Privacy Policy

1. Information Collected

• Account data (when logged in): your email address and user ID from Neon Auth, plus your login method.
• Session and authentication data: a signed HttpOnly anonymous session cookie for pass purchasers, and authentication cookies when you are logged in.
• Credits and orders: credit balance, credit movements (holds, consumption, automatic returns) and order metadata (product, amount, credit amount, status, transaction identifiers).
• Uploads: the photo you upload and the template you select.
• Generation data: generated results, task IDs, generation parameters (model tier, duration, resolution) and task status.
• Technical logs: IP address and standard server logs needed to operate and secure the service.
• Support and reports: the content of emails and violation reports you send us.

2. Third-Party Services

• Neon — authentication (email sign-in codes) and database (accounts, credits, orders, pass records and task records).
• Waffo — payment and checkout processing when purchases are enabled.
• AI video provider — not yet finalized. When generation is enabled, your uploaded photo and generation parameters will be sent to the AI provider for processing. The specific provider and its data practices will be disclosed here before launch.
• File storage provider — not yet finalized. Uploaded photos and generated videos will be stored in private, access-controlled storage. The specific provider will be disclosed here before launch.
• Vercel — website hosting and server-side execution.
• Plausible — privacy-friendly web analytics (aggregate page views, cookieless), served from our own analytics domain.

3. AI Processing

To generate your video, your uploaded photo and the generation parameters are sent to our AI provider for processing. The AI provider may process this data in accordance with its own terms and policies.

We do not claim that the AI provider applies zero data retention, never uses data for model training, or deletes data immediately and permanently, and uploads are not end-to-end encrypted. The specific provider's data practices will be disclosed before generation goes live.

4. Data Retention and Deletion

Uploaded photos: stored in private storage and shared with the AI provider only through short-lived access links. Photos are deleted once the generation task reaches its final state (success or failure). Retention periods for edge cases will be confirmed before launch.

Generated videos: kept in private storage so you can download them. Automatic deletion periods will be confirmed before launch. You can request deletion at any time.

Account, order and task records: kept while your account is active. Order and transaction records are retained as needed for accounting, dispute handling, fraud prevention and legal obligations.

Deletion requests: email us to request deletion of your photos, generated videos, task records or account data. We review and complete verified deletion requests promptly, except where we must retain records for legal, security or dispute purposes.

5. Security

Photos and results are stored in private, access-controlled storage. Downloads use short-lived signed links. Database access is scoped to the service's server-side components. Sessions use signed, HttpOnly cookies. The site is served over HTTPS.

6. User Rights

Subject to applicable law, you can request access to, correction of or deletion of your personal data, and can withdraw consent for future processing by stopping use of the service. We may ask you to verify your identity before acting.

7. Contact and Changes

Privacy questions, deletion requests and reports: [email protected]. If this policy changes materially, we will update this page before the changes take effect.