Privacy Policy: Uploaded Photos, Storage and Deletion

trykissai is operated by an independent developer as an individual, not by a registered company. The operator is responsible for the personal data described in this policy and can be reached at support@trykissai.com.

We collect only what we need to run the Service:

• Account data: your email address and display name. If you use a password, we store only an Argon2id hash of it. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Photos and results: the portraits you upload and the photos and videos generated from them.
• Purchase records: the credit pack, amount, status and Stripe payment references. Card details go directly to Stripe and never reach our servers.
• Usage data: your jobs and their status, your credit history, and any feedback you send us.
• Technical data: pages viewed, the site or search engine that referred you, page-load performance and your browser's user agent. Your IP address is used for rate limiting and stored only as a salted hash. If you open a partner share link, the click is logged with your IP address and user agent. Our hosting provider also keeps standard server logs.

We use this data to run your jobs and deliver results, manage your account and credits, process payments, send account emails such as verification and password-reset messages, prevent fraud and abuse, enforce our Content Policy, answer support requests, and see which pages work so we can improve the Service. We do not sell personal data and we do not use it for advertising.

Uploaded photos and generated results are kept in private storage and can only be opened through short-lived signed links. To create a result, your photos and the scene instructions are sent to the AI model provider that runs the image or video model.

Photos attached to a job are deleted as soon as the job finishes, fails or is cancelled. Photos you upload but never use in a job are deleted after 24 hours. Generated photos and videos are deleted 7 days after they are created. We do not use your photos or results to train AI models.

• Uploaded photos: until the job ends, or 24 hours if they are never used in a job.
• Generated photos and videos: 7 days.
• Login sessions: 30 days, renewed while you keep using the Service.
• Account data, credit history, purchase records and job records (without the files): for as long as your account exists. Stripe keeps its own records of each payment under its own policy.
• Technical and analytics data: only as long as it is useful for running and improving the Service.

We share data only with providers that help us run the Service, and only what each one needs:

• Vercel: website hosting.
• Cloudflare: domain and DNS, private file storage (R2) and forwarding of support email.
• A dedicated server provider: hosting of our database.
• Stripe: payment processing.
• Resend: delivery of account emails.
• Google: sign-in, if you choose it.
• Upstash: the job queue, which receives the details of each job, including references to its photos.
• AI model providers: they run the image and video models and receive the photos and scene instructions for each job.

We may also disclose data when the law requires it, or to report child sexual abuse material and other serious illegal content to the authorities.

Our providers operate in the United States and other countries, so your data may be stored and processed outside the country where you live.

We use only the cookies the Service needs. We do not use advertising or third-party tracking cookies.

• auth_session: keeps you signed in (30 days).
• NEXT_LOCALE: remembers your language.
• google_oauth_*: short-lived cookies used during Google sign-in.
• trykiss_attribution: remembers how you first found the site, such as a search engine (30 days).
• ref_code: remembers the partner link you arrived from (30 days).

We also keep small flags in your browser's session storage so the same visit is not counted twice. Stripe sets its own cookies on its checkout page.

Connections use HTTPS, passwords are stored only as Argon2id hashes, uploaded files sit in private storage behind short-lived signed links, and access to production systems is restricted. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Service is only for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18, and we delete it if we learn that we have. If you believe a minor has used the Service, contact us.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, or to object to or restrict how we use it. To make a request, including deleting your account, email support@trykissai.com from the email address on your account; we will reply within 30 days. Deleting your account removes your profile, sessions, jobs, files, remaining credits and our copy of your purchase records. You can also complain to your local data protection authority.

When we update this policy, we post the new version here and change the effective date. If a change materially affects how we use your data, we will tell you by email or by a notice on the site before it takes effect.

For privacy questions and requests, email support@trykissai.com and include enough information for us to verify your request.