Privacy

Face uploads are temporary

Source and target images stay in request memory for safety checks, then move to fal's input CDN with a provider-enforced expiry of no more than one hour. We do not write image bytes or filenames to our database.

Safety processing

Images are sent to Runware for adult/NSFW/public-figure classification and to fal for the permitted edit. The final provider file is temporary; we do not build face profiles.

What we keep

Only non-image telemetry such as file type, dimensions, status, cost, latency, source page, and a salted IP hash for rate limiting.