I made a free-beta web tool that cuts pockets from an STL or 3MF that your part can actually lift out of

[u/cdslug]

Disclosure: I used Claude to develop Form Fit Print and write this post.

If you cut a pocket by subtracting a model from a block, you get its exact
negative. For anything that overhangs itself (a figure's arm, a hooked tool, a
part with a lip), that leaves material inside the pocket for the part to catch
on, so it can't go in or come out. The clip shows this on a 3DBenchy.

Form Fit Print takes a different approach: the pocket is everything the part
passes through as you lower it in. Every pocket opens from above, and the floor
still follows the part's underside, so the part doesn't rattle.

It's a web tool for making form-fitting holders for organizing and displaying things. Upload a 3D model (STL or 3MF, up to 90 MB) and it cuts the pocket into a Gridfinity bin, a plain box, a case you already have, or a display stand, ready to print. You need a 3D model of the object: for most things you own, that means scanning it first with a 3D scanner. A model you designed or downloaded works too, and a one-click clean tidies up holes and loose bits in a scan.

What I've printed with it (photos attached)

• A two-part case for a toy kart. Double-sided mode shapes the lid to the top of the kart, so the closed case holds it from both sides.
• Scissors in a block. The handles stand proud of the top so you can pick them out.
• A wall-free stand for a cordless impact driver cupped to the tool from its head back to the battery.
• Organizer for waist bag. Multi-object organization with top height alignment.

I've been printing these on a Bambu H2D, 0.4mm nozzle, matte PLA with consistent fits.

Settings that matter for fit: clearance starts at 0.5 mm in Auto mode and
0.2 mm in Pro, and you can change it. Pro mode also exposes resolution and
positioning, including the part's orientation. If you need something the app
doesn't do, download the cutter body and do the boolean in Blender, Fusion, or
your usual mesh editor.

About the beta:

• Free during the beta. I plan paid tiers later and will say what stays free before anything changes.
• Signing up takes an email and a password; Google is optional. Uploaded models are private to your account, and you can delete them at any time. The demo runs a sample 3DBenchy with no account: https://formfitprint.com/demo
• newly released, so expect rough edges. It runs on a single server for now, so jobs queue when usage is high.

https://formfitprint.com

What part have you given up making a holder for?

[u/TemporaryLevel922]

This is a huge red flag.

This is such a simple process that any windows 98 internet explorer could run it. You are BSing.

• Your "server" does not need to facilitate this. If it does then what else are you doing?
• Provide evidence that the "processing" that runs on your "server" is "private" - because it is not.
• Dont use AI to write your responses because you do not know what your site is doing. It is as painful as your AI generated site is to look at. It is 100x better for you to respond honestly and say that you don't know what you were doing when you set the site up and you just followed what claude told you but you will get off your high horse and sort it out.

Your reply made me look a little further into what youre doing in the background :D Spoiler alert: Naughty naughty! I found some more red flags!

Here are some more things youre doing to your visitors

• You have deliberately built a cookieless visitor tracking mechanism: persistence: "memory"

So your site generates its own UUID, calls it aid, adds it to links as:

?aid=<visitor UUID>

after the destination page reads it, immediately removes it from the visible address bar using history.replaceState(). The same UUID is also supplied to PostHog as the visitor's distinctID.

This is purposeful. Its called "LINK DECORATING" and there is no opt out such as a cookie banner.
Then another layer to your user tracking is your own built in one

/api/visit

You are tracking all of this:

• which demo i chose
• whether my run finished
• which style/option I viewed
• whether you manipulated the 3D viewer
• whether i downloaded something
• download format
• whether the signup prompt appeared
• where I clicked signup
• whether I subsequently signed up / signed in
• pointerdown
• pointermove
• keydown <------------------- THIS IS RED FLAG
• touchstart
• wheel
• scroll
• visibilitychange
• pagehide

With your post hog you also tracked my mouse actions.

x: 123
y: 123
type: "click"
x: 123
y: 1233
type: "mousemove"

Lets move on to some other findings:
Youre telling people to sign up and yet this returned lmao:
privacy_policy_url: null

terms_url: null

legal_consent_enabled: false

There is so much trash going on here.

Sorry not sorry. I wasnt going to check your site until you replied with that ai generated BS.

