Privacy policy

01Summary

Your projects are saved in your browser, not on our servers.

We hold an email address for your account, the status of your subscription, and content-free records of AI requests.

When you use an AI feature, only the content that request needs is sent to our AI providers.

We do not sell your personal data or use advertising cookies. We use Google Analytics to measure visits to public website pages only after you consent, and Cloudflare Web Analytics to count visits without cookies.

02Data that stays on your device

Your projects, imported files, edit history, generated results and Agent conversations are saved in your browser’s local storage on your device. They are not uploaded to us for storage, and we cannot view, restore or delete them. You can remove them by clearing this site’s data in your browser.

03Personal data we collect

Account data: your email address, the date your account was created, whether your email is verified, and sign-in session data.

Subscription data: the identifiers and status of your customer record and subscription at Paddle, your billing period dates, and records of refunds or payment disputes. We do not receive or store your card number or other payment credentials.

AI usage records: for each AI request, an identifier, its type and state, timestamps, its cost, and a cryptographic fingerprint of the request. These records do not contain your project, your instructions or any image.

Technical data: our hosting provider processes IP addresses and request metadata in order to deliver and protect the Service.

Website analytics (with your consent): public page views, referring website domains, browser and device information, and approximate location. Google Analytics uses cookies to distinguish visitors. We do not send email addresses, project identifiers, creative content, URL query parameters or fragments, or measure sign-in, account, checkout or editor pages.

Cookieless website statistics: Cloudflare Web Analytics records, for public website pages, the page address, the referring website, browser and device type, country, and how quickly the page loaded. It does not use cookies or local storage, does not identify individual visitors, and does not measure sign-in, account, checkout or editor pages.

Communications: the content of messages you send us.

04Content processed for AI features

When you use an AI feature, the content that the request needs — for example your instruction, a description of the layers involved, or the picture to be separated — is sent through our server to our AI providers to produce the result. We process it only for the duration of that request and do not write it to our logs or databases. We do not use it to train AI models.

AI providers may retain request data for a limited period under their own policies, for example to detect abuse. We do not control that retention and cannot guarantee that providers retain nothing.

05How we use personal data and our legal bases

To provide the Service and your account, verify your subscription before running paid features, and measure usage against your allowance (performance of our contract with you).

To secure the Service, prevent fraud and abuse including refund abuse, reconcile billing, and respond to your messages (our legitimate interests in running a safe and sustainable service).

To keep accounting records and comply with legal requests (legal obligation).

To understand visits to public website pages and improve the website, based on your consent. You can withdraw consent at any time using Cookie settings in the footer.

To count visits to public website pages and measure how quickly they load, using the cookieless statistics described above (our legitimate interest in running and improving the website).

06Who we share data with

We share personal data only with service providers that process it on our behalf or as described below:

Supabase — account authentication and the database that holds account, subscription and usage records.

Paddle — checkout, payments, invoicing, tax and refunds. Paddle acts as Merchant of Record and is an independent controller of the payment data it collects. When a refund is requested, we may tell Paddle how much of the period’s usage allowance has been used.

Vercel (AI Gateway) and OpenAI — processing of AI requests.

Cloudflare — hosting, content delivery, security and cookieless website statistics.

Resend — delivery of account emails such as verification and password reset.

Google (Google Analytics) — website analytics, only after you consent.

We may also disclose data where required by law or to protect our rights. We do not sell personal data or share it for cross-context behavioural advertising.

07Cookies

Necessary cookies keep you signed in and remember your language. You can optionally allow Google Analytics cookies to measure public website visits. Rejecting them does not affect use of the website or editor. Change your choice using Cookie settings in the footer; withdrawing consent stops measurement and removes accessible Google Analytics cookies for this site. We remember your choice in local storage and do not use advertising cookies. Cloudflare’s cookieless statistics (section 3) use no cookies and are not affected by this choice.

08Retention

Account, subscription and usage records are kept while your account exists and afterwards for as long as required for accounting, tax and dispute purposes. Messages you send us are kept for as long as needed to handle them. Content processed for AI features is not retained by us after the request completes.

09Security

Data is encrypted in transit. Access to account and billing records is restricted to server-side code, and records are separated by account. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10International transfers

Our service providers operate in several countries, so personal data may be processed outside the country where you live. Where required, such transfers rely on appropriate safeguards provided by those providers, such as standard contractual clauses.

11Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to certain processing, and to withdraw consent. To exercise these rights or to delete your account, email us. We respond within 30 days. We may need to keep certain records where the law requires it.

You may also lodge a complaint with the data protection authority where you live.

12Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

13Changes to this policy

We may update this policy. If a change is material, we will notify account holders by email or in the Service. The date at the top of this page shows the current version.