Privacy policy

Photos you upload

Your photo is sent to our server and stored in Cloudflare R2 while the drawing is made. We delete it from our storage when processing finishes or fails.

The finished drawing is available to download for 24 hours and is scheduled for automatic deletion from our Cloudflare R2 storage afterward. Automatic deletion may take additional time. Download links are private and expire after one hour.

We do not use your photos or drawings to train AI models or publish them as examples. Examples on our site use our own or licensed stock photos, not private user uploads.

AI model providers

To create your drawing, we send your photo and style instructions through processing partners to model providers. Those providers’ retention and training rules are governed by their own policies; we cannot guarantee a fixed maximum retention period or that every provider excludes training. Deletion from our storage does not mean that processing partners or model providers have deleted their copies.

What we store

For free use we keep a keyed hash of your IP address and a random browser ID in a cookie, to count the 3 free drawings a day. The IP address can’t be read back from the hash without our server key, but we still treat it as personal data.

Supabase Auth stores your email address, login identities and sessions. Our business database stores your Supabase user ID, a hashed form of your email, a payment provider customer ID (if supplied), orders and credit movements. We do not store card details.

Cookies

Essential cookies: itd_aid, a random ID that counts the 3 free drawings a day (up to 400 days); Supabase authentication cookies that keep you signed in, refresh your session and protect sign-in redirects; itd_next, which remembers for 15 minutes which page to return to after signing in.

Analytics cookies: Google Analytics sets cookies to measure visits. In the EEA, the United Kingdom and Switzerland they are only set after you accept them in the cookie banner. Elsewhere they are on by default. After you sign in, itd_login is kept for 2 minutes so analytics can count one sign-in and whether it used Google or email. Your choice is saved in your browser (itd_consent) and you can change it at any time with “Cookie settings” at the bottom of every page.

Services we use

Cloudflare: hosting, storage, databases and bot protection (Turnstile, only shown when traffic looks automated).

Waffo: payments. Waffo is the merchant of record and receives your email and payment details at checkout.

Supabase: manages authentication, verified email addresses, login identities and sessions. Resend: delivers sign-in emails through Supabase SMTP and purchase receipts.

Google: verifies your identity when you choose Google sign-in. We request your email identity, not access to your Gmail messages.

Google Analytics 4: usage statistics such as page views and button clicks, measured with cookies (see Cookies above for when they are set). We do not use Google Analytics for advertising.

Google AdSense: ads shown to free users, if enabled.

Your choices

Email us to delete your purchase records or to ask what we hold about you. Clearing your browser cookies removes the browser ID and the login session in that browser.