Privacy Policy

1. The short version

• We do not train AI models on your photos. Not ours, not anyone else's. Your images are never added to a training set.
• We do not sell your data or your images. Not to advertisers, not to data brokers, not to anyone.
• Generated images are permanently deleted from our servers after 24 hours. The photo you upload is never written to our storage at all.
• You can delete any generation sooner, and deleting removes the stored files, not just the listing.
• Generating a sketch does require sending your image to our AI provider. Section 4 explains exactly who and what they may do with it.

2. Who we are

SketchWish is operated by [LEGAL ENTITY], which is the data controller for the personal data described here. Contact: hello@sketchwish.com.

3. What we collect

Account data

When you sign in with Google we receive your email address, and where you have made them available, your name and profile picture. We store these along with your credit balance and account status.

Images you upload

The photos you upload for conversion, and the sketches generated from them. Both are stored so your generation history works and so you can re-download your results.

Usage and technical data

Basic operational data such as which style and resolution you selected, timestamps, credit transactions, and standard server logs including IP address. We use IP address for rate limiting and abuse prevention.

Payment data

When paid plans are available, payments are processed by Stripe. We never receive or store your full card number. We retain only the transaction reference and subscription status Stripe returns to us.

4. AI processing and who sees your images

Producing a sketch is not something we can do locally. When you generate, your uploaded image is transmitted to Google's Gemini API, which returns the generated sketch. Your image is processed under Google's terms for that API and is subject to their data-handling commitments for paid API traffic.

We do not train AI models on your photos

We never use your uploaded photos or generated sketches to train, fine-tune, or evaluate any AI model — not our own, and not a third party's. We do not contribute your images to any training dataset, and we do not permit our providers to use them for model training on our account. We do not send your images to any AI provider other than the one named above.

Our subprocessors

• Google (Gemini API) — AI image generation. Receives your uploaded image at generation time.
• Supabase — authentication and database. Stores account data and generation metadata.
• Cloudflare R2 — object storage. Stores your uploaded and generated image files.
• Stripe — payment processing, once paid plans launch.

5. Why we process it

• To provide the service you asked for — performance of a contract.
• To prevent abuse, enforce credit limits, and keep the service running — legitimate interests.
• To process payments and meet tax and accounting obligations.
• To communicate about your account, including material changes to these policies.

6. How long we keep things

Photos you upload — not stored at all

The photo you upload is held in memory only for as long as it takes to send it to our AI provider and receive the sketch back. It is never written to our image storage and there is nothing on our servers to delete afterwards.

Generated sketches — deleted after 24 hours

Generated images are automatically and permanently deleted from our servers 24 hours after they are created. A scheduled job removes both the stored image files and the database record. This is automatic: you do not need to do anything, and there is no setting that keeps them longer.

You can also delete a generation yourself at any point before that, individually or by clearing your whole history at once. Deleting your account removes your profile and cascades to your generation records.

Account and transaction data

These are kept on a different schedule to your images, described below.

Account data is retained while your account is active. Payment and transaction records are retained for as long as tax and accounting law requires, typically seven years, even after account deletion.

Logs. Server and abuse-prevention logs are retained on a short rolling window and then discarded.

7. Who we share with

We share personal data only with the subprocessors listed in section 4, and only to the extent needed to run the service. Beyond that, we disclose data only where we are legally required to, or where it is necessary to investigate a credible safety or security issue.

We do not sell personal data or images, and we do not share them for cross-context behavioural advertising as those terms are used under the CCPA/CPRA.

8. Cookies

We use cookies that are necessary for the service to work: an authentication session cookie, and a preference cookie for your theme and language selections. We do not use advertising or cross-site tracking cookies.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to certain processing. If you are in the EU or UK you also have the right to lodge a complaint with your local supervisory authority.

You can delete your images yourself at any time from your generation history. For anything else, email hello@sketchwish.com and we will respond within the timeframe your local law requires. We will not charge you or degrade your service for exercising these rights.

10. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

11. Security

Clean, unwatermarked renders are held in private storage and served only through an authenticated, per-request entitlement check — they are never exposed by direct public URL. Sessions use httpOnly cookies. Access to production data is limited to what is needed to operate the service.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

12. Children

SketchWish is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. If a change is material — particularly any change to how we use your images — we will give notice before it takes effect. The effective date at the top always reflects the current version.

14. Language

15. Contact

[LEGAL ENTITY]
[ADDRESS]
hello@sketchwish.com