Privacy Policy

The short version

• Your photos, music and videos never leave your device. They are processed in your browser. We never receive, store, view or use them.
• No biometric data. Face detection runs entirely on your device. We do not collect, store or transmit face scans, face geometry or any biometric identifier.
• We do not sell or share your personal information, and we do not use it for advertising.
• No ad trackers, no analytics, no third-party cookies from us.
• You can download or permanently delete your data yourself, any time, from My account.

1. Information we handle

Information you give us

• Password, if you choose one. It is stored only as a salted hash by our sign-in provider (Supabase); we cannot read it.
• Google sign-in, if you use it: Google sends us your email address and your name or profile name. We use the email to identify your account and do not receive your Google password.
• Email address, when you sign in or when you subscribe without an account (you enter it on Stripe's payment page, and we create your account from it). We use it to send your sign-in link and to identify your account.
• Subscription and billing details. Payments are processed by Stripe on its own secure page; we never see or store your full card number. We keep your subscription status, billing period dates and the Stripe customer and subscription IDs.
• Proof that you accepted our Terms (date and version) when you subscribe.

Information collected automatically

• Standard server logs, including your IP address and request details, handled by our hosting provider (Cloudflare) to run, secure and protect the Service against abuse.
• A sign-in session cookie (see Cookies below).

Information we do not collect

Your photos, audio files, the videos you create, face data, precise location, or contacts. We do not knowingly collect sensitive personal information.

2. How we use information

• to provide, secure and maintain the Service and your account;
• to process payments, manage your subscription and prevent fraud;
• to respond to requests and to comply with legal obligations (including tax and accounting records).

We do not sell your information, and we do not share it for cross-context behavioral advertising.

3. Who we share it with

Only service providers that help us run the Service, under their own privacy terms:

• Cloudflare, Inc.: hosting and network delivery.
• Supabase, Inc.: sign-in and our account database (hosted in a European region).
• Resend, Inc.: sends our account emails (sign-in links, confirmations, password resets).
• Google LLC: only if you choose “Continue with Google”.
• Stripe, Inc.: payments, invoices and the subscription management page.

We may also disclose information if required by law, to protect rights and safety, or in a business transfer such as a merger or sale, in which case this policy would continue to apply to your data unless you are told otherwise.

4. Cookies

We only use a strictly necessary cookie: a sign-in session cookie (its name starts with sb-) set after you sign in so that you stay signed in. We do not use advertising, analytics or cross-site tracking cookies, so there is no cookie banner. When you pay, you are taken to Stripe's website, which has its own cookie policy.

Do Not Track / Global Privacy Control: because we do not track you across sites or sell or share your data, there is nothing to opt out of; we treat these signals as honored.

5. Your privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to know what personal information we hold, get a copy, correct it, delete it, and not be discriminated against for exercising these rights. You can also appeal a decision about your request.

• Access and delete it yourself: in My account you can download your data (JSON file) and permanently delete your account. Deleting your account erases your account data and cancels your subscription immediately.
• Invoices and payment records already issued may be kept by us and by Stripe for as long as tax and accounting laws require.
• Other requests: projectsekai.inc@gmail.com. We respond within 45 days.

Notice at collection (California): in the past 12 months we collected identifiers (email address, account ID, IP address) and commercial information (subscription status) for the purposes in section 2. We did not sell or share personal information, and we do not use or disclose sensitive personal information for purposes beyond providing the Service. Retention: account data is kept until you delete your account; billing records as required by law.

6. Children

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. Accounts require you to be at least 13, and subscriptions at least 18. If you believe a child under 13 has created an account, delete it from My account or contact us and we will remove it.

7. Security

We protect your data with encrypted connections (HTTPS), password-less sign-in links, row-level access rules on our database, and secret keys kept out of our code. No system is perfectly secure, and we cannot guarantee absolute security.

8. International visitors

The Service is operated for users in the United States. Our providers may process data in the United States and other countries. If you visit from outside the U.S., you consent to this processing; the self-service tools in My account let you access and delete your data.

9. Changes

We may update this policy. The “Last updated” date above shows the latest version, and we will give notice of material changes (for example by email to account holders).