Privacy Policy

We collect only what we need to run the Service and support you:

• Account data: your email address, display name, sign-in details, and information provided by GitHub or Google if you choose one of those sign-in options.
• Images and prompts: the images, masks, and text instructions you submit for editing, and the edited outputs we generate for you.
• Usage records: information about edits, prompts, credits, and activity needed to provide your history and operate the Service.
• Billing records: your plan, credit balance, purchases, and subscription information. Payment details are handled by our payment provider; we do not store your full card number.
• API-key information: details about the keys you create and use. We protect the secret portion of each key.
• Analytics data: limited information about visits, feature usage, referrals, and account activity when analytics is enabled.
• Advertising measurement data: limited information about visits, referrals, ad clicks, and conversions used to measure our campaigns. We do not send submitted images or prompts for advertising measurement.
• Technical and security data: information such as IP addresses and diagnostic details used to secure and support the Service.

We process your personal data for the purposes below. Where the GDPR or similar laws apply, the corresponding legal basis is shown.

• To provide the Service: authenticate you, accept your images and prompts, generate and deliver Output, and maintain your history. Legal basis: performance of our contract with you.
• To operate billing and credits: meter usage, grant and debit credits, process purchases and subscriptions, and keep accurate financial records. Legal basis: performance of a contract and compliance with a legal obligation (accounting and tax).
• To secure the Service and prevent abuse: detect and stop fraud, enforce rate limits and our acceptable-use rules, and protect users. Legal basis: our legitimate interests in a safe, reliable service.
• To support and communicate with you: respond to requests and send essential service and account messages. Legal basis: legitimate interests and, for any optional messages, your consent.
• To understand and improve the Service: measure feature usage, reliability, and purchases. In the European Economic Area and the United Kingdom, optional product analytics and advertising are used only with your consent; elsewhere they run until you turn them off. We may also use operational data as needed to run the Service, where permitted.
• To measure advertising: understand whether a Google or Reddit ad led to a visit, signup, or purchase and evaluate campaign performance. Legal basis: your consent in the European Economic Area and the United Kingdom, and our legitimate interests in promoting the Service elsewhere, subject to your choice to turn it off.
• To comply with law: respond to lawful requests and meet regulatory obligations. Legal basis: compliance with a legal obligation.

We do not sell your personal data. Peelaway does not use your images or prompts to train or fine-tune AI models.

When you submit an edit, we and our service providers process your image, instructions, and any mask you provide to create the requested result. We keep the result in your account so you can retrieve it. We do not make your content public or use it to train AI models.

The extension handles website content only when you click its toolbar action. The activeTab permission is used only after you click the toolbar action, so the extension can capture the visible part of that active web tab for the screenshot you requested. It reads the current tab URL locally only to confirm that the page is a regular HTTP or HTTPS page; it does not read your browser history or run a content script.

Screenshot pixels are processed only on your device and are not transmitted to Peelaway or any third party. The captured PNG is held in extension service-worker memory for no more than 60 seconds and is removed after the editor retrieves it once. Cropping, resizing, and PNG export happen in the packaged editor, and the downloaded file remains under your control. The extension does not use analytics, advertising, cookies, accounts, or persistent storage.

Peelaway's use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Website content is used only to provide the extension's single purpose and is never transferred, used for advertising, or made available for human review by Peelaway. The optional more-tools link opens peelaway.io only when you click it; the website portions of this policy apply after you choose to visit.

We share personal data only with the service providers that help us run Peelaway, under agreements that require them to protect it and use it only on our instructions. Our current sub-processors are:

• Cloudflare: hosting, image processing, storage, networking, and security.
• fal: primary AI processing for the image edits you request.
• Replicate: AI processing for the image edits you request.
• Stripe: payments, subscriptions, checkout, and the billing portal.
• PostHog: optional product analytics and operational measurement.
• Google Ads: advertising attribution and conversion measurement. Enhanced conversions and ad personalization are disabled, and we do not send submitted images, prompts, email addresses, or phone numbers to Google Ads.
• Reddit Ads: advertising attribution and conversion measurement through the Reddit Pixel. Automatic advanced matching is disabled, and we do not send submitted images, prompts, email addresses, or phone numbers to Reddit Ads.
• Loops: service-related email delivery and lifecycle messaging.
• GitHub and Google: optional sign-in.

We may also disclose data if required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets (with notice where required). We do not share your data with third parties for their own marketing.

Peelaway and our service providers may process and store data in the United States and other countries that may have data-protection laws different from your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism made available by the relevant provider. Contact us for more information about the safeguards applicable to your data.

We keep personal data only as long as we need it for the purposes above:

• Images, generated results, and edit history are kept while your account is active so you can retrieve past work. Temporary result links may expire sooner without deleting that work.
• Our AI provider generally removes its temporary copies of inputs and outputs after about one hour.
• Job, usage, account, authentication, API-key, and analytics records are kept while your account is active and for a limited period afterward when needed for security, dispute resolution, or legal compliance.
• When we fulfill a verified deletion request, we delete account-linked database records and request deletion of stored images, subject to legal exceptions and limited backup or provider retention.
• Billing and transaction records are kept for as long as required to meet accounting, tax, and legal obligations, even after account deletion.

Depending on where you live, you have rights over your personal data. Under the GDPR and similar laws these may include the rights to access, correct, delete, restrict or object to processing, and data portability, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority.

• Access and portability: ask for a copy of the personal data associated with your account.
• Correction: ask us to correct inaccurate account information.
• Deletion: ask us to delete your account and account-linked content, subject to legal exceptions.
• Consent and objection: turn off optional measurement and advertising when first asked, or change your choice at any time through the Cookie choices control in the site footer.

Submit a request from the email address associated with your account to hello@peelaway.io. We may need to verify your identity before acting on a request. We will respond within the period required by applicable law and will not discriminate against you for exercising your rights.

If the California Consumer Privacy Act, as amended by the CPRA, applies to Peelaway's processing, California residents have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. Peelaway does not sell or share your personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that require a right to limit. In the preceding 12 months, we have collected the identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation inferred from network information, and user-provided images or other content described above. We collect this information from you, your device, your chosen sign-in provider, and our payment provider. We disclose the relevant categories to the service providers listed in Section 5 for the business purposes described in Section 2; we have not sold or shared them for cross-context behavioral advertising. Submit a request to know, access, correct, or delete by emailing hello@peelaway.io. We will verify and respond to requests as required by law and will not discriminate against you for exercising your rights.

We use reasonable technical and organizational safeguards to protect your data, including encryption and access controls. No service can guarantee absolute security, but we work to protect your data and respond appropriately to incidents.

The Service is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, provide additional notice.

For any privacy question or request, including data-subject and California rights, contact Prologue Machines LLC at hello@peelaway.io.