Privacy policy

An account holds an email address. A workspace holds the prompts you write, the settings each generation ran with, the media it produced, any images you upload as references or elements, and a ledger of every credit movement.

Prompts are kept alongside their results deliberately, so a generation can be reproduced or rerun. That means a prompt is as durable as the image it made.

Prompts and attached images are sent to the provider hosting the model you chose. Media is stored in a private bucket and served over short-lived signed links, so a URL that leaks stops working rather than staying public.

The named list of providers and sub-processors, where each is located, and the transfer mechanism for anything leaving the EEA. This has to be a list, not a category.

Reads are scoped to a workspace by construction — there is no query in the application that returns another workspace's media. The one exception is deliberate: work published to the front page, which only happens when someone explicitly puts it there.

Retention periods for media, prompts, the credit ledger and logs, and what deletion actually removes. Deleting a generation currently marks it deleted rather than erasing the stored object, and a policy has to say that plainly or be wrong.

Access, correction, deletion, portability and objection — how each is exercised and how quickly. Requires a real contact address and someone who answers it.

What is set and why. As of now the app sets a session cookie for sign-in and runs no analytics; if that changes this section changes with it, and a consent banner may become necessary.