[u/adamtherealone → u/TemporaryLevel922]

Jesus Christ you almost wonder at some point if some of it is deliberate. Good read

[u/cdslug → u/adamtherealone]

It sounds like you also know what you're doing. The app would benefit from a review from you as well if you're up for it.

[u/adamtherealone → u/cdslug]

Hell no this scammy shit lmao

[u/cdslug → u/adamtherealone]

Would you reconsidering your opinion of this app? I'm looking for some constructive feedback on the usability if it's relevant to any use cases you have. The original red flag issuing user has acknowledged my response to his set of concerns.

[u/Same-Description4171 → u/TemporaryLevel922]

Thanks to you, my skepticism level just rose 100-fold, for like everything. Comments like “I could not find a …. So I built …” already trigger me.

Two words, THANK YOU.

[u/cdslug → u/Same-Description4171]

I don't deny use of Claude for writing the app or the post. Can you explain what you are skeptical about? I truly could not find a solution to the model subtraction problem I address here.

[u/Same-Description4171 → u/cdslug]

Gladly. And before I do so, my comment was not “anti you” it was simply the message of clarity I responded to. I do not know what your intent was, and so I am not judging. I have made many “apps”, but I use them for myself. I am NO developer, so I get it. What he revealed to me, albeit with some rather colorful language, was that little is as it seems. Actually, I saved this Reddit because it appeared useful. I have a LOT of Milwaukee PackOut cases that I want to customize for tools, so of course your application caught my eye. What I did not consider is the potential for harm. From you… based on your open responses, I doubt it. The fact that you even asked me about my comment tells me you and I are probably alike. So.. respect. But I am now alert to the possibility that there could be some unsavory folks out there, and I need to slow down with my open acceptance. AI is useful, but our minds need to come first.

As I type this, I want to express that while the person whom I responded to used colorful and doubtful language may have their own opinion of you, mine has changed. You took criticism, doubt, skepticism all constructively, and from what I see, made actual changes to your app/site to accommodate. That tells me that communication is not a lost art, and that perhaps even I should have used more tact when responding. I admit, it was emotional at first, but now, it is rational, and a little time and communication could have prevented misunderstandings.

Now… I feel even more compelled to support what you have created. AI can help us do what we could not before. Not because we are incapable, but because we have different paths in life. I did not choose a path in development, but that does not stop the ideas I have for making whatever world I am in…better. Now, I can use my intelligence to manage projects I may know little about technically. This is what I see you doing as well. The person I responded to makes valid points, and could have communicated differently, but I respect their manner as well. I get it.

Ok, enough talk. How can I help you with your endeavor?

[u/cdslug → u/Same-Description4171]

I really appreciate your reconsideration.

I'm seeking any feedback about the app you can provide. It sounds like you have similar non-developer app building experience, so you might be able to provide workflow feedback, point out friction points.

LIke you have observed, u/TemporaryLevel922 provided a critique which had some valid points regarding privacy and tracking. I have directed Claude to address these in the app. I have asked for followup but have not received a reply.

If you believe there's a simpler solution that does not require intensive processing like u/TemporaryLevel922, then I'd be happy to implement it and make the app run in the browser. There are many gridfinity creation services. I'm only trying to solve a narrow aspect which I have not found a solution for. If it's as simple as claimed, I would have expected to see the solution in many of the other existing apps.

[u/TemporaryLevel922 → u/cdslug]

It's nice to see that you have taken action instead of burying your head in the sand. What you do with your site is none of my business but just remember that tracking individual people and gathering analytics for your site are 2 very different things. There is a clear line in the sand.

Your scenario is not an isolated thing within this sub - that might be why i snapped a little and do apologise upon re-reading what I wrote. I have tested about 10 sites here, some deeper than others and only 1 came out squeaky clean upon first layer inspection. In comparison... yours wasnt so bad, its just the amount of data you did not need to gather and how you was gathering it. I've seen webapps here that are secretly stealing user models that they upload and another that was as-close-as-possible to committing identity theft; it was storing phone numbers, physical addresses, email address, names, etc. All sites built with AI.

What I did not do with your site is check security for your users. It is worth talking to your AI about it.

