Privacy Policy

We collect only what we need to run the Service and support you:

• Account data: your email address, display name, and, if you sign in with GitHub, the identifiers your provider shares to authenticate you. We store password credentials in hashed form only.
• Images and prompts: the images, masks, and text instructions you submit for editing, and the edited outputs we generate for you.
• Usage and job records: for each edit, we log a job identifier, its status, the prompt text, the credits used, and timestamps, so you can see your history and so we can operate and support the Service.
• Billing records: your plan, credit grants and balances, purchase and billing events, and the customer and subscription identifiers our payment provider assigns. We do not collect or store your full card number; payment details are handled by our processor.
• API-key metadata: the name, key prefix, creation date, and last-used time of the keys you create. We never store or expose the secret portion of a key in readable form.
• Technical and security data: limited request and diagnostic information (such as IP address and request metadata) used to secure the Service, prevent abuse, and debug problems.

We process your personal data for the purposes below. Where the GDPR or similar laws apply, the corresponding legal basis is shown.

• To provide the Service: authenticate you, accept your images and prompts, generate and deliver Output, and maintain your history. Legal basis: performance of our contract with you.
• To operate billing and credits: meter usage, grant and debit credits, process purchases and subscriptions, and keep accurate financial records. Legal basis: performance of a contract and compliance with a legal obligation (accounting and tax).
• To secure the Service and prevent abuse: detect and stop fraud, enforce rate limits and our acceptable-use rules, and protect users. Legal basis: our legitimate interests in a safe, reliable service.
• To support and communicate with you: respond to requests and send essential service and account messages. Legal basis: legitimate interests and, for any optional messages, your consent.
• To comply with law: respond to lawful requests and meet regulatory obligations. Legal basis: compliance with a legal obligation.

We do not sell your personal data, and we do not use your images or prompts to train, fine-tune, or improve AI models.

When you submit an edit, your image and prompt are stored in our object storage and sent to our AI-inference provider to perform the requested edit; the resulting Output is returned to you. This processing happens only to deliver the result you asked for. Your images and prompts are not used to train models, and we do not make them public.

We share personal data only with the service providers that help us run Peelaway, under agreements that require them to protect it and use it only on our instructions. Our current sub-processors are:

• Cloudflare: application hosting, object storage (R2) for your images, and supporting infrastructure.
• Replicate: AI model inference that performs the image edits you request.
• Polar: payment processing and checkout, acting as merchant of record for purchases.
• PostHog: product analytics — usage and event data (pages viewed, features used, edits and purchases) to operate and improve the Service. Collected without advertising or tracking cookies.
• Resend: transactional email delivery (for example, email verification).
• GitHub: optional OAuth sign-in, if you choose to authenticate with GitHub.

We may also disclose data if required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets (with notice where required). We do not share your data with third parties for their own marketing.

Peelaway and our sub-processors may process and store data in the United States and other countries that may have data-protection laws different from your own. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism.

We keep personal data only as long as we need it for the purposes above:

• Uploaded and output images are retained for a limited window (currently around 30 days) and are access-controlled: they are served only through short-lived, cryptographically signed URLs that expire (currently about one hour).
• Job and usage records are kept while your account is active so you can view your history.
• Account data is kept while your account exists and is removed when you delete your account.
• Billing and transaction records are kept for as long as required to meet accounting, tax, and legal obligations, even after account deletion.

Depending on where you live, you have rights over your personal data. Under the GDPR and similar laws these include the rights to access, correct, delete, restrict or object to processing, and data portability, as well as the right to withdraw consent and to lodge a complaint with a supervisory authority. We have built two of these rights directly into the product:

• Access and portability: export a machine-readable (JSON) copy of the data we hold about you, including your profile, credit grants, usage logs, API-key metadata, and billing events, from your account settings.
• Deletion: permanently delete your account from your account settings. This removes your user record and, by cascade, your credits, keys, and usage history, and purges your stored images from our object storage.

Manage these from your account settings. To exercise any other right, or if you need help, contact hello@peelaway.io. We will not discriminate against you for exercising your rights.

Under the California Consumer Privacy Act, as amended by the CPRA, California residents have the right to know what personal information we collect and how we use it, to request access and deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. Peelaway does not sell or share your personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that would require an opt-out. The categories we collect and our purposes are described in the sections above; you can exercise your access and deletion rights directly in your account settings or by contacting hello@peelaway.io. We will not discriminate against you for exercising these rights.

We use technical and organizational measures to protect your data, including encryption of data in transit, access controls, hashed credentials and API keys, and short-lived signed URLs that gate access to your stored images. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond appropriately to incidents.

The Service is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, provide additional notice.

For any privacy question or request, including data-subject and California rights, email hello@peelaway.io.