Privacy Policy

Who we are

Tiny-Desk-AI is a video generation service. For privacy questions, or to exercise any right described below, email us at the support address shown in the footer of every page.

What we collect

• Account details: your email address, plus the display name and avatar if you sign in with Google.
• What you create: the reference photos you upload, the motion prompt you write, the clips we render, and the settings used for each render.
• Credit activity: purchases, redeem codes, spending per render and refunds, so the balance on your account can be explained line by line.
• Technical data: a salted hash of your IP address (never the raw address) used for rate limiting and abuse prevention, plus the browser string recorded with a session.

How we use it

• To render your clip and deliver the download.
• To keep your credits correct and show your history.
• To stop abuse: rate limits, duplicate-account checks and fraud prevention on redeem codes.
• To answer support requests and, when the law requires it, to keep records of transactions.

Cookies

One cookie does the work: a session cookie that keeps you signed in. It is HttpOnly, SameSite=Lax, and expires after 30 days or when you sign out. We do not set advertising cookies and we do not sell data. If a deployment enables page analytics, the tag only loads after you interact with the page.

Who we share with

• Cloudflare — hosting, database, file storage and email routing for the service.
• Our email provider — to deliver six-digit sign-in codes.
• Google — only if you choose to sign in with a Google account.
• Model providers — the reference photo and prompt are sent to the provider that renders the clip. They are not permitted to use your content for their own training under our agreements with them.
• Authorities — only when we are legally required to disclose, and only what is requested.

How long we keep it

• Rendered clips and their source references: 7 days, then deleted automatically.
• Sessions: 30 days, or immediately when you sign out.
• Credit ledger and order records: kept while your account exists, and afterwards as long as accounting law requires.
• IP hashes used for rate limiting: up to 30 days.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account and everything attached to it. Email us from the address on the account and we will respond within 30 days. Deleting an account removes your renders, references and credit history; records we must keep for tax purposes are retained in the minimum form the law allows.

Security

Traffic is served over HTTPS. Session tokens are stored only as hashes, passwords (where enabled) are stored as salted hashes, and access to production data is limited to operators who need it. No system is perfectly secure, so please use a unique email account for sign-in.

Children

The service is not intended for anyone under 16. If you believe a child has created an account, email us and we will remove it.

Changes

If this policy changes in a way that affects what we collect or how long we keep it, we will update the date at the top of this page and, for material changes, tell you by email before the change takes effect.