the model.
- Check it yourself: open your browser's developer tools (F12, then the Network tab) while you use Knurl Bro. You'll see the site's own files load, and, only when you pay, a short request carrying the design's fingerprint. Your model file never appears in that list.
Paying for an export
Each export costs $1.30, or $5 for a pack of 10. Paying is the only time Knurl Bro talks to its own server, and what it sends is a fingerprint: a SHA-256 hash of your model and knurl settings. It identifies one design so a payment unlocks exactly that export, but nothing about the shape can be recovered from it. Card details go to Stripe's checkout page (in a new tab), never through Knurl Bro.
What our server keeps: design fingerprints, Stripe checkout ids, and pack codes with their remaining exports. No model data, no file names, no names or email addresses.
What your browser keeps (on your device only): your pack code, if you bought one; the export tokens for designs you paid for, so you can download them again for 24 hours; and, while a payment is in progress, a note of the file's name, the knurl settings and a hash of the model (never the model itself), so a phone that closes the tab can still give you the paid download when you open the same file again (kept 24 hours).