Privacy Policy

We collect:

• Account information — your email address and a password, which is stored only as a salted hash and never in plain text.
• Content you provide — the prompts you enter and the images or videos you upload as source material, plus the outputs you generate.
• Payment information — purchases are processed by Stripe. Stripe handles your card details directly; we never see or store your full card number.
• Usage and technical data — generation timestamps, models used, credit activity, and standard server logs such as IP address and browser/device type, used for security, abuse prevention, and operating the Service.

We use the information above to:

• Provide the Service, authenticate you, and track your credit balance;
• Process payments and manage subscriptions;
• Generate, deliver, and store your outputs and history;
• Detect, prevent, and investigate abuse, fraud, and violations of our Terms;
• Comply with legal obligations and enforce our agreements;
• Respond to support requests and send service-related communications;
• Maintain and improve the security and reliability of the Service.

If you are in the EEA or UK, we process your data on the bases of performing our contract with you, our legitimate interests in operating and securing the Service, your consent where applicable, and compliance with legal obligations.

We use essential cookies and similar technologies to keep you signed in, remember preferences, and secure the Service. We use Cloudflare Turnstile to protect certain forms from bots. We do not use advertising or cross-site tracking cookies.

We do not sell your personal information. We share it only as needed to run the Service:

• Service providers — Supabase (authentication, database, and file storage), Stripe (payments), FAL.ai and its model providers (generation processing), Resend (transactional email), Cloudflare (bot protection), and our hosting provider. Each processes data under its own terms.
• Legal and safety — to comply with law or valid legal process, enforce our Terms, or protect the rights, safety, and property of Dirtybunny, our users, or the public. We report confirmed child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) and law enforcement.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Source images and videos you upload for a generation are automatically deleted 30 days after upload. Generated outputs and your generation history are retained while your account is active so your history stays available. Account information is retained until you delete your account. We may retain limited information longer where necessary to comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements.

We use technical and organizational measures to protect your information, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your account by using a strong, unique password and keeping your credentials confidential.

Depending on where you live, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. You can:

• Delete your account and associated data yourself from Account settings;
• Submit a deletion request via our Data Deletion page;
• Contact us with any other privacy request via our Contact page.

We do not sell or “share” personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights. EEA/UK users also have the right to lodge a complaint with their local data-protection authority.

The Service is not directed to and may not be used by anyone under 18. We do not knowingly collect personal information from minors. If we learn we have collected information from a minor, we will delete it. We have zero tolerance for content that sexualizes or exploits minors and report it as described above.

We and our service providers are based in or process data in the United States and may process your information in other countries. By using the Service, you understand your information may be transferred to and processed in countries with different data-protection laws than your own.

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide reasonable notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Questions or requests regarding this Policy? Reach us via the Contact page.