Legal

Privacy Policy

Last updated: 22 August 2026. This is the product-side privacy policy draft for launch and should receive legal review.

Data we process

We process account details, payment identifiers supplied by Stripe, uploaded images, generated model files, job status, and limited anti-abuse data such as a hashed/lifetime KV marker tied to an IP address for the anonymous demo.

Retention

Paid-account uploads and generated outputs are retained for 30 days for re-download. Free-demo inputs and outputs are retained for 7 days. We do not use uploads or outputs to train models unless you explicitly opt in. We may keep limited records required for security, fraud prevention, or legal obligations.

Storage and processors

Files are stored in Cloudflare R2. Generation requests are sent to Replicate. Payments are processed by Stripe. We share only the information required for those providers to perform their service.

Your choices

You can request access, export, correction, or deletion of your personal data. Account deletion is intended to physically delete account data and associated private files, not merely hide them. Use the contact form for a data request while the account-deletion workflow is being completed.

Security

Generation outputs are served through an authenticated or token-authorised Worker proxy; we do not expose public, guessable R2 object URLs. No internet transmission or storage system can be guaranteed completely secure.

Contact

For privacy questions, use the contact form. Messages are stored and read directly; there is no published support address yet because the domain is not connected.