Privacy policy

Last updated: October 4, 2026.

What we process

We process your email address, a salted password hash, verification and session records, payment order references, credit transactions and generation task records. We do not store your plaintext password. Photos are sent to KIE to perform the generation you request. We store task IDs and generated videos in Cloudflare R2, not a permanent copy of your source photos. For guests, we store a hashed IP address and UTC date to enforce one free video per IP per day.

Service providers

Cloudflare hosts the application and database. KIE processes image uploads, prompts and generated media. Stripe handles checkout and payment details. Resend delivers account verification and password-reset emails. Their own privacy terms apply to processing in their services. Data may be processed outside your country.

Website analytics

We use Pageview, a self-hosted Plausible analytics service, to measure page visits and referral sources without analytics cookies. Page paths, referrer domains and browser information are processed to produce aggregate reports. We exclude URL query strings and fragments, and do not send account details, photos, prompts or payment information in analytics events.

Cookies and retention

We use an essential, HTTP-only session cookie for sign-in, expiring after seven days. An essential HTTP-only guest cookie lasts up to one year and grants access to videos created in that browser. Clearing it removes browser access to those videos. Email tokens expire after one hour. Account and transaction records remain until deleted or no longer required for service, accounting or fraud prevention. KIE upload links are temporary; provider retention is governed by its policy. Download outputs promptly.

Your choices

You can sign out, request a password reset, or ask for access, correction or deletion through the support channel on our Contact page. To protect your account, we may ask you to verify control of the registered email address. Do not upload images of people without their permission.

Security

API credentials remain on the server. We use signed payment webhooks, expiring sessions and account/IP request limits. No online service can guarantee complete security.