Privacy Policy

We collect only what we need to run the Service and support you:

• Account data: your email address, display name, sign-in details, and information provided by Apple or Google if you choose an available sign-in option.
• Images and prompts: the images, masks, and text instructions you submit for editing, and the edited outputs we generate for you.
• Profile and sharing data: your username, display name, biography, and the images or styles you choose to publish or share.
• Safety and privacy choices: content reports and their details, blocked creators, and the version and acceptance time of your mobile AI processing permission.
• Usage records: information about edits, prompts, credits, and activity needed to provide your history and operate the Service.
• Billing records: your plan, credit balance, purchases, and subscription information. Payment details are handled by our payment provider; we do not store your full card number.
• API-key information: details about the keys you create and use. We protect the secret portion of each key.
• Analytics data: limited information about visits, feature usage, referrals, and account activity when analytics is enabled.
• Advertising measurement data: limited information about visits, referrals, ad clicks, and conversions used to measure our campaigns. We do not send submitted images or prompts for advertising measurement.
• Technical and security data: information such as IP addresses and diagnostic details used to secure and support the Service.

We process your personal data for the purposes below. Where the GDPR or similar laws apply, the corresponding legal basis is shown.

• To provide the Service: authenticate you, accept your images and prompts, generate and deliver Output, and maintain your history. Legal basis: performance of our contract with you.
• To operate billing and credits: meter usage, grant and debit credits, process purchases and subscriptions, and keep accurate financial records. Legal basis: performance of a contract and compliance with a legal obligation (accounting and tax).
• To secure the Service and prevent abuse: detect and stop fraud, enforce rate limits and our acceptable-use rules, and protect users. Legal basis: our legitimate interests in a safe, reliable service.
• To support and communicate with you: respond to requests and send essential service and account messages. Legal basis: legitimate interests and, for any optional messages, your consent.
• To understand and improve the Service: measure feature usage, reliability, and purchases. In the European Economic Area and the United Kingdom, optional product analytics and advertising are used only with your consent; elsewhere they run until you turn them off. We may also use operational data as needed to run the Service, where permitted.
• To measure advertising: understand whether a Google or Reddit ad led to a visit, signup, or purchase and evaluate campaign performance. Legal basis: your consent in the European Economic Area and the United Kingdom, and our legitimate interests in promoting the Service elsewhere, subject to your choice to turn it off.
• To comply with law: respond to lawful requests and meet regulatory obligations. Legal basis: compliance with a legal obligation.

We do not sell your personal data. Peelaway does not use your images or prompts to train or fine-tune AI models.

When you submit an edit, we and our service providers process your image, instructions, and any mask you provide to create the requested result. We keep the result in your account so you can retrieve it. Your creations are private unless you choose to publish or share them. Your public profile and published images or styles are visible to others, who may view or remix available content. Peelaway does not use your content to train AI models.

On iOS and Android, you can take a photo with camera permission or choose a photo using the system photo picker. The app accesses the photo you select, rather than your entire photo library. It prepares a resized copy on your device and keeps that copy with your creation draft so you can resume it. Selecting a photo does not upload it for AI processing; upload happens when you choose to create. Saving a result to your photo library uses your device's permission controls. Files you save or share remain under your control.

Before your first mobile creation, the app asks permission to send your selected photo and instructions to its AI processing providers: fal.ai, Replicate, and Cloudflare. Photos may contain faces or other personal information. You can decline and continue browsing, or withdraw this permission in Settings before future creations. Withdrawal does not undo processing already requested or delete existing creations. We store your permission choice with your account; account deletion is available separately.

The extension handles website content only when you click its toolbar action. The activeTab permission is used only after you click the toolbar action, so the extension can capture the visible part of that active web tab for the screenshot you requested. It reads the current tab URL locally only to confirm that the page is a regular HTTP or HTTPS page; it does not read your browser history or run a content script.

Screenshot pixels are processed only on your device and are not transmitted to Peelaway or any third party. The captured PNG is held in extension service-worker memory for no more than 60 seconds and is removed after the editor retrieves it once. Cropping, resizing, and PNG export happen in the packaged editor, and the downloaded file remains under your control. The extension does not use analytics, advertising, cookies, accounts, or persistent storage.

