Privacy Policy

Adamantite H is the controller of the personal data described here. Reach us at .

Account data. Your email address, your display name, and a bcrypt hash of your password. We never hold the password itself and cannot recover it for you.

Session data. A session record per sign-in, holding a hashed token, creation time and time last seen. The last-seen timestamp is what enforces the 1-hour idle sign-out and what tells the account owner whether a session is currently active.

Content. Your projects, your prompts, the settings you chose, and the images and video you generated.

Linked sign-in accounts. If you sign in with Microsoft we store that provider's permanent identifier for you, the email address it gave us, and when you last used it. We ask Microsoft only for your name, email and profile — never your contacts, files or mail — and we never receive your password.

Billing data. Your plan, subscription status, period dates, and the Stripe customer and subscription identifiers. Card numbers never reach our servers — Stripe collects and stores those directly.

Usage data. A credit ledger entry for each generation and refund, so a balance can be explained rather than merely asserted.

Analytics. We record a row per page view: the path, the referring site's domain, how long the page was open, your browser, operating system and device type, any campaign tag in the link you followed, and the country, region and city our host resolves from your connection.

That row carries no name and no address. Repeat visits are counted through a one-way hash of your IP and browser string mixed with a salt that changes every day, so the same person is a different value tomorrow and the hash cannot be reversed to an address. We do not store IP addresses. If you happen to be signed in, the view is linked to your account so we can tell customers from strangers.

The analytics are ours and run on our own servers. There is no Google Analytics, no advertising pixel, no third-party script and no data broker. We set no analytics cookie — the only cookies on this site are the session cookie that keeps you signed in and a short-lived one used during Microsoft sign-in. Both are strictly necessary, which is why you are not shown a consent banner.

• Account, session and content data — to perform the contract of providing the service.
• Billing and usage data — to perform the contract, and to meet accounting and tax obligations.
• Analytics — our legitimate interest in understanding how the site is used. It is measured in a form that cannot identify you, which is what makes that basis appropriate rather than consent.
• Security and abuse records — our legitimate interest in keeping the service working and lawful.

Model providers. To generate anything we must send your prompt, your chosen settings and any reference image you supplied to the provider running that model. They process it under their own terms and policies.

Stripe. Payment processing and subscription management.

Microsoft. Only if you choose to sign in with it, and only to verify who you are. We send them no information about what you do on this site.

Hosting and database providers. Infrastructure that runs the application and stores its data, acting on our instructions.

We share data with no one else, and we do not sell personal data to anyone for any purpose. We may disclose data where a law or a valid court order requires it.

We do not use your prompts, uploads or generated output to train any model, and we do not license them to anyone who does. Providers apply their own policies to material sent to them for generation; those policies are theirs, not ours, and are worth reading if this matters to your work.

• Account and content data: until you delete the content or close your account.
• Sessions: cleared once expired, which is at most thirty days after sign-in and typically within 1 hour of your last activity.
• Analytics rows: 14 months, then deleted. They are not tied to an identity, so closing your account does not remove them.
• Billing and ledger records: retained after account closure for as long as tax and accounting law requires, typically seven years.

Closing your account deletes your projects and generations. That is not reversible, so export anything you want to keep first.

Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, receive it in a portable form, and complain to a supervisory authority.

Exercise any of them by writing to . We will respond within thirty days and will not charge you or degrade your service for asking.

Passwords are stored as bcrypt hashes. Session tokens are stored hashed, so a copy of the database does not yield usable sessions. Sessions expire on inactivity and absolutely. Provider and payment keys are held server-side and are never sent to the browser.

No system is perfectly secure. If we discover a breach affecting your data we will notify you and the relevant authority as the law requires.

The service is not intended for anyone under 13, and we do not knowingly hold data about them. If you believe a child has registered, write to us and we will delete the account.

We will announce material changes before they take effect and update the revision date below. The current terms of service sit alongside this policy.