Privacy Policy

We may collect information that you provide directly, information collected automatically when you use the Services, and information from third parties as described below.

If you sign in with Google or another provider supported by our authentication partner (Supabase), we may receive and store identifiers such as your email address, name, profile image URL, and provider subject ID as made available by that provider. We use this information to create and secure your account, personalize your experience, and communicate with you about your account or the Services.

We also keep a record that you confirmed you are at least 18 years old: when you confirmed it, the exact wording you were shown, and whether the confirmation came from you or was carried over when we introduced the requirement. We keep it because the Terms of Use let us act on an inaccurate age confirmation, and acting on one means being able to show what was actually asked.

When you upload images, prompts, or other media, and when you generate AI outputs (including videos), we process and store such content as needed to operate the Services—for example, to run generation jobs, display results in your dashboard or gallery, troubleshoot issues, and enforce our Terms of Use.

Running a generation means sending your prompt, and a temporary link to any file you uploaded, to the provider that operates the model you chose. We send only what the generation needs. See Section 7 for who those providers are and what governs their use of it.

We do not use your content to train AI models. Prompts, uploads and generated results are not used to develop, fine-tune or improve any model we operate. If that ever changes we will say so here before it does, and where the law requires your consent we will ask for it.

You are responsible for ensuring that you have the rights and, where applicable, consents necessary for any content you upload or generate, as further described in our Terms of Use.

Purchases (such as credit packs) are processed by Morning (Green Invoice), our payment and invoicing provider, which also issues your tax invoice. We never see or store your card details — they are handled by Morning and its own payment providers. We receive transaction metadata such as the order identifier, the pack purchased, the amount and the payment status.

We use only cookies that are essential for the Services to function — the ones that sign you in and keep you signed in. We do not run analytics, advertising or session-recording tools, and no third party sets a cookie through this site. Our Cookie Policy lists each one, what it is for and how long it lasts. You can control cookies through your browser settings.

We use the information we collect to:

• Provide, maintain, and improve the Services;
• Authenticate users and prevent fraud or abuse;
• Process payments and fulfill orders;
• Communicate with you about updates, security, and support;
• Comply with legal obligations and enforce our terms and policies;
• Analyze usage in aggregate to improve performance and user experience.

We rely on the following providers to run the Services. We do not sell your personal information.

• Supabase — sign-in and the database holding your account and generation history.
• Google — sign-in, when you use it.
• Amazon Web Services and Cloudflare R2 — hosting, and private storage for your uploads and results.
• RunPod and WaveSpeed — the compute that runs generations. WaveSpeed routes to the model you pick, which may be operated by a further company.
• Morning (Green Invoice) — payments and tax invoicing.

Hosting, storage, database and payment providers act on our instructions and only as needed to provide their service.

Model providers are different, and we would rather say so than imply otherwise. What a model provider may do with a prompt or an image sent to it is governed by that company’s own terms, which we do not control. Our commitment not to train on your content is a commitment about models we operate. If this matters to you, please do not upload anything you would not want leaving our systems.

We retain information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account subject to applicable law and our ability to retain certain records where required.

Media has a fixed lifetime, and it is short. Specifically:

• Generated videos and images are permanently deleted 7 days after the generation completes. After that they cannot be played, downloaded or recovered — by you or by us. Download anything you want to keep before then.
• Images and videos you upload as the source for a generation are deleted together with the result they produced — and within 7 days of upload if the generation fails and never produces one. Files uploaded but never used for a generation are deleted within 24 hours.
• Details of the generation — the prompt you wrote, when it ran, what it cost in credits — are kept after the media is gone. We need them for your account history, for billing, and to answer questions about a charge.

Deletion is carried out by an automated job that runs regularly rather than at the exact moment a period ends, so a file may persist for a short time past it. Copies can also remain briefly in backups after deletion from our active systems.

You represent that content you upload or generate through XMAKU complies with applicable law and that you have obtained any necessary rights and consents. We may remove content or suspend access where we reasonably believe it violates our policies or the law.

We implement technical and organizational measures designed to protect your information against unauthorized access, loss, or misuse. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security.

The Services are for adults. You must be at least 18 years old to use them, and we ask you to confirm that before you can generate anything. We do not knowingly collect personal information from anyone under 18. If you believe we have collected such information, please contact us and we will take appropriate steps to delete it.

Your information may be processed in countries other than your country of residence, including where our service providers operate. We take steps designed to ensure appropriate safeguards where required by applicable law.

Depending on your location, you may have rights to access, correct, delete, or restrict processing of your personal information, or to object to certain processing. To exercise these rights, contact us at the email below. We may need to verify your identity before responding.

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last updated" date. Continued use of the Services after changes constitutes acceptance of the updated policy, where permitted by law.

For questions about this Privacy Policy or our data practices, contact us at support@xmaku.com.