Privacy Policy

Account information: email, display name, login sessions, user group, account status, registration region, and current region.

Acquisition information: UTM parameters, external referrer host, landing-page path, capture time, and region for public-page entries. We do not store full referrer URLs or ad click identifiers; we record only whether an ad parameter is present.

Creation information: projects, prompts, uploaded assets, generated media, parameters, errors, and historical usage.

Billing information: Stripe customer, Checkout Session and payment identifiers; purchase orders; region, currency, and price-version snapshots; credit balances, expiration, and ledger entries. Full card details are handled by Stripe and are not stored by us.

Security information: IP addresses and necessary browser, device, and network signals may be processed to prevent automated abuse.

We use information for login, project isolation, generation tasks, asset management, credit purchases and debits, payment-status synchronization, support, abuse prevention, security audits, and service improvement.

We use necessary cookies and local storage for session state, language preferences, and workspace preferences.

We use first-party anonymous analytics cookies to understand acquisition channels and associate registration sources. The visitor identifier lasts 90 days and the visit identifier expires after 30 minutes of inactivity.

One-time payments are handled by Stripe. AI generation, object storage, thumbnails, and infrastructure may use cloud services or model providers.

Login and registration pages use Cloudflare Turnstile to identify automated abuse. Cloudflare processes the browser, device, and network signals needed to perform the security check.

We provide these services only the information needed to perform the requested function.

Account, project, media, and billing records are retained as needed to provide the service, audit usage, resolve disputes, and meet legal requirements.

Raw visit-source records are retained for long-term search engine optimization (SEO) and generative engine optimization (GEO) analysis and are not automatically deleted based on age. The 90-day analytics cookie and the 30-minute inactivity limit for the visit identifier govern browser identifiers, not the retention of database records.

Registration-source snapshots are retained with the account and deleted when the account is deleted.

You can request account, content, or visit-source record deletion through the support email. Some billing, anti-fraud, or compliance records may need to be retained longer.

We use access controls, server-side authorization, same-origin checks, signed webhooks, and project isolation to protect account and billing data.

No internet service can be guaranteed completely secure. Contact us promptly if you find a security issue.