Privacy Policy

1. The short version

• We do not train AI models on your photos. Not ours, not anyone else's. Your images are never added to a training set.
• We do not sell your data or your images. Not to advertisers, not to data brokers, not to anyone.
• We use analytics and ad measurement. PostHog shows us how the site is used, and Google Ads tells us whether our ads lead to purchases. Google's ad personalisation is switched off for our tag. Section 8 lists every cookie we use.
• Generated images are permanently deleted from our servers after 24 hours. The photo you upload is never written to our storage at all. Images you share by link are the one exception: they stay online so the link keeps working, until you ask support to remove them. See section 6.
• You can delete any generation sooner, and deleting removes the stored files, not just the listing.
• Generating a sketch does require sending your image to our AI provider. Section 4 explains exactly who and what they may do with it.

2. Who we are

SketchWish LLC ("SketchWish", "we", "us", or "our") is the data controller for the personal data described here. Contact: support@sketchwish.com.

3. What we collect

Account data

When you sign in with Google we receive your email address, and where you have made them available, your name and profile picture. We store these along with your credit balance and account status.

Images you upload

The photos you upload for conversion, and the sketches generated from them. Your uploaded photo is held in memory only while the sketch is made and sent to our AI provider (see section 4); it is never written to our storage. The generated sketches are stored so your generation history works and you can re-download your results, and they are deleted automatically after 24 hours, unless you create a share link for one (see section 6).

Usage and technical data

Basic operational data such as which style and resolution you selected, timestamps, credit transactions, and standard server logs including IP address. We use IP address for rate limiting and abuse prevention.

We also collect analytics about how the site is used: pages viewed, buttons clicked, browser and device type, the page that referred you, and an approximate location derived from your IP address. Sections 4a and 8 describe how.

Payment data

Credit pack purchases are processed by Stripe. We never receive or store your full card number. We retain only the transaction reference Stripe returns to us and the credits added to your account.

4. AI processing and who sees your images

Producing a sketch is not something we can do locally. When you generate, your uploaded image is transmitted to Google's Gemini API, which returns the generated sketch. Your image is processed under Google's terms for that API and is subject to their data-handling commitments for paid API traffic.

We do not train AI models on your photos

We never use your uploaded photos or generated sketches to train, fine-tune, or evaluate any AI model , not our own, and not a third party's. We do not contribute your images to any training dataset, and we do not permit our providers to use them for model training on our account. We do not send your images to any AI provider other than the one named above.

Our subprocessors

• Google (Gemini API), AI image generation. Receives your uploaded image at generation time.
• Supabase, authentication and database. Stores account data and generation metadata.
• Cloudflare R2, object storage. Stores the images we generate for you. Your uploaded photo is never stored there.
• Stripe, payment processing for credit packs.
• Vercel, website hosting. Handles every request to the site, including your IP address.
• Upstash, rate limiting. Receives your account ID, or your IP address if you are not signed in, to enforce generation limits.
• PostHog, product analytics and session replay. Receives page views, feature-usage events such as which style you selected, and recordings of how the interface is used. See section 4a.

4a. Session replays, and what is masked out of them

We use PostHog for UI/UX session replays to improve our website. A session replay is a reconstruction of how the interface was used, so we can find confusing steps and broken flows. However, strict masking is applied to ensure your uploaded and generated images are never recorded or visible in these analytics sessions. Every element that displays one is marked so the recorder replaces it with a blank placeholder before anything is transmitted. The image data never leaves your browser as part of a replay.

Also masked: the filename of the photo you upload, and the contents of input fields. What a replay does show is layout, navigation, clicks, scrolling, and cursor movement.

5. Why we process it

• To provide the service you asked for, performance of a contract.
• To prevent abuse, enforce credit limits, and keep the service running, legitimate interests.
• To understand how the site is used so we can fix problems and improve it, and to measure whether our ads lead to purchases, legitimate interests.
• To process payments and meet tax and accounting obligations.
• To communicate about your account, including material changes to these policies.

6. How long we keep things

Photos you upload, not stored at all

The photo you upload is held in memory only for as long as it takes to send it to our AI provider and receive the sketch back. It is never written to our image storage and there is nothing on our servers to delete afterwards.

