Privacy Policy

01The short version

This is a summary for convenience, not a substitute for the sections below.

02Who we are

SpoolBase is a filament inventory service for owners of Bambu Lab 3D printers. It is operated by , a limited liability company formed in , doing business as SpoolBase. In this policy, “we”, “us” and “our” mean that company; “you” means the person using the service.

This policy covers the SpoolBase website at , the SpoolBase web application, and the SpoolBase mobile apps for iOS and Android. Together we call these the Service.

For anything in this policy, including privacy requests, write to . If you are in the EU or UK, we are the controller of your personal data for the purposes of the GDPR and UK GDPR.

SpoolBase is an independent product. We are not affiliated with, endorsed by, or sponsored by Bambu Lab, and this policy does not cover anything Bambu Lab does with your data. That is governed by Bambu Lab's own privacy policy.

03Information we collect

We collect only what the Service actually needs to work. Here is the complete list.

Information you give us

Information from your printer

Once you connect a Bambu Lab printer, SpoolBase listens to the data stream your printer publishes to Bambu Lab's cloud. From that stream we record:

• Printer identity — the name you gave it, its serial number, model, and online/offline status.
• AMS contents — what is loaded in each slot: material type, colour, and the RFID tag identifiers Bambu Lab's own spools broadcast (tag UID and tray UUID). These identify a physical spool, not a person.
• Print activity — the name of each print job, when it started and finished, whether it succeeded, its progress, and the task identifier Bambu Lab assigns it.
• Filament consumption — how many grams each AMS slot actually used, retrieved from Bambu Lab's cloud when a print finishes, plus the estimate Bambu Lab predicted before it started.

Information we collect automatically

• Server logs — our web server records the IP address, browser user-agent, requested address, response code, and timestamp of requests made to the Service. This is standard web-server logging, used for security and debugging.
• Application logs — diagnostic records of what the Service did and any errors it hit, which can include your account identifier, printer identifiers, and the raw RFID data your printer reported.
• Device push tokens — if you install a SpoolBase mobile app and allow notifications, we store the anonymous token Apple or Google issues for that device so we can send you a notification.

We do not collect precise location, contacts, photos, biometric data, or anything from your device beyond what is listed here.

Payment information

Paid plans are billed through Stripe. Card numbers go directly to Stripe and never touch our servers — we cannot see them. From Stripe we receive only what we need to run your subscription: which plan you are on, whether it is active, when the current period ends, the last four digits and brand of your card, and your billing country for tax purposes. If you subscribe through the Apple App Store or Google Play instead, that purchase is handled entirely by Apple or Google and we receive only a confirmation that it happened.

04Your Bambu Lab connection

This deserves its own section, because it is the most sensitive thing SpoolBase handles.

To watch your printers, SpoolBase needs access to your Bambu Lab account. When you connect it, you enter your Bambu Lab email address and password into SpoolBase. Here is exactly what happens to them:

• Your Bambu Lab password is passed straight through to Bambu Lab's own login service over an encrypted connection and then discarded. It is never written to our database, never written to a log file, and never stored anywhere on our systems in any form.
• Bambu Lab returns access and refresh tokens. Those we do store, because they are what lets SpoolBase keep listening to your printers without asking you to sign in again. They are encrypted at rest using authenticated symmetric encryption, with a key held outside the database.
• Your printer's own access token is encrypted the same way.
• We store your Bambu Lab username so the app can show you which account is connected.

We use this access for one purpose: reading your printers' status and your print history so we can track filament. We never use it to start, stop, or modify a print, to change your Bambu Lab account, or to place orders.

You can disconnect at any time from Settings. Doing so deletes the stored tokens immediately. Because they are tokens rather than your password, disconnecting is enough to end our access — but if you would like to be certain, you can also change your Bambu Lab password, which invalidates them at Bambu Lab's end.

05How we use your information

We use what we collect only for these purposes:

• To run the Service — to keep your inventory accurate, deduct filament as prints complete, match prints to the right spool, show you your history, and raise a question when a match is ambiguous.
• To manage your account — signing in, keeping you signed in, enforcing plan limits, and processing subscriptions.
• To notify you — low-stock warnings, items needing your confirmation, print completions, and important account or security messages. See section 07.
• To support you — answering your questions and investigating problems you report.
• To keep the Service secure and working — detecting abuse, rate-limiting sign-in attempts, diagnosing failures, and preventing fraud.
• To improve the product — understanding, in aggregate, which features are used and where the Service is getting things wrong. We do this from our own operational data, not from third-party tracking.
• To build the shared filament library — when your printer reports a Bambu Lab filament we have not catalogued, we add that material and colour to a library shared by all users. This records the filament, not you: the entry contains a part number, material and colour, and is not linked to your account in anything we show anyone.
• To meet legal obligations — tax records, responding to lawful requests, and enforcing our Terms of Service.

