Privacy policy

What is collected

Three things, and nothing else is asked for.

• Your name, email address and profile picture, from Google when you sign in. Sign-in requests only the openid, email and profile scopes — no access to your Google account beyond identifying you.
• The photographs you upload: the face you want in the picture, and any garment photograph you supply. Plus the photographs the studio generates for you, and any video clips made from them.
• Payment metadata from Razorpay when you buy credits — the order and payment identifiers, the amount, and whether it succeeded. Your card details are never sent to this server and are never stored here.

How photographs are stored

Generated photographs, saved faces and video clips are encrypted with AES-256-GCM and held as ciphertext in the database. They are not written to disk as image files, and they are not served from a public URL.

A picture is readable only through a route that requires you to be signed in, and the ownership check is part of the database query rather than something applied afterwards — a request for somebody else's photograph does not find a row to decrypt.

Be clear about what that protects against. Encryption at rest defends a stolen database dump, a backup, or a lifted disk volume. It does not defend against a fully compromised running server, because the decryption key has to be in the server's memory for the application to work at all. Anybody who has compromised the machine has the key.

One historical exception, stated because it is still true of some rows: face photographs uploaded before encryption shipped are stored unencrypted, and the read path serves them as they are rather than failing. They are replaced with encrypted versions as those accounts upload again.

Who else sees your data

Generating a photograph means sending it to a model provider. There is no way to do that on our own hardware, so the honest statement is who receives what:

• OpenRouter — receives the photographs you upload and the text prompt built from your choices, in order to run the image, video and text models. It routes on to the underlying model provider.
• Razorpay — handles payment. You enter card or UPI details on Razorpay's own checkout, never on this site.
• Google — provides sign-in. It learns that you signed in to this application.
• Google Analytics 4 — see the cookies section below.

Cookies and analytics

A session cookie keeps you signed in. It is required for the application to function and cannot be turned off while you are using it.

Google Analytics 4 is loaded on the public pages and records page views. It sets its own cookies and its data goes to Google. No custom events describing what you generate are sent to it — only ordinary page-view tracking.

Nothing here is sold, and there is no advertising network on this site.

Administrator access

This is the uncomfortable one, and it is here because it is true. An administrator of this service can view a stored photograph through the admin console. Every such view writes an audit log line recording who looked, at which photograph, and whose account it belongs to.

That access is not new capability — whoever runs the server already holds the encryption key and could read the database directly. The console makes it convenient, which is exactly why the logging is not optional. Saved face photographs are deliberately outside what the admin console can browse.

Abuse prevention

The free welcome credits are granted once per person. To make that mean anything, the email address is normalised before it is recorded — lowercased, and for Gmail addresses only, with dots and any plus-suffix removed — so the same inbox cannot claim the grant repeatedly.

The IP address a new account is created from is recorded as a keyed hash, never in plain form, and is used only to limit how many free trials one address can start in a day. A refused trial refuses a gift, never the service: an account that does not qualify for free credits can still be created, can buy credits, and works normally.

How long it is kept, and deleting it

Photographs and clips are kept until you delete them. You can delete any generated photograph or clip from your gallery, and deletion removes the row, ciphertext and all.

There is no automatic expiry and no scheduled purge — said plainly, because the tidier claim of a fixed retention window would not be true.

To have your account and everything in it removed, email sachinkumar.webdev@gmail.com. Deletion covers your photographs, clips, saved faces and account record. Payment records are kept where financial and tax law requires.

Your rights

You can ask what is held about you, ask for it to be corrected, and ask for it to be deleted. Email sachinkumar.webdev@gmail.com and expect a reply within two working days.