Privacy Policy

ImagineImg is operated by , at Street, City, State, PIN, India. For anything in this policy, write to privacy@your-domain.com.

Only what the service needs to work:

• Account details — your first name, optional last name, and email address.
• Your password, hashed. We store a bcrypt hash, never the password itself. We cannot read it or recover it for you.
• Photos you upload for a style, and the prompts you write.
• Images generated for you, along with the settings used — size, model, style, seed, and which provider produced it.
• Your credit balance and how it changes.
• Your IP address, held briefly in memory to limit repeated sign-in attempts. It is not written to our database.
• A session cookie so you stay signed in for 30 days. We store only a one-way hash of its value, so a copy of our database would not let anyone sign in as you.

We do not use advertising or analytics trackers, and the only cookie we set is the sign-in one described above.

This is the part most worth understanding. When you apply a style, your photo is sent to the AI provider that performs the edit, the result comes back, and your original upload is discarded. We do not write it to disk and it is not in our database. Only the generated image is saved, to your private gallery.

What the provider does with it during processing is governed by their terms, not ours — see the next section.

We do not generate images ourselves. Your prompt, and your photo when you upload one, are sent to whichever third-party provider handles the request:

• Google (Gemini API) — privacy policy
• Pollinations — pollinations.ai

A request may be sent to more than one of them: if the first provider is out of capacity or fails, we retry with the next. These providers may retain and process content under their own policies, including for safety review. Please do not upload anything you would not be comfortable sending to a third-party AI service.

Beyond these providers and our own hosting, we do not sell, rent or share your personal data with anyone. We may disclose it if the law requires it.

If you upload a photo containing someone else, you are responsible for having their permission. Do not upload images of other people without their consent, and never upload images of children. See our Acceptable Use Policy.

We process your account details and content to provide the service you asked for — that is, to perform our contract with you. We process your IP address for the limited purpose of protecting accounts from automated sign-in attempts, which is our legitimate interest in keeping the service secure.

• Generated images — until you delete them, or until you delete your account.
• Uploaded photos — not retained at all (section 3).
• Account details — until you delete your account.
• Sessions — 30 days, or until you sign out.

Deleting an image removes both its database record and the file itself. Deleting your account removes your images with it.

You can ask us to show you the personal data we hold about you, correct it, delete it, or send you a copy. You can delete individual images yourself at any time from your gallery. To delete your whole account, or for anything else, write to privacy@your-domain.com and we will respond within 30 days.

If you are in India, you also have rights under the Digital Personal Data Protection Act, 2023, including the right to nominate someone to exercise them on your behalf. If you are in the EEA or UK, you have the rights given by the GDPR, including the right to complain to your supervisory authority.

Our AI providers operate internationally, so your prompts and uploads may be processed on servers outside your country, including outside India and the EEA.

Passwords are hashed with bcrypt. Session tokens are stored only as hashes. Sign-in attempts are rate limited. No service can promise perfect security, but we do not keep what we do not need — which is why uploads are not retained.

This service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us at privacy@your-domain.com and we will delete it.

If we change this policy we will update the date at the top, and tell you by email if the change is significant.

Our Grievance Officer is Full Name, reachable at grievance@your-domain.com. Complaints are acknowledged within 24 hours and resolved within 15 days, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.