Privacy Policy

Overview

This Privacy Policy describes what Depikt collects, why, and what happens to it. It is written to match how the product actually works today.

Information we collect

Account information. When you sign in with a supported identity provider, we receive the identity your provider shares with us: an identifier, your email address (Apple may provide a private relay address instead), and, where offered, your name and profile picture. Passwordless email sign-in uses your email address to send an authentication link. We do not receive or store passwords. Sign-in is brokered by Lovable's managed OAuth service and sessions are issued by Supabase Auth.

Prompts. Text you enter in Improve prompt and Critique is sent to OpenAI to produce or review a prompt. Text you use to generate or edit an image is stored with that generation job so that you can see, regenerate, and edit your work.

Reference images. Images you attach are resized in your browser and uploaded to private storage under your account. They are sent to OpenAI only to run the job you requested.

Generated images. Every successful generation or edit is stored privately under your account, together with its prompt and size. When research or validation ran for a job, related status and source metadata may be stored with that result.

Research queries. When grounded generation needs current or visual context, Depikt may send short search queries derived from your request to a web search provider. Returned snippets and image thumbnails are used only to support that job; they are not used for advertising.

Credits and billing. We keep a ledger of every credit change (starter grant, plan grants, purchases, reservations, refunds) and a billing record with your plan, subscription status, and billing period.

How we use information

We use this information to run your account: authenticate you, process the generation or edit you asked for (including research and validation when those stages run), show you your credit balance and history, keep your Creations and drafts available across sessions, process payments, and understand how the product is used so we can improve it. We do not use your prompts, reference images, or generated images for advertising.

AI and image processing

Prompt and image requests are sent to OpenAI to produce the result. Per OpenAI's API data controls, inputs and outputs may be retained for a limited period for abuse monitoring and are not used to train OpenAI's models by default. Validation checks that need OCR or visual judgment also use OpenAI.

Service providers

• OpenAI — generates prompts and images, and supports validation checks.
• Brave Search — web and image search when grounded generation needs external context.
• Supabase — database, authentication, and private file storage.
• Cloudflare — hosting and edge network.
• Lovable — managed OAuth broker for Google, Apple, and Microsoft sign-in.
• Stripe — subscriptions, one-time purchases, invoices, and the billing portal. We never see or store your card number; payment details are entered on Stripe's hosted pages.
• Google — Google Analytics 4 and Google Fonts.

We do not sell your data and do not share it with anyone else.

Storage and retention

Your account data, generated images, reference images, and credit ledger are kept while your account exists. When you delete your account (Account → Delete account), we cancel any active subscription, remove your reference uploads and generated images from storage, and delete your account and credit records. We keep a minimal deletion record and purchase records without your name or email, because payment records may need to be retained for accounting, refund, and dispute purposes. Stripe retains its own records of your payments under Stripe's privacy policy.

Analytics and browser storage

We use Google Analytics 4 to understand how the site is used: page views and clicks on buttons and links. We do not send prompt text, images, email addresses, or payment details to analytics.

Depikt also keeps some data only on your device: your Improve prompt and Critique history (including any reference image you attached, up to a size limit) in IndexedDB; favorites, theme, and library filters in localStorage; and short-lived hand-offs (for example, a generation you started before signing in) in sessionStorage. You can clear these through your browser at any time; deleting your account also clears them on the device you delete from.

Payments

Subscriptions and credit-pack purchases are processed by Stripe. Depikt keeps your plan, subscription status, billing period, and your Stripe customer and subscription identifiers -- never your card details.

Your choices and account deletion

You can update your profile, manage billing, and delete your account at any time from the Account page. Signing out ends your session on that device. You can clear or manage Depikt's browser-stored data (history, favorites, preferences) through your browser's own settings.

Contact

For support or privacy requests, email depiktapp@gmail.com.

Security

Data is transmitted over HTTPS. Generated and uploaded images are stored in a private bucket readable only by the owning account. Database access is protected by row-level security, and payment processing never passes through our servers. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.

Age

Users must be at least 13 years old, or the minimum age required in their country to use online services. Users under 18 must have permission from a parent or legal guardian.

Changes to this policy

We will update this page when our practices change and update the effective date above. Material changes will be announced in the product.