Privacy
What we store, where it goes, how long it stays, and how you delete it. This page lists the actual columns and files, not a category.
Last updated 2026-08-31
What we store
| Data | Why | How long |
|---|---|---|
| Email address | Sign-in, password reset, billing receipts | Until you delete the account |
| Username | Shown to you in the studio | Until you delete the account |
| Password, hashed | Sign-in. We never hold the password itself. | Until you delete the account |
| Plan, credits used, billing period | Enforcing the monthly allowance | Until you delete the account |
| Your prompts and run settings | Rendering the run and showing your history | Until you delete the run or the account |
| Rendered images | Delivering the pictures back to you | 7 days, then deleted automatically |
| Reference images you upload | Used as the starting picture for an edit or an enlargement | 7 days, with the run |
| Style files (LoRA) you upload | Applying your custom style to your renders. Copied to the render machines. | Until you delete the style or the account |
| Feedback and support messages | Answering the report. They carry your message, the page address and the browser identification string. | Kept after account deletion, with the link to your account removed |
| API keys, hashed | Authenticating API requests. The key itself is shown once and not stored. | Until you revoke it |
| Sign-in and reset tokens, hashed | Verifying an email address, resetting a password | Until they expire |
| Server logs | Finding faults. They carry request paths, timings and account ids. | Rotated by the system journal |
What we do not do
- We do not train models on your prompts or your images.
- We do not sell your data, and we do not share it with advertisers.
- We run no advertising tracker and no third-party analytics script on this site.
- We do not read your images except when a fault report names a specific run.
Who else sees anything
- Amazon Web Services stores your images — uploads and renders — in S3 (Oregon, us-west-2) and delivers this site and your images through CloudFront. On every page or image request, AWS receives your IP address, your browser identification string and the requested address, as any host does.
- SendGrid delivers account email — verification and password reset. It receives your email address and the message.
- Stripe handles card payment when paid plans open. Stripe receives your card details directly; we never hold a card number. We store the Stripe customer and subscription identifiers so the plan can be looked up.
Rendering happens entirely on hardware we own and operate. Your prompt does not leave our machines to reach a third-party model provider.
AI processing
Every picture the service returns is generated by AI image models running on our own machines. A reference image you upload is processed by the same AI models to produce the edit or the enlargement you asked for. Before delivery, an automated repair pass may re-render small regions of a picture, such as eyes, with the same models. No person takes part in this processing; see "What we do not do" for when a person may look at an image.
Cookies
Four cookies, none for tracking. pf_token holds your sign-in session and is sent
only to our own API; signing out clears it. Three delivery cookies
(CloudFront-Policy, CloudFront-Signature, CloudFront-Key-Pair-Id) let your browser fetch your own images from the delivery
network; they are signed for your account's images only and expire on their own within a day.
All four are HttpOnly, so no script on the page can read them. There is no
advertising cookie and no cross-site tracker to consent to.
Prompt screening
Prompts are screened before rendering, to enforce section 5 of the terms. The screen runs on our own machines, and the prompt is not sent anywhere to be screened. A refusal appears in the server log with the request, in the same way as any other refused request. We keep no separate list of refused prompts.
Your rights
- See it. Your prompts, settings and seeds are in your run history in the studio. For anything else, ask.
- Delete it. Delete a single run from the studio, or the whole account from the account page. Account deletion removes your runs, your images, your uploads, your style files and your API keys. Feedback messages stay for triage, with the link to your account removed.
- Take it. Download any run as one zip, from the studio or
from
GET /jobs/{id}/archive. - Correct it. The studio has no field for changing an email address or a username yet. Write to us and we change it for you.
To exercise a right this page does not cover, write to support@wardrobegonewild.com, or open "Send feedback" in the studio account menu — it files a ticket we read. We answer within 30 days.
Security
- Passwords are hashed, never stored in a readable form.
- API keys are hashed. The key is shown once, at creation, and cannot be read back.
- A delivered PNG carries no embedded prompt: the metadata chunk is stripped on the way out.
- A request without a key answers 401. A request for a run that is not yours answers 404, the same as one that does not exist.
Changes
If we change what we collect or who receives it, the date at the top of this page changes and the change appears on this page.
This page describes the service as it runs today. It is written in plain language and has not been reviewed by a lawyer. If you need a data-processing agreement, write to support@wardrobegonewild.com.