Privacy Policy

This page explains what PhotuBox collects, why, and for how long.

Draft. This text is a draft. It has not been reviewed by a lawyer and the operator's details below are not filled in yet. It is not final.

1. Who we are

PhotuBox is run by [OPERATOR NAME], based in [CITY, STATE], India ("we", "us"). We decide how your data is used. Contact us at [CONTACT EMAIL].

2. What we collect

• Account details: your email address, and a password stored only as a salted hash, never as plain text. If you sign in with Google or Apple, we keep the identifier that provider gives us and the email address it confirms. If you sign in with Apple, we also keep, encrypted, the token Apple gives us so that we can revoke the sign-in when you delete your account; it is removed with your account.
• Age and consent: whether your age was confirmed and when, and which version of the face-photo consent you accepted and when. We do not keep your date of birth.
• Your photos and requests: the photos you upload to make a picture, and the style or the words you chose (the prompt). See section 4.
• Results: the pictures we make for you. See section 4.
• Usage: how many generations you have used each day, your bonus generations, offers granted to you, and your referral code and who referred you.
• Safety records: when one of your pictures was blocked by a safety check, and any reports you send.
• Subscription: if you buy Premium, the state and end date of your subscription and the purchase token Google Play gives us, stored encrypted. We do not receive your card or payment details.
• Sign-in sessions: a record that lets the app keep you signed in. A session lasts 30 days.
• Short-lived sign-up records: while you sign up, change your email or ask for a code, we hold the address, the code in hashed form, a record of when codes were sent, and, for a new registration, your password hash and referral code. See section 7 for how long.
• Server logs: the server writes operational logs that contain account and job identifiers and records of events such as sign-in, consent, purchases, offers, account deletion and safety blocks. They do not contain photos, prompts, passwords or sign-in tokens. See section 7.
• Network address: we use your network address to limit how many accounts are created from one address. This count is held in the server's memory and is not part of your account.

3. How we use it

We use your data to run your account, to make the pictures you ask for (by sending your photos and prompt to Google, see section 4), to count your daily allowance, offers and referrals, to confirm and manage Premium, to keep the service safe, to send you the codes you ask for and notices that your password or email was changed, and to answer reports and your questions. We do not sell your data. This website sets no cookies and has no analytics or trackers.

4. Your photos and results

A photo you upload is used for that one generation and is deleted from our server after the job finishes, whether it works or fails. A photo is also deleted if a job was lost because the server restarted. We do not write photos or prompts to our logs.

To make your picture, we send your photos and your prompt (the words you chose, or the wording of the style) to Google's Gemini API. Google does not use them to improve its products. Google keeps your photos, your prompts and the pictures it makes for up to 55 days to detect abuse, and its systems and, as its terms allow, its reviewers can read them in that time. Deleting a photo or a result from our server, deleting your account, or withdrawing your consent does not delete Google's copy.

The finished picture is kept on our server for 24 hours so that the app can fetch it, and is then deleted. Before it is delivered, a picture is checked automatically; one that fails the check is deleted and not shown. Photos you upload are also checked before a job starts, and a photo that fails is refused and not stored.

5. What stays on your device

When a picture is made, the app saves a copy on your device, in a private place, as one of your creations, together with the style or words you used. The app keeps up to 50 creations per account, removing the oldest one when there are more. The app keeps creations out of iCloud and Android cloud backups, but a picture you save to your phone's gallery or share elsewhere is outside the app and is not covered by that. You can delete a creation yourself. Your history is stored on your device, not on our server.

6. Reports

If you report a picture, we keep your report: the account that sent it, the job, the category you chose, your note, and a copy of the picture. A report and its picture are deleted after 30 days, whether or not we have reviewed it, or earlier if you delete your account.

7. How long we keep account data

Your account details, age and consent records, usage, offers and subscription records stay in our database until you delete your account. Pictures and job records are removed after 24 hours as described above, and reports after 30 days.

A registration that is not confirmed (your email, password hash and referral code), an unused email-change request, the records of codes sent, and a record of each email address a code was requested for (kept even if no code was sent, for example when the request was refused) become eligible for removal after 24 hours (a registration or email change), an hour after each was sent (records of codes sent), ten minutes after it was created (the record of an address) or when the code expires (the codes themselves). They are removed the next time the server restarts or sends another code, so there is no fixed latest time for their removal. Records of safety blocks (strikes) are used to decide whether to pause you; they are removed when a later block is recorded and the old one is outside the checking window, or when you delete your account.

The server's operational logs hold account and job identifiers and event records (including safety blocks and account deletions), but no photos, prompts, passwords or sign-in tokens. They are kept according to the host's log settings. Today there is no fixed retention period, and the server does not rotate or delete them itself. Deleting your account does not remove entries already written to these logs.

8. Which other companies receive data

• Google (picture making): Google receives your photos and prompts through its Gemini API to make each picture, as described in section 4, and keeps your photos, prompts and the pictures it makes for up to 55 days to detect abuse.
• Google (sign-in and payments): if you sign in with Google, Google tells us who you are; we check its signature using Google's public keys. If you buy Premium, Google Play handles the payment, and we look your purchase up with Google Play using your purchase token. Google also sends us notifications about subscription changes, and the purchase is tied to an opaque reference to your account that Google passes through.
• Apple: if you sign in with Apple, Apple tells us who you are. When you delete an account that is linked to Apple, we ask Apple to revoke the sign-in authorisation we hold for it.
• An email delivery provider: the codes and notices we send you are sent through an email service that the operator sets up. That service sees your email address and the message.
• A hosting provider: the server runs on infrastructure that the operator controls or rents, and the provider that supplies it can in principle reach what is stored there, including a photo during the short time it is on the server.

We may also have to share data when the law requires it.

9. Deleting your account and withdrawing consent

You can delete your account in the app, in your profile, by confirming with your password (or with Google or Apple if your account has no password). This permanently deletes your account's records in our database, your sessions, your jobs and generated pictures on our server, your linked sign-in providers, and the reports you made, and removes your saved creations from that device. It does not cancel a Google Play subscription: cancel that in Google Play first, or you may keep being billed. Log entries already written are not removed (section 7), and neither is the copy Google keeps for up to 55 days (section 4).

You can also withdraw your face-photo consent at any time in the app, in your profile. We then delete the record of your consent; this does not delete what Google already holds (section 4). You will not be able to make new pictures until you accept the consent again. Questions about your data: [CONTACT EMAIL].

10. Age limit

PhotuBox is only for people aged 18 and over. We check your age when you sign up and do not keep your date of birth. We do not knowingly offer the service to anyone under 18.

11. Security

We take steps to protect your data: passwords and email codes are stored only in hashed form, purchase tokens and Apple tokens are stored encrypted, and the server does not write passwords, Google or Apple sign-in tokens, prompts or your photos to its logs. No system is perfectly secure, and we cannot promise that your data will never be exposed.

12. Changes to this policy

We may change this policy. We will post the new version on this page. If we start to share your photos with a company other than those named in section 8, we will update this page and the consent text in the app before we do. If the consent text changes, the app asks you to accept it again before you make another picture.

13. Contact

[OPERATOR NAME], [CITY, STATE], India. Email: [CONTACT EMAIL].