Privacy Policy

The short version

• Your hand photos are not stored by us. They pass through our server to the AI provider that generates the result, and are not written to our database or file storage.
• We store your email address, your credit history, and your order and subscription status.
• We never see your card details — the payment page belongs to Creem.
• We use no analytics and no advertising cookies, so there is no cookie banner.
• We do not use your photos or designs to train AI models.

Photos you upload

When you try a design on a photo, the image is sent to our server and forwarded to our AI provider (fal.ai) to produce the result. We do not keep a copy: nothing is written to our database, and we do not log image contents.

The generated result is hosted by the AI provider and delivered to you over an unguessable URL. Treat that URL as semi-private: anyone who has it can open the image until the provider removes it. Our provider's own retention period applies to both the input and the result; see fal.ai's privacy policy.

If the photo shows an identifiable person, it is personal data about them. Please only upload photos you have permission to upload.

What we store, and why

• Email address — to sign you in (there is no password) and to reply to you. Legal basis: performance of our contract with you.
• Sign-in sessions — a session cookie and a matching database row, so you stay signed in. This is the only cookie we set.
• Credit history — an append-only ledger of credits granted and spent, so a balance can always be explained and audited.
• Orders and subscription status — plan, status, renewal date, amounts, and the payment events we receive from Creem. Legal basis: contract and our legal obligation to keep financial records.
• Feedback you send — the message and the optional contact address you provide. Legal basis: our legitimate interest in improving the product and replying to you.

Who it is shared with

We use the following processors. All of them are bound to use the data only to provide their service to us.

• fal.ai (United States) — Runs the AI image models. Receives the hand photo you try a design on, and the design prompt.
• Neon (United States) — Hosts the database: your email, credit history, orders and subscription status.
• Vercel (United States / global edge network) — Hosts and serves the application, and keeps short-lived request logs.
• Resend (United States) — Sends transactional email: sign-in links and replies to your feedback.
• Creem (European Union) — Merchant of record for all purchases. Handles payment details, invoices and sales tax; we never receive your card data.

We do not sell personal data and we do not share it for advertising. Some of these providers are outside the EEA/UK; transfers rely on their standard contractual clauses.

How long we keep it

• Account data (email, sessions, credit ledger): while your account exists.
• After you delete your account: account data is removed within 30 days, except records we must keep for accounting and tax, which are kept as required by law (typically up to 7 years) and are not used for anything else.
• Payment events: for the same accounting period as above.
• Hosting request logs (Vercel): short-lived, typically days.
• Uploaded photos: not retained by us at all.

Your rights

If you are in the EEA or UK, you have the right to access, correct, delete, port, restrict and object to the processing of your personal data, and to complain to your local data protection authority. Similar rights apply in several other jurisdictions, including California.

Account deletion is not yet self-service. To delete your account and data, or to exercise any other right, send a request from the contact page from the address you signed up with. We act within 30 days.

Security

Traffic is encrypted in transit. Credentials for AI, database and payment providers are held server-side only and never reach the browser. Credit spending is enforced on the server, not in the page. No system is perfectly secure; if we become aware of a breach affecting you, we will notify you and the relevant authority as the law requires.

Changes

If we change how we handle personal data in a way that affects you, we will update this page and email account holders before the change takes effect.