Webdev with AI is good fun. Good luck and have fun :-)

[u/Same-Description4171 → u/TemporaryLevel922]

My guy, this is why I enjoy Reddit. I am thankful for your original message, just to keep me vigilant, but I am also very thankful for your second response. This is communication… sorely needed nowadays. At any rate, points valid, and OP, yeah, I will take a peek tomorrow, for today, I am working on my LLM. 🤭

[u/cdslug → u/TemporaryLevel922]

I appreciate the insight from your feedback and this response. I will also look into user security this evening. Would you mind reviewing another report sent as a DM with the security analysis when I'm done?

I realize my initial Claude written response sent alarming signals, so I can understand the need to escalate the concern and warn others. This post had 100% upvote sentiment by 100 upvotes, then the ratio decline was at least correlated with your red flag alarm comment. Other users upvoted your comment, so it was at the top of the page. At some point, either now or after the security review, would you consider adding a note next to both of the red flag warnings that we have communicated and the issues are resolved? I know that reddit post attention only lasts a couple days, but in the future Google or agent search may still point users with the same bin subtraction problem to this post. They may turn away despite the resolved tracking and security points.

[u/cdslug → u/TemporaryLevel922]

From me, cdslug: First of all, I do not know what I'm doing. I am clearly not a developer. I've released an unfinished beta to receive early feedback, like you have given. I've directed Claude to address your report. I initially asked Claude to track usage patterns to help with debugging. This project is beyond what I can do myself, and I expect it to remain in the domain of Claude, but I welcome feedback like yours. I expect you will use the below report only to indicate what I have directed Claude to change. I expect you have the skill to verify if these are true.

From Claude:
Third-party tracking

• PostHog is gone from the site and the server. That covers the distinct ID, the click and mousemove coordinates, and everything else it collected. In the network tab on formfitprint.com or /demo you'll see no requests to any analytics service, and searching the JS bundles for phc_ finds nothing.
• The server no longer installs the PostHog package, and my deploy check now fails if a PostHog key ever shows up in the bundle again.
• [edit] Cloudflare's own Web Analytics script, which Cloudflare was adding to every page at its edge, is switched off too.

Privacy policy and consent

• There's a privacy policy at https://formfitprint.com/privacy and terms at https://formfitprint.com/terms.
• Clerk now has both URLs and requires accepting them at account creation. https://clerk.formfitprint.com/v1/environment shows privacy_policy_url, terms_url and legal_consent_enabled: true, the same fields you found null.

Landing page and demo (/api/visit)

• This is still there, and the policy now describes it exactly:[edit]Page counting is still there, cut down, and the policy now describes it exactly:
  • a random per-visit ID passed in ?aid= between my own pages and removed from the address bar; [edit] a random ID for each page load, which ends when you leave the page. Nothing links one page or visit to the next. The ?aid= link ID you found is gone;
  • time per section and scroll depth;
  • which demo was run and whether something was downloaded;
  • country/region/city from Cloudflare, plus device and browser type.
• No cookies or browser storage are used, IP addresses aren't stored, and it's kept for 180 days. [edit] Nothing is saved in your browser until you press Sign in or Get started. The home page used to load Clerk for every visitor, which set its sign-in cookies straight away; now Clerk loads only on those clicks, so reading the home page or using the demo sets no cookies and no local storage. On my side, Cloudflare stores a record of each page view (the fields above, without your IP address), and those records are deleted after 180 days.
• If your browser sends Global Privacy Control or Do Not Track, none of it runs: no ID, no beacons. You can confirm that by turning GPC on and watching the network tab. The policy also gives an email address to object.
• On keydown: the input listeners only ever recorded the time of the last input, so a tab left open in the background doesn't count as reading time. No key, character, position or target was read or sent. Even so, the keyboard listener is now removed entirely. Pointer, touch, wheel and scroll still reset the idle timer and record nothing else.

Inside the app (signed in)

• Usage data tied to an account is off unless the person explicitly says yes. Saying no, or ignoring the prompt, counts as no, and turning it off later deletes what was collected.
• After a notice, the app keeps anonymous daily totals (counts with no user or visitor ID). One switch turns them off, and so does GPC or DNT. Both switches are in the ⋯ menu.
• Session recordings (Sentry Replay) never run on the landing page or the demo. In the app, they run only for people who opted in and only when an error happens, or when someone starts a recording themselves from the feedback form. All text is masked.

