Privacy Policy

What we collect

• •Account data: email address, display name, and authentication records.
• •Photos you upload for visualization, and the AI images generated from them.
• •Consent records: age attestations and policy acceptances, with timestamps.
• •Purchase records: credit bundles bought and payment references (card details are handled by Stripe, not stored by us).
• •Community content you choose to post.
• •Technical logs used for security, abuse prevention, and reliability.

Why we collect it

Photos are collected solely to produce the concept visualizations you request and to run safety moderation. Procedure interests and journal content exist to power the features you use. We treat photos and procedure interests as highly sensitive information.

Who processes your data

• •Supabase — database, authentication, and private file storage.
• •OpenAI — processes uploaded photos and prompts to generate visualizations and run moderation.
• •Vercel — application hosting.
• •Stripe — payment processing.
• •Resend — transactional email delivery.

Storage and privacy defaults

Uploaded and generated images are stored in private buckets and are never public by default. Access uses short-lived signed URLs limited to your account. Publishing an image requires a separate, explicit consent step and moderation review.

Retention and deletion

You can delete individual images or your entire account from your dashboard. Deletion removes images from normal access promptly, with storage deletion following on a documented schedule. Minimal billing and audit records may be retained where legally required. Abandoned uploads expire automatically.

What we do not do

• •We do not sell or share your facial images for advertising.
• •We do not train appearance models on your images without a completely separate, explicit, informed opt-in.
• •We do not use your private content as marketing material without separate written consent.
• •We do not claim your data is anonymous, and we do not claim HIPAA compliance.

Security and breach response

We use technical and organizational safeguards designed to protect your information, including private storage, row-level access controls, and audit logging. If a breach affecting your data occurs, we will notify affected users and authorities as required by applicable law, which may include the FTC Health Breach Notification Rule.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your data, and to object to certain processing. Use the Delete My Data page or contact us to exercise these rights.