Your photo.
Your privacy.

Last updated October 28, 2026. This page describes the current studio implementation.

What we process

If you choose Google sign-in, Google provides your verified email and account identifier. We store that identifier to recognize your account; we do not request access to your Gmail inbox. We store your account email, a salted password hash when you use email sign-in, session records, payment references and video job records. We process the photo you submit to generate your requested video. Uploaded photo metadata is removed during server-side image conversion.

Video generation

Your photo and our scene references are sent to Replicate to run the MiniMax H3 model. Generated videos are copied to our server for download. Replicate also processes these files under its own policies. See Replicate’s privacy policy.

Payments

Stripe processes card information on its hosted checkout. Our server receives payment status and identifiers to add credits; we do not receive or store full card numbers. See Stripe’s privacy policy.

Storage and retention

Source photos are deleted from our server after the job succeeds or definitively fails. An unresolved submission may retain its photo while support checks the request. Videos are retained for the period shown in the studio, normally 30 days. Account, credit and purchase records remain while needed to operate your account and resolve payment issues.

Cookies and local storage

A first-party, HTTP-only session cookie keeps you signed in. Browser session storage remembers a checkout request identifier to prevent duplicate checkout creation. If you select a photo before checkout, this browser keeps a local draft so you can continue after paying. It is eligible for restoration for 24 hours and is cleared when you remove it, submit it or sign out. This implementation does not install advertising trackers.

Your choices

Only upload photos you are permitted to use. Download results you want to keep. Contact the support address linked in the studio footer for access or deletion requests. Never include your password or payment card details in a request.