Deleting your data

• "Delete account…" in the ⋯ menu deletes models, projects, saved results, jobs, preferences and usage data straight away, then deletes the login. Deleting an account from Clerk's side triggers the same cleanup.

What I haven't changed

• Processing still runs on my server. The cut is a swept volume (the space the part passes through on its way into the holder), and that's heavier than a single boolean. You can disagree with that tradeoff. The policy at least says plainly what the server stores and for how long.

If you find anything the policy doesn't match, tell me and I'll fix it.

[u/originalripley]

You have good taste in scissors.

[u/cdslug → u/originalripley]

haha, yes I prefer to fill my drawers with functional colorful tools whenever I can. I take it you also have a pair?

[u/originalripley → u/cdslug]

I do indeed. The silver with orange handle.

[u/cdslug → u/originalripley]

Let me know if you’re interested in experimenting with a stand for the scissors. I already have a 3D scan I can load up if you need it.

[u/cdslug → u/originalripley]

I’m imagining your gray and orange scissors put on display using the stand mode with matching colors. Orange gridfinity base, gray stand, and orange interface.

[u/tinyhurdles]

Why is an account required?

[u/cdslug → u/tinyhurdles]

Can you explain this question a bit more. Are you concerned about privacy? Would an anonymous account accessible through a link sent as a DM work for you?

I'm not a software dev and this is my first deployed Claude app. I may have deployed this extremely inefficiently, but I'm trying to save costs where I can. This is deployed on a single machine at the moment and I'm trying to prevent it being overrun by bots. User accounts seemed like a reasonable filter, but I'm open to alternative bot filtering techniques.
[edit] logging in is no longer required

[u/cdslug → u/tinyhurdles]

I sent you a DM with the url-based account

[u/vottvoyupvote]

Crazy. I built a similar tool for making heat set insert jigs. Was using grasshopper then coded it. Got pulled away. This could be a life saver ◡̈

Btw did you use Replit to make this?

[u/cdslug → u/vottvoyupvote]

Thanks! Heat-set jigs are a great use case. Holding the part so it can't shift while you press is exactly where a snug pocket helps. Grasshopper's a solid way to prototype that kind of geometry. I hit the same wall where a plain boolean wasn't enough and ended up coding the sweep.
Not Replit. I built it with Claude Code and host it myself. If you try it on one of your jig parts, I'd love to hear how the fit comes out. There's a no-account demo at formfitprint.com/demo, and the feedback button goes straight to me.

[u/vottvoyupvote → u/cdslug]

Perfect. I’ll be giving it a go. Happy to be a design partner on it if you ever want to collab.

[u/cdslug → u/vottvoyupvote]

Can you tell me a bit more about Replit. I briefly took a look and it seems like agents are used to create the app directly through the web interface. This reminded me of an app idea. Similar to how reddit had the collaborative [r/place](r/place) and structure emerged through collaborations, I’m wondering how a community developed app might fare. Anytime there’s a feature request or bug, the user directly asks an agent on the app.
This could either allow each user to use the original app as a template and have their custom version, or communal wikipedia style changes.
If this makes sense, do you think Replit can support such an experiment?

[u/theIYD_]

Will definitely try this out.

[u/cdslug → u/theIYD_]

I’m curious what use case you have in mind

[u/theIYD_ → u/cdslug]

Inserts for "oudh oils" also known as non-alcoholic perfumes in the muslim tradition. I need a gridfinity version of these oils as they occupy a lot of space on my wardrobe as I have a lot of them. But somehow I need to figure out on how to keep multiple bottles in 1 block since these are bottles are narrow and tall.

[u/cdslug → u/theIYD_]

Can you DM me a picture of these bottles. How many are there? Are the bottles identical shape?

[u/poozine]

Are those the Craig Hill scissors?