We do not use your data to train machine-learning models, and we do not make automated decisions about you that produce legal or similarly significant effects.

06Legal bases for processing

If you are in the European Economic Area, the United Kingdom, or Switzerland, we must tell you the legal basis on which we process your personal data. They are:

07Email and notifications

We separate two kinds of message, and treat them differently.

Service messages

These relate to your account and are part of providing the Service: confirming your email, resetting your password, security alerts, receipts and renewal notices, notices of material changes to this policy or our Terms, and warnings that something needs your attention. You cannot unsubscribe from these while you have an account, because they are how we tell you things you need to know. We keep them infrequent.

Product and marketing messages

News about new features, tips, and occasional product announcements. We send these only if you have opted in, and every one of them carries a one-click unsubscribe. Opting out of these never affects your service messages, and we will not ask you again after you unsubscribe. We do not sell, rent, or share your email address with anyone for their own marketing.

Push notifications

If you use a SpoolBase mobile app, you can allow push notifications for things like a finished print or an item waiting in your Confirmation Queue. These are delivered through Apple's and Google's push services. You can turn them off in your device settings or in SpoolBase's own notification settings at any time.

08What we don't do

These are commitments, not descriptions of a current mood:

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under California law and comparable state laws. We never have.
• We run no advertising on the Service.
• We use no third-party analytics — no Google Analytics, no advertising pixels, no session-recording tools, no fingerprinting, and no data-broker enrichment of your account.
• We set no tracking cookies. See our Cookies & Tracking notice for the full detail of the handful of things we do store in your browser.
• We do not use your data to train AI models, ours or anyone else's.

If any of this ever changes, we will say so clearly in advance — not by quietly editing this page. Adding third-party analytics or any form of advertising would be a material change under section 19, which means notice to you before it takes effect.

09Who we share information with

We share personal information only with the service providers below, only to the extent they need it to do their job for us, and only under contracts that require them to protect it and forbid them using it for their own purposes.

We will keep this list current. Where required, we will give notice before adding a new provider that processes personal data.

Beyond these providers, we may disclose information in three narrow circumstances:

• When the law requires it — in response to a valid subpoena, warrant, court order, or other lawful request. We will review each request, push back on any that is overbroad, and notify you unless we are legally prohibited from doing so.
• To protect people — where we believe in good faith that disclosure is necessary to prevent physical harm, financial loss, or a crime.
• In a business transfer — if SpoolBase is acquired, merged, or its assets sold, your information may transfer as part of that. We will notify you beforehand, and any acquirer will be bound by this policy or one at least as protective until you are told otherwise and given a chance to leave.

10International data transfers

SpoolBase's servers are in the United States. If you use the Service from outside the US, your information is transferred to and processed there, which may have data-protection laws that differ from your own.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum, where applicable), together with the technical measures described in section 12. You can request a copy of the relevant safeguards by writing to .

11How long we keep information

We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires.

12How we protect your information

Technical and organisational measures we have in place today:

• All traffic to the Service is encrypted in transit with TLS. The site is HTTPS-only.
• Passwords are stored as bcrypt hashes and are not recoverable, by us or by anyone who obtains the database. Passwords must be at least eight characters and include an uppercase letter and a digit.
• Bambu Lab tokens and printer access tokens are encrypted at rest with authenticated symmetric encryption, using a key stored outside the database and not included in database backups.
• Sign-in sessions use short-lived access tokens with separate refresh tokens.
• Sign-in and registration are rate-limited to blunt automated attacks.
• Every query is scoped to your own account; the Service has no facility for one user to read another's inventory.
• Databases are backed up nightly and restores are tested.
• Administrative access to production is limited to personnel who need it.

No system is perfectly secure, and we will not pretend otherwise. What we can promise is that we do not collect data we do not need, we encrypt the most sensitive thing we hold, and we will tell you promptly if something goes wrong — see section 18.

You can help: use a password you use nowhere else, and do not share your account.

13Deleting your account

You can delete your account yourself, from Settings in the web app or the mobile app. You do not need to email us or explain why. Here is what happens:

• Immediately — your account is deactivated and you are signed out. It stops being visible or usable, and your stored Bambu Lab and printer tokens are deleted, ending our access to your printers.
• For 30 days — your data is retained but inaccessible, so that you can contact us and have the account restored if you deleted it by mistake or someone else deleted it.
• After 30 days — your account and all personal data associated with it are permanently erased from our live systems.
• Within a further 14 days — the erasure works through our rolling backups, after which no copy remains.

If you want the 30-day window skipped and your data erased right away, tell us at and we will do it.

Two things survive deletion, and we want to be straightforward about both. Payment and tax records are kept for as long as tax law requires. And entries added to the shared filament library stay, because they describe a filament product rather than a person and other users' inventories depend on them.