Peelaway's use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Website content is used only to provide the extension's single purpose and is never transferred, used for advertising, or made available for human review by Peelaway. The optional more-tools link opens peelaway.io only when you click it; the website portions of this policy apply after you choose to visit.

We share personal data only with the service providers that help us run Peelaway, under agreements that require them to protect it and use it only on our instructions. Our current sub-processors are:

• Cloudflare: hosting, image processing, storage, networking, and security.
• fal: primary AI processing for the image edits you request.
• Replicate: AI processing for the image edits you request.
• Stripe: payments, subscriptions, checkout, and the billing portal.
• PostHog: optional product analytics and operational measurement.
• Google Ads: advertising attribution and conversion measurement. While optional measurement is on, we send Google a SHA-256 hash of your verified account email to match ad views with paid purchases, including purchases made later. Turning optional measurement off in Cookie settings stops this. Ad personalization remains disabled. We do not send raw email addresses, phone numbers, submitted images or prompts to Google Ads.
• Reddit Ads: advertising attribution and conversion measurement through the Reddit Pixel and server conversion events. Automatic advanced matching is disabled, and we do not send submitted images, prompts, email addresses, or phone numbers to Reddit Ads.
• Meta: optional advertising attribution using browser and click identifiers, IP address, browser information and purchase metadata. Submitted images, prompts, email addresses and phone numbers are excluded.
• Loops: service-related email delivery and lifecycle messaging.
• Apple and Google: optional sign-in.

We may also disclose data if required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets (with notice where required). We do not share your data with third parties for their own marketing.

Peelaway and our service providers may process and store data in the United States and other countries that may have data-protection laws different from your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, an adequacy decision, or another lawful transfer mechanism made available by the relevant provider. Contact us for more information about the safeguards applicable to your data.

We keep personal data only as long as we need it for the purposes above:

• Images, generated results, and edit history are kept while your account is active so you can retrieve past work. Temporary result links may expire sooner without deleting that work.
• AI providers may retain temporary copies of inputs and outputs under their own retention policies and the settings that apply to the processing request. Contact us for information about a particular request.
• Job, usage, account, authentication, API-key, and analytics records are kept while your account is active and for a limited period afterward when needed for security, dispute resolution, or legal compliance.
• When we fulfill a verified deletion request, we delete account-linked database records and request deletion of stored images, subject to legal exceptions and limited backup or provider retention.
• Billing and transaction records are kept for as long as required to meet accounting, tax, and legal obligations, even after account deletion.

Depending on where you live, you have rights over your personal data. Under the GDPR and similar laws these may include the rights to access, correct, delete, restrict or object to processing, and data portability, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority.

• Access and portability: ask for a copy of the personal data associated with your account.
• Correction: ask us to correct inaccurate account information.
• Deletion: ask us to delete your account and account-linked content, subject to legal exceptions.
• Consent and objection: turn off optional measurement and advertising when first asked, or change your choice at any time through the Cookie choices control in the site footer.

You can delete your account on the website through Settings → Delete account, in the mobile app through Profile → Settings → Delete account, or use our account deletion request page without the app. For other privacy requests, email hello@peelaway.io from the address associated with your account. We may need to verify your identity before acting on a request. We will respond within the period required by applicable law and will not discriminate against you for exercising your rights.

If the California Consumer Privacy Act, as amended by the CPRA, applies to Peelaway's processing, California residents have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. Peelaway does not sell or share your personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that require a right to limit. In the preceding 12 months, we have collected the identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation inferred from network information, and user-provided images or other content described above. We collect this information from you, your device, your chosen sign-in provider, and our payment provider. We disclose the relevant categories to the service providers listed in Section 5 for the business purposes described in Section 2; we have not sold or shared them for cross-context behavioral advertising. Submit a request to know, access, correct, or delete by emailing hello@peelaway.io. We will verify and respond to requests as required by law and will not discriminate against you for exercising your rights.

We use reasonable technical and organizational safeguards to protect your data, including encryption and access controls. No service can guarantee absolute security, but we work to protect your data and respond appropriately to incidents.

The Service is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, provide additional notice.

For any privacy question or request, including data-subject and California rights, contact Prologue Machines LLC at hello@peelaway.io.