Privacy Policy

Account data: Name, email address, profile image, hashed password (if using email login), OAuth provider ID (if using Google Sign-In), account creation date, and role.

Billing data: Plan, credit balance, transaction records, and payment provider references (e.g. Stripe customer ID). We do not store raw card numbers; payment processing is handled by our payment providers.

Generation data: Prompts, selected models, generation settings, output media URLs, media type, public/private status, and creation timestamps.

Usage data: Pages visited, features used, error logs, IP address, browser/device type, and referral source. This data is used for security, analytics, and service improvement.

Communications: Emails you send us, support requests, and opt-in email sequences.

• To provide, operate, and improve the Platform and its features
• To process payments and manage credit balances
• To send transactional emails (account creation, billing receipts, password reset)
• To send product updates and onboarding emails where you have not opted out
• To detect and prevent fraud, abuse, and security incidents
• To comply with legal obligations, enforce our Terms, and respond to lawful requests
• To display public-plan generations in community surfaces (Showcase) unless you set your generation to private

We share data with third-party providers only to the extent necessary to deliver the service. These include:

• Hosting / Infrastructure: Vercel (deployment), Neon / Supabase / PostgreSQL (database)
• AI Generation: FAL AI, RunPod, and similar providers that process your prompts and return generated media
• Authentication: NextAuth.js with Google OAuth (Google LLC)
• Payments: Stripe, Inc. and LemonSqueezy
• Email delivery: Supabase Auth via custom SMTP
• Analytics: Vercel Analytics and Google Firebase Analytics for page views, funnel tracking, and product usage measurement

Each provider is subject to its own privacy policy and data processing terms. We do not sell your personal data to third parties.

We retain your account and generation data for as long as your account is active or as needed to provide the service. Billing records and transaction logs may be retained longer for legal, tax, and audit compliance purposes.

If you delete your account, we will remove your personal data from active systems within a reasonable period, subject to retention obligations under applicable law.

We use essential cookies for authentication (session token) and security (CSRF protection). We may use additional cookies for analytics. You can control cookies through your browser settings, though disabling essential cookies may prevent login.

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data
• Object to certain processing or request restriction
• Opt out of marketing communications (unsubscribe link in every email)
• Data portability where technically feasible

To exercise any of these rights, contact us from the email address associated with your account. We will respond within 30 days.

We implement industry-standard technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), and access controls. No system is completely secure; we cannot guarantee absolute security of transmitted data.

The Platform is not intended for users under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, contact us and we will remove it promptly.

We may update this Privacy Policy at any time. The updated date at the top of this page reflects the most recent revision. Continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

For privacy-related questions or data requests, contact us via the support link in the Platform or from the email address associated with your account.