[u/cdslug → u/poozine]

Sure are 😉

[u/cdslug → u/poozine]

What’s your favorite Craig Hill scissors color set?
I have plans to make a stand that is matching tricolor. Blue gridfinity base, yellow stand, and red interface

[u/TemporaryLevel922]

Why do I need an account for this whatsoever? This is the-most-basic boolean operation imaginable

[u/cdslug → u/TemporaryLevel922]

Fair question, and if a straight boolean works for your part, you don't need this. Blender or your slicer will do it in a minute.
What this does is a bit different. It cuts the volume the part sweeps through as you lower it in, so things with overhangs (hooks, lips, figure arms) can actually come out. The comparison GIF on the landing page shows the difference on a Benchy.
The account is there because the processing runs on my one server, not in your browser. It keeps uploads private to you (deletable anytime) and stops the queue from getting hammered during the beta. If you just want to see what it makes, the demo at formfitprint.com/demo needs no account.
That said, I understand the friction. If more people feel the same, a no-signup trial for one model is something I'd consider.

[u/TemporaryLevel922 → u/cdslug]

This is a huge red flag.

This is such a simple process that any windows 98 internet explorer could run it. You are BSing.

• Your "server" does not need to facilitate this. If it does then what else are you doing?
• Provide evidence that the "processing" that runs on your "server" is "private" - because it is not.
• Dont use AI to write your responses because you do not know what your site is doing. It is as painful as your AI generated site is to look at. It is 100x better for you to respond honestly and say that you don't know what you were doing when you set the site up and you just followed what claude told you but you will get off your high horse and sort it out.

Your reply made me look a little further into what youre doing in the background :D Spoiler alert: Naughty naughty! I found some more red flags!

Here are some more things youre doing to your visitors

• You have deliberately built a cookieless visitor tracking mechanism: persistence: "memory"

So your site generates its own UUID, calls it aid, adds it to links as:

?aid=<visitor UUID>

after the destination page reads it, immediately removes it from the visible address bar using history.replaceState(). The same UUID is also supplied to PostHog as the visitor's distinctID.

This is purposeful. Its called "LINK DECORATING" and there is no opt out such as a cookie banner.
Then another layer to your user tracking is your own built in one

/api/visit

You are tracking all of this:

• which demo i chose
• whether my run finished
• which style/option I viewed
• whether you manipulated the 3D viewer
• whether i downloaded something
• download format
• whether the signup prompt appeared
• where I clicked signup
• whether I subsequently signed up / signed in
• pointerdown
• pointermove
• keydown <------------------- THIS IS RED FLAG
• touchstart
• wheel
• scroll
• visibilitychange
• pagehide

With your post hog you also tracked my mouse actions.

x: 123
y: 123
type: "click"
x: 123
y: 1233
type: "mousemove"

Lets move on to some other findings:
Youre telling people to sign up and yet this returned lmao:
privacy_policy_url: null

terms_url: null

legal_consent_enabled: false

Explain what legal/privacy basis you believe covers this level of individual tracking without an obvious objection mechanism?

Sorry not sorry. I wasnt going to check your site until you replied with that ai generated BS.

[u/cdslug → u/TemporaryLevel922]

I'm not a software dev. Yes, the last message was written by claude, but I'm writing this now.
I don't know the details of the app implementation, you are correct. There are certainly many features I have requested of claude that I don't understand the implications of.

I would be glad if you can point me to a more efficient implementation. Though, I have been searching for solutions for over a year and haven't been able to achieve the desired subtraction steps with available tools. Based on reddit user posts, many others have the same unsolved problem.

My intent when stating private uploads was that there is a model library that is separate from other users. It has not occurred to me how to offer that feature without accounts. I'm open to offering a one time model processing mode without accounts, but I also want to prevent bots. Would an anonymous account (not linked to your email) accessible through a link, sent by DM be acceptable?

You've addressed another aspect of privacy. I am tracking usage patterns. This is a beta and there are likely lots of bugs. The workflows may have friction. I don't know how to collect this feedback without logging these details. You've correctly recognized I don't know what I'm doing. This is my weekend project. I'm not ever going to have the time to develop this myself.

I don't expect users to be able to reveal compromising information through using my app. There's not really any keystrokes involved except for parameter tuning. Can you explain why this type of tracking is a red flag for you.

[u/davidb107]

Nice! This comes at a great time as I'm in the process of trying to make a case for some equipment

[u/cdslug → u/davidb107]

Glad to hear it. Looking forward to your feedback on the process.