14Your privacy rights

Depending on where you live, you have some or all of the rights below. We extend the core rights — access, correction, deletion, and portability — to every SpoolBase user regardless of location, because drawing a line through our users based on their postcode is not something we want to do.

If you are in the EEA, UK, or Switzerland

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted, subject to the legal retention noted above.
• Restriction — have us pause processing while a dispute is resolved.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — at any time, where we relied on it.
• Complain — to your national supervisory authority. In the UK that is the Information Commissioner's Office. We would appreciate the chance to put it right first, but this is your right and you do not need our permission.

If you are in California

Under the California Consumer Privacy Act as amended by the CPRA, you have the right to know what we collect and why, to access it, to correct it, to delete it, and to limit the use of sensitive personal information. You also have the right to opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of. We will not discriminate against you for exercising any of these rights: your service and pricing stay exactly the same. In the twelve months before the effective date of this policy, we disclosed personal information only to the service providers listed in section 09, and sold or shared none. An authorised agent may make a request on your behalf with written proof of authority.

If you are in Virginia, Colorado, Connecticut, Utah, or another US state with a comprehensive privacy law

You have the rights to confirm whether we process your data, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects. We do none of those three things. If we deny a request, you may appeal by replying to our decision or writing to with “Privacy Appeal” in the subject. We will respond to an appeal within 45 days and, if we still say no, tell you how to complain to your state Attorney General.

If you are in Canada

Under PIPEDA you may access the personal information we hold about you, challenge its accuracy, and withdraw consent subject to legal and contractual limits. You may also complain to the Office of the Privacy Commissioner of Canada.

If you are in Australia, Japan, Brazil, or elsewhere

Local law may give you similar rights. Write to us and we will honour them, and in any case we will apply the core rights above.

15How to exercise your rights

Most of it you can do yourself, without asking us:

• Access and correction — your account details, spools, printers and print history are all visible and editable in the app.
• Deletion — Settings, then delete your account. See section 13.
• Withdrawing consent — turn off notifications in the app or your device settings; unsubscribe from any marketing email using the link in it.
• Disconnecting Bambu Lab — Settings, disconnect. Tokens are deleted at once.

For anything else — a full export, a restriction, an objection, or a request you would rather we handled — email from the address on your account.

We will acknowledge within 10 days and respond substantively within 30 days for most requests, and within 45 days where California, Virginia, Colorado, Connecticut or Utah law applies. If a request is genuinely complex we may extend once, and we will tell you why before we do. There is no charge, unless a request is manifestly unfounded or repetitive, in which case we will tell you the cost before doing anything.

We may need to verify it is really you. Normally, being able to act from the account's email address is enough. For a deletion or a full export we may ask you to confirm from that address. We will not demand identity documents for a routine request.

16Children's privacy

SpoolBase is not intended for children. You must be at least 16 years old to create an account, and at least 18 to buy a paid plan. We do not knowingly collect personal information from anyone under 16, and the Service is not directed at children under 13 within the meaning of the US Children's Online Privacy Protection Act.

If you believe a child has given us personal information, write to and we will delete the account and its data promptly.

17Do Not Track and Global Privacy Control

Some browsers send a “Do Not Track” signal or a Global Privacy Control signal. There is no consistent industry standard for what Do Not Track means, so most services ignore it. We do not need to interpret either signal, because SpoolBase does not track you across sites and does not sell or share personal information under any circumstances. Sending a GPC signal changes nothing about how we handle your data, because there is nothing for it to switch off.

18Security disclosure and breach notification

Reporting a vulnerability

If you have found a security flaw in SpoolBase, please tell us at with “Security” in the subject line. Give us enough detail to reproduce it. We aim to acknowledge within 3 business days and keep you updated until it is resolved.

We will not pursue legal action against anyone who reports a flaw in good faith, gives us reasonable time to fix it before going public, works only against their own account, and does not access, modify, or destroy another user's data or degrade the Service for anyone else. We do not currently run a paid bug bounty, but we will credit you if you would like.

If something goes wrong

If a security incident affects your personal information, we will notify you within 72 hours of confirming it and tell you what happened, what data was involved, what we have done, and what you should do. We will notify supervisory authorities within the deadlines the law sets. We commit to telling you even where the law does not strictly require it — if your data was involved, you should hear it from us.

19Changes to this policy

We will update this policy as the Service changes. When we do, we will change the “Last updated” date at the top and keep the current version at this address.

For a material change — one that expands what we collect, adds a new purpose, adds a new category of recipient, or reduces your rights — we will give you at least 30 days' notice before it takes effect, by email to your account address and by a notice in the app. If you do not agree with a change, you can delete your account before it takes effect; continuing to use SpoolBase afterwards means you accept it.

We will not apply a material change retroactively to data we already collected under an earlier version of this policy without asking you first.

20Contact us

Questions, requests, or complaints about privacy all go to the same place:

Related documents: Terms of Service, Cookies & Tracking, and Refund Policy.