Privacy policy

Your photos and models

• Enhancing, reading the photo type, 3D depth, the point cloud and the download files are all made in your browser.
• Remove the background for me sends a smaller copy of the photo (a JPEG up to 1536 pixels) through our server to fal.ai, which returns the cutout. Full 3D figure does the same to make a 3D model. We do not store these copies, and we ask the provider to return results directly. fal.ai's own privacy terms apply to that processing. If you do not want a photo to leave your device, choose "Keep the background" or "My photo already has a clean background".
• We do not use your photos to train AI models, and we do not sell or share them.

Faces and biometric data

Face and photo recognition runs only in your browser to choose settings (for example, the photo type, depth and where to add detail). We do not collect, store or share face geometry or any biometric data. Nothing about the faces in your photo is sent to us or kept after you close the page.

Accounts and payments

• Accounts (when available): if you create one we keep your email address and your plan (free or Pro, renewal date). Passwords are handled by our account provider, Supabase, and stored only as secure hashes.
• Payments (when available) are handled by Stripe. Stripe receives your card and billing details; we receive only a customer ID, the subscription status and dates. We never see your full card number.
• We send account emails (when available) (confirm your email, reset your password, your subscription's renewal terms, receipts from Stripe). We do not send marketing emails unless you ask for them.

Free-plan counting and security

To give everyone one free full-feature photo a day and stop abuse (when available), we record the day, a random code saved in your browser, and a one-way scrambled code made from your network address (not the address itself), plus a short code for the photo (not the photo). We keep these records for up to 60 days. Our host, Vercel, keeps standard technical logs (such as IP address and browser type) for security and reliability.

Saved on your device

Your recent crystals (photo and settings), Burn log notes, saved setups, preferences and, when you sign in, a sign-in token are kept in your browser's storage. They are not sent to us. Clear them with the × buttons, by signing out, or by clearing this site's data in your browser. We do not use advertising or tracking cookies.

Do Not Track and Global Privacy Control

Our site does not use tracking across other sites, and we treat browser Do Not Track and Global Privacy Control signals as an opt-out of any sale or sharing. (We do not sell or share personal information in the first place.)

Other services we use

Vercel (hosting), fal.ai (AI background removal and 3D figures), Google Fonts and public code sites such as jsDelivr and Google for loading the lettering fonts and photo-recognition tools (these see your browser's network address, as any website does, but your photo is not sent to them), and, when available, Supabase (accounts) and Stripe (payments). Each processes data only to provide its service to us.

Your rights (including California)

You can ask to see, correct, download or delete the personal information we hold about you, and, when accounts are available, delete your account yourself in Account → Delete account. California residents have these rights under the CCPA/CPRA; we do not sell or share personal information for cross-context advertising, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using these rights. Email Thedyckmans@disrupttheordinary.com; we answer within 45 days and may need to confirm it is you. California residents may also ask, once a year, whether we shared personal information with others for their direct marketing (we do not).

How long we keep data

Account and plan details: while your account is open, then deleted (payment records Stripe must keep for tax and law stay with Stripe). Free-plan counting records: up to 60 days. Photos sent for processing: not kept by us.

Children

The Service is not meant for children under 13, and we do not knowingly collect their information. If you think a child gave us information, email Thedyckmans@disrupttheordinary.com and we will delete it.

Security

Data is sent over encrypted connections, account tables are locked to our server only, and payment details stay with Stripe. No system is perfectly secure; if a breach affects you we will tell you as the law requires.

Changes and contact

We will post changes here and update the date above; important changes will be announced on the site or by email. Questions: Thedyckmans@disrupttheordinary.com · Disrupt The Ordinary LLC, California, USA (mailing address on request).