Privacy Policy

In short

• No ads, no analytics, no tracking or advertising cookies, no third-party scripts.
• We never store your IP address as such: it is replaced by a salted one-way hash.
• You cannot upload photos, so we hold no pictures of you.
• Your generations are private unless you share them to the public feed, where a moderator approves them first.
• We do not sell your data or share it with advertisers.

1. What we collect

If you use the Service without an account:

• an anonymous visitor ID, stored in a cookie on your device, linked to the number of free generations used, the time you confirmed you are 18 or older, and daily usage counts;
• the prompts, options and generated images described below.

If you sign in with Google or X (Twitter):

• your e-mail address, display name and profile picture as provided by that service (or a random avatar), your account ID with that service, and the sign-in tokens it issues;
• a username we create for you, your role and account status, the time you confirmed you are 18 or older, and the time of your last visit;
• your settings: default style, format and number of images, content preference (straight, gay or trans), whether shared images show your username, gallery blur, e-mail notification choices and language;
• your likes and favourites.

Whenever you are signed in, your session: a session token, its expiry date, the hashed IP address and your browser's user-agent string (device and browser type).

For each generation: the prompt you wrote, the final prompt sent to the engine, the style, format, options, random seed, automatic tags, status, technical data (processing time, errors) and the resulting images.

Safety data: when a prompt is blocked, the rule it triggered, a short excerpt of the prompt (at most 80 characters) and the account or visitor ID. When you report an image, the image, the reason you chose and, if you are signed in, your account. Sensitive staff actions (bans, deletions) are recorded in an audit log.

IP addresses: our servers necessarily receive your IP address to deliver pages. To limit abuse (for example too many requests in a minute) we only use a salted SHA-256 hash of it, kept in memory for about a minute. The hashed form is also stored with your session. The raw IP address is never written to our database.

We do not collect payment data, precise location, contacts, or any photo of you.

2. Why we use it, and on what legal basis

• To provide the Service you ask for: generating, storing and showing your images, your account and settings, sharing. Basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep the Service safe and lawful: age confirmation, prompt filtering, moderation, handling reports, suspending accounts after repeated attempts involving minors, preventing abuse and enforcing free and daily limits. Basis: our legitimate interest in running a safe service and preventing illegal content (Art. 6(1)(f)), and our legal obligations (Art. 6(1)(c)).
• To answer your requests and comply with the law, including requests from authorities. Basis: legal obligation (Art. 6(1)(c)).

Your content preference and your prompts may reveal information about your sex life or sexual orientation, which is sensitive data. We process it only because you choose to give it to us to use the Service (Art. 9(2)(a)), only to provide that Service and keep it safe, never for advertising or profiling. You can withdraw by changing your settings or deleting your content or account.

3. Cookies

We only use cookies that the Service needs to work, so no consent banner is required. There are no third-party cookies. Fonts are served from our own server.

• mg_age: remembers that you confirmed you are 18 or older (the time of the click). 1 year.
• mg_guest: your anonymous visitor ID, used for free generations and to keep your images before you sign in. Not readable by page scripts. 1 year.
• mg_orient: your content preference (straight, gay or trans). 1 year.
• better-auth.session_token (prefixed with __Secure- on HTTPS) and short-lived helper cookies used during Google or X sign-in: keep you signed in. Not readable by page scripts. 30 days, renewed while you use the site.

4. Who processes your data

• Our server: a virtual private server in the European Union hosts the website, the database, the generation queue and the generated images.
• GPU servers: images are created on graphics servers we rent from RunPod. They receive only what is needed to create the image (final prompt, style, content preference, size, seed), never your e-mail or account details. The images are sent back to our server and stored there.
• Google and X: if you choose to sign in with them, they act as independent controllers under their own privacy policies. We only receive the basic profile described above.
• Authorities: we disclose data when the law requires it, and we report content involving minors to the competent authorities (such as NCMEC or the police).

Nobody else receives your data. We use no advertising networks, data brokers or analytics providers.

5. Transfers outside the EU

Our server is in the EU and we choose EU data centres for GPU servers where available. Some providers (RunPod, Google, X) are based in the United States. Where data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. Who can see your images

Your generations are private: only you can see them, plus authorised staff when needed for moderation, safety, support or legal reasons.

If you share an image to the public "Popular" feed, a moderator reviews it first. Once approved, anyone can see the image and its prompt, and your username if your settings allow it. You can make it private again at any time, but we cannot recall copies others may already have saved.

7. How long we keep it

• Account data and settings: as long as your account exists. When you ask us to delete your account, it is deleted together with its generations, images, likes, favourites and sessions, normally within 30 days.
• Generations and images: until you or we delete them, or your account is deleted. Images removed after a report are hidden immediately and may be kept for a limited time for review and as evidence.
• Visitor (guest) data: linked to the visitor cookie. If you sign in, it is moved to your account; otherwise it may be deleted at any time once inactive.
• Sessions: expire 30 days after they were last renewed, and end when you sign out or are banned.
• Reports, blocked-prompt records and the audit log: as long as necessary to keep the Service safe, handle disputes and meet legal obligations. Records about content involving minors may be kept and handed to the authorities.
• Hashed IP addresses used for rate limiting: about one minute, in memory only.

8. Your rights

Under the GDPR and similar laws you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted ("right to be forgotten");
• restrict or object to certain processing, including processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting earlier processing;
• lodge a complaint with a data-protection authority, in particular in the EU country where you live or work.

To use these rights, contact us at the contact address published on this page once available. To protect your account, we may ask you to write from the e-mail address linked to it. We answer within one month. We may keep some data where the law requires it or to establish or defend legal claims, for example evidence of illegal content.

9. Security

The site is served over HTTPS. Session and visitor cookies cannot be read by page scripts. IP addresses are hashed. Members have no password with us: sign-in goes through Google or X. Access to user data is limited to authorised staff, and sensitive staff actions are logged.

10. Minors

The Service is for adults only. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to a minor, we close it and delete its data, except what we must keep to meet legal obligations.

11. Changes

We will update this policy when the Service changes. The date at the top shows the latest version. Significant changes will be announced on the site.

Operator and contact

The operator's full legal details (legal name, postal address and contact e-mail) will be published in this section. Until then, use the Report button on any image for anything urgent about content on the site.