Privacy
Last updated 23 September 2026
What we hold
Your email address, a hashed password if you set one, your username and anything you choose to put on your profile, your generations and their prompts, and your credit balance and payment history. From the mobile app, two more: whether you are on Android or iOS, and the name of the handset you signed in on — “Pixel 7”, “iPhone 15” — so that the list of signed-in devices in Settings means something to you. We do not collect an advertising identifier, and nothing here follows you to another app or site.
What we never publish
Your email address is never shown to anyone. Public work is attributed by username only. Your credit spend stays hidden unless you turn it on yourself in Settings.
Who else sees your prompts
Prompts and uploaded images are sent to the AI provider that runs the model you picked, because that is how generation works. They are also stored here so your library and history keep working.
The companies we use
We do not sell or share your data for advertising. It does pass through the services that make the product run: fal.ai runs the models, Bunny.net stores and serves your finished files, Neon hosts the database, Stripe takes payments on the web, Google Play and the App Store take them in the app, RevenueCat keeps the record of what was bought there, Firebase delivers notifications to your phone, and Resend sends our email, and Vercel hosts the site. Each one only receives what it needs to do its job.
Measuring how the site is used
Two things count visits here, and they behave differently. Vercel Analytics counts page views and where visitors arrived from. It sets no cookies, stores no identifier and cannot follow anyone between sites or visits, so it runs for everybody and needs no permission. Google Analytics is the one that does set cookies. It tells us which pages people find useful and where they give up. It is switched off until you agree: if you are in the UK, the EEA or Switzerland you are asked before anything is measured, and until you answer, nothing is. Saying no changes nothing about how the site works, and your answer is remembered in your own browser — clearing your site data will ask again. Neither of them ever receives your prompts, your uploads, your generations or your email address.
Photographs of people
A character, a face picked for an ad, or any photo you upload as a reference is stored with your account and sent to the model provider that renders the shot. We do not run face recognition, we do not build a faceprint, and we never use these to identify anyone or to train a model. They are kept until you delete the character or the account, and deleting either removes the files from storage. Only upload a photograph of someone else if you have their permission. In the mobile app you can also take the picture there and then. The camera opens only when you tap to use it, nothing is captured in the background, and the photo is then treated exactly like one chosen from your library. Refusing camera or photo access leaves the rest of the app working — only the reference picker stops.
Where it is held
Our database and storage are in the United States. If you are in the UK or the EU, using the product means your data is transferred there.
How long we keep it
Your generations and uploads are kept until you delete them or delete your account — there is no automatic expiry, so anything you want gone has to be removed. Deleting a generation removes the file from storage as well as the record.
Email you can turn off
Product news and promotional email carry an unsubscribe link, and one click stops them for good. You can also turn them off, or back on, in Settings under Account. Receipts, failed payments, password resets and other records of something you did are not marketing and keep arriving — those are the proof of your own transactions.
Payments
Card details are handled entirely by Stripe. We never see or store a card number. A subscription or a credit pack bought inside the mobile app is not ours to take: Google Play or the App Store takes the money under their own terms and their own privacy policy, and we are told only which product was bought and whether it is still active. That message reaches us through RevenueCat, which keeps the purchase record against your account so your plan works on the web as well as the phone. They receive an identifier for your account and the purchase itself — never your prompts, your generations or your card.
Signing in with Google or Apple
Choosing Google or Apple instead of a password hands us what that provider chooses to send: your email address, your name and your profile picture. We use them to find or create your account and nothing else. Apple lets people hide their address, in which case we receive a forwarding one ending @privaterelay.appleid.comand never see the real one. Email we send still reaches you, and your account is matched on Apple’s own identifier rather than the address, so hiding it does not split you into two accounts.
Notifications
If you allow them, the mobile app registers a notification token with Firebase so we can tell you a render has finished. Refusing, or turning notifications off later in your phone’s settings, changes nothing else about the app — the token is simply an address for that phone, it is not an advertising identifier, and it carries no prompt or generation with it.
Cookies
A session cookie to keep you signed in. No advertising trackers.
Your data, and deleting it
You can delete any generation from your Library — the file is removed from storage too. In Settings → Your data you can download everything we hold about you as a file, or delete the whole account: that cancels any subscription, erases your videos and images from storage, and cannot be undone.
Contact
support@buildmy.video