Privacy policy
What we keep about you, why, and how to delete it. Last updated 14 November 2026.
Phantasia is run by [Company name], [Registered address], which is responsible for your data. Questions or requests: contact us.
What we keep, and why
| What | Why |
|---|---|
| Your email address and password (stored scrambled; we can’t read it) | Your account and signing in |
| Your prompts, settings and the files you make | Making them, showing them to you, and keeping our daily limits fair |
| Pictures you upload to animate | Animating them. Each is checked automatically: pictures with faces or nudity are refused and deleted at once |
| Your credits and their history | Charging and refunding credits |
| Your API keys (only a short fingerprint we can’t turn back into the key) and your Gemini API key if you add one (encrypted; only the last 4 characters are ever shown) | Letting your agents, scripts and Google models work for you |
| Messages you send us | Answering you |
| Error reports (what went wrong, on which page) | Fixing problems |
| A count of visits per day, page and referring site, with nothing about you | Knowing how people find us |
We don’t sell your data, show ads, or use advertising trackers. We don’t use your prompts or creations to train models.
Cookies and storage
We use your browser’s storage only to keep you signed in, to remember a prompt you picked before signing up, and to count a visit once per tab. No advertising or tracking cookies.
Who else handles your data
We use these services to run Phantasia. They process data only to provide their service to us:
- Supabase: accounts, sign-in, the database (creations, credits, messages).
- Vercel: runs the website.
- Modal: runs the AI models that make your creations.
- Cloudflare R2: stores the files you make.
- Google (Gemini API): only if you add your own Gemini key: prompts for Google models go to Google under your key and Google’s terms (on Google’s free tier, Google may use them to improve its products).
Your account data is stored in [Supabase project region]. Some of these services work in other countries, including the United States; they are bound by data-protection agreements.
What’s public
Nothing you make is public until you share it to the gallery. Shared creations show the creation, your prompt and the model, not your email. You can un-share or delete them any time.
How long we keep it
- Your account and creations: until you delete them.
- A deleted creation: its file is removed about a day later (so Undo works); a small record stays so daily limits stay fair.
- When you delete your account: your account and everything linked to it is deleted at once; your files are removed within a few hours. Backups may keep a copy for a short while until they roll over.
- Messages and error reports: up to 12 months.
Your rights
You can see, correct, download or delete your data, object to how we use it, or ask us to limit it. Delete your account yourself on the Account page; for anything else, contact us and we’ll answer within 30 days. If you’re unhappy with our answer, you can complain to your data-protection authority.
Children
Phantasia is for people aged 16 and over. If you think a younger child has an account, tell us and we’ll delete it.
Changes
If this policy changes in a way that matters, we’ll say so on the site. The date at the top shows the latest version.