Generated sketches, deleted after 24 hours

Generated images are automatically and permanently deleted from our servers 24 hours after they are created. A scheduled job removes both the stored image files and the database record. This is automatic: you do not need to do anything.

You can also delete a generation yourself at any point before that, individually or by clearing your whole history at once. Deleting your account removes your profile and cascades to your generation records.

Images you share by link

Images are permanently deleted after 24 hours. However, if you generate a Share Link, that specific image will be securely hosted indefinitely so your link continues to work, unless you contact support to remove it. Anyone who has the link can view that image; share pages are hidden from search engines. To remove one, email support@sketchwish.com.

Account and transaction data

These are kept on a different schedule to your images, described below.

Account data is retained while your account is active. Payment and transaction records are retained for as long as tax and accounting law requires, typically seven years, even after account deletion.

Logs. Server and abuse-prevention logs are retained on a short rolling window and then discarded.

7. Who we share with

We share personal data only with the subprocessors listed in section 4 and the third-party services described in section 8, and only to the extent needed to run the service and measure our advertising. Beyond that, we disclose data only where we are legally required to, or where it is necessary to investigate a credible safety or security issue.

We do not sell personal data or images, and we do not share them for cross-context behavioural advertising as those terms are used under the CCPA/CPRA. We use Google Ads only to measure whether our own ads lead to purchases, and we have switched off Google's ad personalisation for our tag, so your visits to SketchWish are not used by us to build audiences for targeted ads.

8. Cookies and third-party scripts

We use cookies and similar browser storage, such as local storage. This section lists every one we set, and the third-party scripts on our pages that can set their own.

Necessary for the site to work

• Sign-in session (Supabase, names starting with "sb-"): keeps you signed in.
• Sign-in return page ("sw_post_login_next", 10 minutes): sends you back to the page you were on after you sign in with Google.
• Language ("googtrans"): remembers the language you picked.
• Preferences in local storage: your theme and language, and the style you picked before signing in, so it is still selected when you come back.

Analytics: PostHog

A first-party cookie and a local storage entry (names starting with "ph_", kept for up to one year) recognise a returning browser so we can count visits, see which features get used, and connect the session replays described in section 4a. Analytics data is sent through our own domain to PostHog. We do not sell or share what it collects.

Ad measurement: Google Ads

Our Google Ads tag sets a first-party cookie ("_gcl_au", 90 days) and a local storage entry ("_gcl_ls"), and sends Google the page you visited, basic browser and device details, and your IP address. When you complete a purchase it also sends the purchase value, currency, and an order reference, so we can tell whether an ad led to a sale. When the tag loads, Google may also read or set its own cookies on Google domains such as google.com and doubleclick.net, under Google's Privacy Policy. We have switched off ad personalisation for this tag, so we do not use your visits to build audiences for targeted ads. You can manage how Google uses your data for ads at My Ad Center.

Language switcher: Google Website Translator

Google's translation script loads on every page so the language switcher works. If you choose a language other than English, the text of the page is sent to Google to be translated. Google may read or set its own cookies when the script loads.

Your choices

You can block or delete cookies in your browser settings. Blocking the sign-in cookie signs you out; blocking the analytics and ad measurement cookies does not stop the site from working.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. If you are in the EU or UK you also have the right to lodge a complaint with your local supervisory authority.

You can delete your images yourself at any time from your generation history. For anything else, email support@sketchwish.com and we will respond within the timeframe your local law requires. We will not charge you or degrade your service for exercising these rights.

10. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Security

Clean, unwatermarked renders are held in private storage and served only through an authenticated, per-request entitlement check. They are never exposed by direct public URL. Your sign-in session is kept in a cookie scoped to this site, and every request that reads your account or your images is checked on our servers. Access to production data is limited to what is needed to operate the service.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

12. Children

SketchWish is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. If a change is material, particularly any change to how we use your images, we will give notice before it takes effect. The effective date at the top always reflects the current version.

14. Language

15. Contact

SketchWish LLC
971 US Highway 202N, Ste N
Branchburg, NJ 08876, USA
support@sketchwish.com

Send all privacy requests, access, deletion, correction, objection, or any other right described above, to support@sketchwish.com.