Privacy Policy

Draft: have a lawyer review before publishing. This text is a starting template, not legal advice.

Last updated: [date]. This policy explains what personal data the Service collects and how it is used.

1. What we collect

Account data: email address, display name (optional), password (stored only as a salted argon2id hash), and terms-acceptance time. Your email address is your login identifier. We only send email for password resets you request and operational alerts to staff accounts; no marketing or notifications.
Usage data: your prompts, uploaded files, generation settings and results, credit balance and ledger, and payment records (amounts, status, invoice identifiers). We do not receive your wallet's private data.
Technical data: IP address, browser user agent, and session records used for security, abuse prevention and rate limiting. A session cookie (jj_session) keeps you signed in; it is strictly necessary and set as httpOnly.

To run the Service: authenticate you, process generations, keep your balance and history.
To detect fraud or abuse, and to process payments if paid checkout is enabled (for example, limiting accounts per network).
We only send email for password resets you request and operational alerts to staff accounts; no marketing or notifications.