Privacy policy
How your information moves through this workspace.
Your account
Sign-in uses Google. We receive your verified email address and Google account identifier to create or recognize your workspace, plus your display name and profile picture for your account menu. We do not receive your Google password or request access to Gmail, Drive, or contacts. Sessions use an HTTP-only cookie. The browser stores draft prompts locally so they remain available when you return.
Signup credits
Welcome credits are a one-time registration offer for eligible new accounts. We store keyed fingerprints of your Google account identifier and normalized email with the award decision and time to prevent repeat claims. Repeat sign-ins do not award additional welcome credits. Minimal eligibility records may remain after account deletion. These fingerprints are pseudonymous records, not anonymous data.
Images and prompts
When you submit a generation or edit, we store your prompt, settings and task history in your private workspace. Uploaded reference images and generated images are stored privately in Cloudflare R2. Reference images and the text needed to process your request are sent to fal and its model providers. Image access requires a signed-in ownership check and uses temporary image links; anyone you share such a link with may access it until it expires.
Content review
Before generation, we send the complete generation text, including region-edit instructions, and an internal request identifier to Creem for prompt review. Images are not sent to this review endpoint. We retain a hash of the reviewed request, the decision, review receipt identifiers, usage and time for service operation and review. These separate review records do not contain the original prompt text. A request that fails prompt review does not start generation or charge credits.
Payments
Creem processes credit-pack payments. We send the selected product, checkout amount, account email and internal order identifiers to create a checkout. We store order, payment, credit and refund records to deliver your purchase and provide support. This application does not store your full payment card details.
Service providers
The service uses Google for sign-in, Cloudflare for traffic delivery and private image storage, fal and its model providers for generation, Creem for payments and prompt review, and hosting and PostgreSQL database providers. Their processing locations and retention policies may differ. Their respective privacy policies apply to their processing of your information.
Retention and requests
Account records, task history, images and associated prompt-review records are retained while your account is active unless removed through an account support request. Billing records may be retained when required for accounting. Use the contact page to request access, corrections, or deletion. Any backups follow the hosting provider’s retention schedule.
Cookies and local storage
A session cookie is used for authentication, with a short-lived HTTP-only cookie to bind a Google sign-in attempt to your browser. Incomplete sign-in attempts expire after ten minutes. Local storage holds separate generation and editing drafts and settings; session storage holds the latest task identifier. A selected reference image is saved in IndexedDB on this browser so you can continue after signing in. It expires after 24 hours and is removed on the next workspace load, or when you remove the reference. Selecting a file alone does not upload it to our servers. This version does not add advertising trackers or third-party analytics cookies.
Contact and updates
Contact the service through the contact page. Material changes to this policy will be reflected here. Current version: October 20, 2026.