Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect your email address, display name, and profile information. If you sign in through a third-party provider (Google or Twitter/X), we receive your public profile information from that provider, including your name, email address, and profile image.

1.2 Content Data

We store the content you create and publish on the Platform, including AI-generated images, prompts, comments, and other user submissions.

1.3 Payment Information

Payment processing is handled by Stripe. We do not store your credit card numbers or bank account details. We retain transaction records including purchase amounts, dates, and subscription status.

1.4 Usage Data

We collect information about your interactions with the Platform, including pages visited, features used, generation parameters, and timestamps. This data is collected through server-side logging and is used to maintain and improve the Platform.

2. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Platform and its features;
• Process transactions and manage your account, including coin balances and subscriptions;
• Enforce our Terms of Service and content policies, including automated content moderation;
• Communicate with you about your account, service updates, and security alerts;
• Prevent fraud, abuse, and unauthorized access;
• Comply with legal obligations.

3. Information Sharing

We do not sell your personal information. We share information with the following third-party service providers who process data on our behalf:

• Stripe: Payment processing. Stripe receives your payment details to process transactions. See Stripe’s Privacy Policy.
• Cloudflare: Content delivery, DNS, and image storage (R2). Cloudflare processes request metadata. See Cloudflare’s Privacy Policy.
• Google / Twitter (X): OAuth authentication. These providers receive confirmation that you have authenticated but do not receive your Platform activity data.
• Resend: Transactional email delivery. Resend processes your email address to deliver account-related communications.

We may also disclose information if required by law, legal process, or governmental request, or to protect the rights, property, or safety of aiio, our users, or the public.

4. Data Storage & Security

Your data is stored on the following infrastructure:

• Application Data: Hosted on Railway (US West region), including your account information, generation history, and social interactions.
• Image Assets: Stored on Cloudflare R2 with global CDN distribution for fast access worldwide.

We implement industry-standard security measures including encryption of data in transit (TLS/HTTPS), secure password hashing, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Cookies & Local Storage

We use minimal cookies and local storage, limited to:

• Authentication Token (JWT): A session cookie that keeps you signed in. This is essential for the Platform to function and cannot be disabled.
• Language Preference: Stores your selected display language to provide a consistent experience.

We do not use advertising cookies, tracking pixels, or third-party analytics cookies.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate personal data.
• Deletion: Request deletion of your account and associated data. You may initiate this through your account settings or by contacting us.
• Export: Request a portable copy of your data in a machine-readable format.
• Objection: Object to certain processing of your personal data where applicable.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

7. Children’s Privacy

The Platform is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. Users between 13 and 18 years of age require parental consent to use the Platform.

If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at [email protected].

8. International Data Transfers

Our servers are located in the United States (Railway, US West). If you access the Platform from outside the United States, your data will be transferred to and processed in the United States. Image assets are distributed globally through Cloudflare’s CDN. By using the Platform, you consent to the transfer of your information to the United States and other countries where our service providers operate, which may have different data protection laws than your jurisdiction.

9. Changes to Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Platform or via email to your registered address. Your continued use of the Platform after such changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

10. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at [email protected].