Privacy Policy — ShimmerPic

The controller of your data is Springtide Labs, LLC (Delaware, United States). Reach us through the support form or at contact@shimmerpic.com.

Information we process

Google sign-in provides your name, email address and profile image. When you register we also record the IP address of the request, your browser's user-agent string, your language preference and the source that brought you here. We store account and session information, your prompts, uploaded references, generated images, credit transactions and support reports. We use this information to operate your account, deliver images, keep credit records, respond to support requests, and to detect accounts created to get around a restriction (legitimate interest in keeping the service safe, GDPR Art. 6(1)(f)).

We email you about your account, purchases and credits. We may also occasionally email you about a limited-time offer; each one has a one-click unsubscribe link, and you can turn offers off at any time in your email preferences. Weekly inspiration emails are sent only if you opt in.

Service providers

Cloudflare hosts our website, database and image storage. Google provides sign-in. APIMart receives prompts and any reference images needed to generate your result, and runs automated content safety checks. Reference images are shared using temporary access links. Stripe processes checkout; we do not store card numbers. Real purchases are processed by Stripe; checkout clearly identifies any test environment.

Some community preview images load from GitHub's content delivery service. Source links take you to third-party websites.

Image access and retention

Your uploads and generated images are private to your account, except temporary links used by the generation provider. Community Explore examples are public and have separate source attribution. We retain account content while your account remains active or until you request deletion. Download important images; the service is not a permanent archive. Provider retention is controlled by the relevant provider's terms.

Content safety and operational alerts

Rejected uploads do not enter your image library. Generated results briefly enter private quarantine for screening and enter your library only after approval; temporary copies are deleted after checking. Safety records contain account/task identifiers, a content hash, the decision category, model and policy version. There is one exception to the rule that rejected material is not stored. For requests that appear to sexualise a minor or to sexualise a real person without consent we keep the prompt and copies of the images involved — the references, and a rejected upload itself — in isolated storage that no part of the site can reach, for one year and 90 days respectively, so that the request can be reviewed and, where the law requires, reported. These copies are deleted when that period ends, or later if a legal hold applies; a deletion request does not shorten it. Operational email alerts contain record identifiers and event categories, never images or prompts.

Pauses after repeated refused requests are applied automatically, as described in the Content Policy. Every pause can be appealed through the support form and is reviewed by a person; a closure for sexual content involving a minor is confirmed by a person before it becomes permanent.

Retention

Account content is kept while your account is active or until you ask for deletion. Safety records — refusals, pauses and account links — are removed 90 days after the last refusal on the account, except on an account that is closed or under review, and except the evidence above, which has its own period. Registration details, including the IP address, are kept for the life of the account. Credit and payment records are kept as long as tax and accounting law requires.

Disclosure

We disclose records to law enforcement when legally required, to the National Center for Missing & Exploited Children as 18 U.S.C. § 2258A requires, and to our payment and model providers where their terms require it. We do not sell your personal information.

Cookies and requests

We use cookies for sign-in and site preferences. To request access, correction or deletion, use our support form with the email associated with your account. We may need to verify ownership before acting. Where a record is part of an open safety review or a report we are required to keep, we may decline to delete it until the retention period ends. If you are in the EU or UK you can also complain to your data protection authority.