Privacy Policy

1. Data we collect

We collect only what we need to run the Service:

• Account data — your email address, and (if you sign in with Google) your name and profile basics from Google.
• Content — prompts, reference photos and videos, generation settings, generated content, and the task identifiers and status needed to process and recover your requests.
• Billing data — your credit balance, purchases, any existing subscription, and transaction history. Stripe handles card payments; we receive payment references and status, not your full card number.
• Usage and security data — page and interaction data, IP addresses, timestamps, browser/device identifiers, and anti-bot verification results used for analytics, account security, and abuse prevention.

2. How we use it

• To authenticate you (sending magic-link sign-in emails) and operate your account.
• To upload and validate your reference files, generate videos, recover interrupted tasks, and provide history, playback, and authorized downloads.
• To process payments, grant and reserve credits, settle completed tasks, release credits for confirmed failures, and administer any existing subscriptions.
• To secure the Service, prevent abuse, and comply with legal obligations.
• To understand aggregate usage and improve the product.

We do not sell your personal data or train our own AI models on your inputs or outputs. Third-party processing is subject to the providers’ terms and policies; this statement is not a guarantee about their independent practices.

3. Third parties we share data with

We share data with service providers only as needed to run the Service. Each processes data under its own privacy terms:

• fal.ai — receives prompts, generation settings, and time-limited access to reference photos and videos to process generation requests.
• Cloudflare R2 — stores uploaded references and generated videos privately. Cloudflare Turnstile also verifies visitors where anti-abuse checks are used.
• Inngest — processes task identifiers and workflow status to execute, retry, and recover video workflows.
• Stripe — processes payments and stores billing details.
• Resend — delivers sign-in and account emails.
• Google — provides optional sign-in (OAuth) and Google Analytics when configured. Vercel Analytics is also integrated for website usage measurement.

We may also disclose data if required by law, or to protect the rights, safety, and property of our users or the Service.

4. Retention

We retain account and service records as needed to operate your account, maintain security, and meet legal obligations. The video-specific section below explains reference-file expiry, private output storage, provider retention, task records, and local browser drafts. Deleting a video removes it from history and schedules its private output for deletion; it does not erase records needed for accounting, security, or task recovery. Account deletion does not itself clear data stored in your browser.

5. Your rights (GDPR)

If you are in the European Economic Area or the UK, applicable law may give you rights to access, correct, delete, or receive a copy of your personal data, restrict or object to certain processing, and withdraw consent where processing relies on consent. Depending on the purpose, our legal bases include performing our contract with you, legal obligations, legitimate interests in security and service operation, and consent where required. You may lodge a complaint with your local data-protection authority.

6. Your rights (California / CCPA)

If you are a California resident, you have the right to know what personal information we collect and how it is used, to request deletion of your personal information, and to not be discriminated against for exercising these rights. We do not sell your personal information.

7. Exercising your rights

You can delete generations and your account from within the app. For any other request — access, correction, export, or deletion — email us at [email protected] and we will respond within the time required by applicable law.

8. Security

We use reasonable technical and organizational measures to protect your data, including encrypted connections and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Cookies, browser storage, and international transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for those transfers.

The site uses browser storage for sign-in sessions, preferences, and local drafts. Analytics integrations may use cookies or similar identifiers. You can manage site storage and cookies in your browser; blocking essential storage may prevent sign-in or draft recovery. Where applicable law requires consent for non-essential tracking, that consent must be obtained before those integrations run.

10. Children

The Service is not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect their data.

11. Changes

We may update this policy from time to time. We will revise the “last updated” date above and, for material changes, provide additional notice where appropriate.

12. Contact

Questions about your privacy? Email us at [email protected]. See also our Terms of Service.

Video generation: uploads, processing and retention

When you submit a video generation request, your photos and source video are uploaded to private Cloudflare R2 storage. fal.ai receives the prompt and time-limited access to the reference files to process the request. Inngest processes job identifiers and workflow status to run and recover the task. These providers process data under their own terms.

Validated reference files are reusable for seven days and are then scheduled for deletion, unless an unresolved task still needs them. Unfinished uploads expire after 15 minutes; their files are removed by scheduled cleanup. Generated videos are kept in private R2 storage until you delete them. Download links expire; generating a new link requires access to the owning account.

We request seven-day retention for generated files on fal. fal request input/output payloads are retained for 30 days for submission recovery; these include prompts and temporary reference links. Deleting a video removes it from your history and schedules its private output for removal, but task and credit records remain for accounting and idempotency. Account-orphaned files are removed by a daily sweep after a 24-hour grace period. Local drafts remain in your browser until cleared or expired; server deletion does not clear browser storage.