Privacy Policy

Last updated: October 23, 2026

This policy explains how Yang Junwei ("we"), the operator of ImageWhim, handles personal data. Contact: [email protected].

Data we collect

Account data: email address and a securely hashed password.
Content: prompts, reference images you upload (including a photo uploaded for a free trial without an account), and the images generated for you.
Usage and billing records: credit balance and history, generation history, and order records (pack, amount, status).
Technical data: IP address, browser user agent, approximate country (from our network provider), and server logs.
Sign-up source: the website that referred you, the first page you visited and any campaign tags in its link (such as utm_source), saved with your account when you sign up.
Payment data: payments are handled by Waffo Pancake, our Merchant of Record. We never receive or store your full card details.

How we use it

To provide the Service: run generations, store your gallery, and keep your credit balance.
To send service emails such as email verification and password resets.
To prevent fraud and abuse, enforce our Acceptable Use Policy, and keep the Service secure. Prompts and images are checked by automated content moderation before and after generation, and we keep a record of blocked requests.
To understand which websites and campaigns bring new users, using the sign-up source above.
To meet legal, tax and accounting obligations.

We do not sell your personal data and do not use it for advertising.

Service providers

OpenAI processes prompts and images to generate results and to moderate uploaded and generated images. Under OpenAI's API data policy, API data is not used to train their models by default and may be retained for a limited period for abuse monitoring.
Content moderation: prompts are also screened by our payment partner's content moderation service before generation.
Waffo Pancake processes payments as Merchant of Record and handles invoices, taxes and refunds.
Cloudflare provides network delivery and security.
Our hosting provider and our email delivery provider.

These providers may process data outside your country. We rely on their contractual safeguards for such transfers.

Retention

We keep account data while your account is open. Generated images stay in your gallery until you delete them or your account. When you delete an image or your account, we remove it from our servers; copies in backups expire within 30 days. Records of blocked requests (an excerpt of the prompt, the moderation result and the time) are kept for up to 12 months to enforce our policies. Billing records may be kept longer where the law requires. Free trial photos and results made without an account are deleted after 7 days unless you sign up or log in to save the result to your account.

Cookies and local storage

We use essential cookies only: one keeps you signed in, and one links a free trial to your browser so you can see its preview and save it after you sign up. Your browser's local storage remembers your language, a pending free trial, and the sign-up source described above until you sign up. We do not use tracking or advertising cookies.

Your rights

You can ask us to access, correct, export or delete your personal data, or object to its processing, by emailing [email protected]. We respond within 30 days. Depending on where you live (for example the EU, UK or California), you may also have the right to complain to a data protection authority.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

Changes

We will post any changes to this policy on this page with a new date.