Writing · 17 October 2026

How credits and stored photographs work

Credits are taken before the model runs and returned if it fails. The photograph is encrypted, and an administrator can open it only if you turn sharing on.

---

Two questions come up as soon as a picture looks like a real person. What did that cost, and who can open the file afterwards?

Both answers are more specific than the usual privacy paragraph, and both are enforced in the software rather than promised beside it.

What a credit is

One credit is a fixed slice of model spend. The price of a generation is rounded up, so a cheap tier is not run at a loss. The number on the studio is the number the server charges. Prices can change without a new release of the site, because the list the page shows is the list the charge reads.

Credits are taken before the model is called. If the call fails, the same debit is reversed once. A retry does not refund a second time, and it does not charge you for a picture that never came back.

The balance is the sum of the ledger. There is no column someone can overwrite with a new total. That is what stops ten requests, all reading the same balance, from all spending it.

A new account is given welcome credits once per inbox. A second Gmail that is the same inbox with a dot or a plus-suffix does not get a second gift. An account that is refused the gift can still buy credits and use them. The refusal is of the free grant, not of the studio.

Where the photograph goes

The picture is encrypted with AES-256-GCM and stored as ciphertext. It is not a file in a public folder. The route that decrypts it checks that the row belongs to the signed-in account as part of the query. A request for somebody else's photograph does not find a row.

An administrator can open one only if you turn sharing on. The switch starts off. Turning it off stops the console from returning the picture. Every open that does succeed writes a log line naming who looked and whose photograph it was.

Encryption protects a stolen database, a backup, or a disk. It does not protect a running server that an attacker already controls, because the key has to be in memory for the application to decrypt anything. That limit is the reason the policy says it out loud.

You can delete a generated photograph from the gallery. Deleting the account itself is a request to support, described on the data deletion page, because there is no button that erases the account on its own.