Privacy Policy

Account details. Your email address, and your name if you provide one. If you sign in with Google, we receive your email and name from Google — not your password.

Your work. The images you upload and the projects you create: template, settings, and name.

Subscription status. If you subscribe, we store your PayPal subscription reference, the plan, its status, and the renewal date. We never see or store your card details — PayPal handles payment entirely.

Usage analytics. Which templates are used, when a project is created, and when someone starts an upgrade. This is what tells us which templates are worth building on.

To run the service: to sign you in, store your projects, show them back to you, and apply the limits of your plan. To take payment and keep your subscription in step. To send transactional email about your account — subscription confirmations, payment problems, and renewal notices. We do not send marketing email.

Analytics is used in aggregate, to decide which features and templates to build. It is not used to profile you or to target advertising.

We use a small number of providers, each for one job: Supabase for authentication, the database, and file storage; PayPal for subscriptions and payment; Resend for transactional email; PostHog for usage analytics; and Vercel for hosting.

They process data on our instructions to provide those services. We do not sell your data, and we do not share it for advertising.

Uploads go to private storage. They are not public, and are readable only through short-lived signed links issued to your own session.

Access is enforced by the database at the row level, not only by the application: another account cannot read your projects or your files even if the app were asked to hand them over.

Projects and uploads are kept while your account exists. Deleting a project removes it and its file. Deleting your account removes your projects, your files, and your account record; backups are overwritten on their normal cycle.

Records of payments are kept as long as tax and accounting rules require, even after an account is closed.

We use cookies to keep you signed in — without them the service cannot work. Analytics sets its own identifier to recognise a returning browser. There are no advertising cookies.

You can ask for a copy of your data, correct it, or have it deleted. Deleting your account does most of this directly; for anything else, contact us and we will act within a month.

If you are in the UK or EEA, you also have the right to complain to your data protection authority.

Our providers operate internationally, so your data may be processed outside your country. Where that happens, transfers rely on the safeguards those providers have in place.

We will update this page when our practices change; the date at the top shows when it last did. For any privacy question, use the support address on our contact page.