Privacy Policy

Before a generation

Photo previews happen in your browser. Selecting a file does not upload it. We do not use analytics, advertising cookies or third-party tracking scripts in this version of the site.

Your account and Google sign-in

When you choose Google sign-in, Google shares your name, email address, profile image and account identifier with us. We store your profile, provider connection and sign-in sessions in Cloudflare D1. OAuth access and refresh tokens are encrypted at rest by the authentication service. We request only your basic profile and email, not access to Gmail, Drive or your contacts.

An essential, HTTP-only cookie keeps you signed in for up to seven days and may be renewed while you use the site. Sign-in also uses a short-lived security cookie. You can change your display name, sign out other devices, or delete your account from the account page. Deletion removes your profile, provider connection and sessions from the live database; infrastructure backups may persist under the hosting provider’s retention policy. Your Google account and media already sent to Replicate are not deleted by this action.

When you confirm a generation

When live rendering is enabled, your photo and our fixed reference are sent to Replicate to generate two parts of a 23-second video. See Replicate’s privacy policy for provider processing. Provider deletion and retention are separate from our storage. A clearly labelled local simulation does not send media to a model.

Your saved video

We keep your job status and provider task identifiers in Cloudflare D1, and your photo and finished video in private Cloudflare R2 storage. Only your signed-in account can check or download your video. Access expires 24 hours after submission. An hourly cleanup removes expired job media and metadata; service interruptions can delay deletion. Temporary processing files are removed after delivery or cleaned up after 24 hours while the processor is running. Download a copy of your result before access expires.

The browser keeps a request identifier and account identifier in session storage to recover a submission or check progress after a reload. It does not save your photo or access code there. Deleting your account revokes access immediately; remaining job files follow the same expiry and cleanup schedule.

Generation credits

We store credit purchases and usage records with your account to track your balance and prevent duplicate charges. These records remain after video files expire and are removed when you delete your account. Payments are not enabled yet.

Operational data

Hosting infrastructure may retain request metadata and backups under its own retention policies. We do not intentionally log photos, prompts, access codes or API credentials. Signing out or closing the browser does not cancel a generation that has already started.

Your choices

You can use the free prompt tools without uploading a photo to the service. Remove a selected file before generation to clear the preview. Closing the tab clears its temporary file previews. A generation already submitted to the provider may continue even after you close the tab.

Only submit photos you have permission to use. Save your result within the 24-hour access window.