Privacy Policy

1. Scope and contact

This policy explains how the individual operator of FoldUStory (foldustory.com) handles personal information through the website, editor, AI creation and digital downloads. Contact foldustory.support@gmail.com for privacy and data requests.

Third-party sign-in, AI and payment services also have their own privacy notices. Read them before choosing to use those services. Using our website is not treated as blanket consent to every optional use of data.

2. Information we process

• Accounts: email, user ID, sign-in and email-verification status. If you choose Google sign-in, the authentication service may receive authorized basic profile details. We do not receive your Google password.
• Creation: photos, prompts, artwork and editing settings you provide, plus generated images, project files and data needed for export. Local editing does not automatically send every change to an AI provider. Relevant inputs are sent when you submit a generation request.
• Transactions: purchasing account, order reference, plan, amount, currency, payment and refund status, credit ledger and export authorization records. Hosted payment services process full card numbers and security codes.
• Communications: questions and replies sent through account support messages or email, and attachments you choose to email us. Account messages are stored with your user ID, email and sending time for you and authorized support staff to read. Account notifications and read status are also stored for reminders and conversation follow-up. Provide only information needed to resolve the issue.
• Service records: key signed-in actions such as creating, opening, saving, renaming or importing projects, plus the name, type, size and checksum of locally selected files. AI requests also record the actual model, prompt, task reference, existing moderation decisions, credit settlement and result checksum. Export records include authorization, file preparation and browser download requests. Browser reports may be incomplete and do not establish that a file was saved to a device. Logging does not upload copies of complete private projects or locally selected files.
• Technical information: request times, network addresses, browser details, errors and other information needed by the website and infrastructure to deliver, troubleshoot and protect the service.

3. Purposes and legal bases

We do not sell personal information or use it for cross-site targeted advertising. Registration does not automatically add you to a marketing mailing list.

• Accounts, editing, AI generation, payment reconciliation and downloads: to provide the service you request and perform our contract.
• Keeping projects, drafts and preferences you choose to retain: to provide those functions; optional processing uses consent where required.
• Support, security and fraud prevention: our legitimate interest in a reliable service, subject to your rights.
• Required financial records, legal requests and disputes: to meet legal obligations or establish, exercise and defend legal rights.

4. Browser storage and projects

The website uses browser storage, including localStorage, sessionStorage and IndexedDB, for sign-in sessions, language and creation preferences, projects, generation history and checkout draft recovery. Original reference photos are saved in the local checkout draft to restore your creation after sign-in or checkout, but are not written to generation history. Generated images may remain as project artwork.

Local projects and drafts remain in that browser until deleted, site data is cleared or the browser evicts them. Signing out does not delete all local content. Generation history retains up to 20 recent results. Download history keeps up to 20 recent files and their design snapshots per account in this browser so the original files can be retrieved. Other users of a shared device may be able to access local content.

When an enabled shared workbench service is used, projects are also sent to and saved by that workbench server. Signing in does not mean all local projects have synced to the cloud. Clearing browser storage does not automatically remove server-side orders or shared workbench files.

When account cloud saving is enabled, books created while signed in and projects you explicitly choose to back up privately store their full documents, original images, reference photos contained in creation drafts and historical versions using Cloudflare D1 and R2, with a copy in a separate R2 bucket. Signing in alone does not upload older local projects. Check the editor’s cloud-save and backup-complete status. Offline changes and changes that exceed storage or usage protection limits remain locally pending synchronization. Restoring history adds a version and preserves earlier versions. Signing out deletes neither cloud projects nor local caches. Cloud documents and backups are retained as needed to provide the service; contact the email on this page to request deletion.

To understand whether free creation and making/export flows work well, first-party short-session statistics record page categories, feature clicks, visible prices, referral domains or campaign codes, entry language, device category and fixed error categories. These statistics exclude photos, designs, filenames, project IDs, prompts, typed content and full URL query strings; campaign codes use a restricted alphanumeric format. sessionStorage holds a random session credential. Sessions are inferred ended after 30 minutes without a report; credentials expire within 24 hours, and server event details are retained for 30 days. Abuse prevention uses a daily changing keyed digest retained for up to 48 hours, without storing raw IP addresses or linking that digest to visit paths.

Use Privacy preferences on the page to opt out of first-party usage statistics. Opting out stops new reports and attempts to delete the current valid statistics session. The site respects Do Not Track and Global Privacy Control signals; in regions configured for prior consent, no statistics session is created before you allow it. If you choose checkout within that session, the visit may be linked to that order to verify payment conversion. The visitor panel does not display account identity, and the link is not used for cross-site advertising. Existing Cloudflare traffic and performance statistics use a separate measurement method and are not backfilled as click paths.

Sign-in and third-party pages may use their necessary storage or cookies. You can clear site data in your browser. Back up first: doing so may sign you out and remove unbacked-up projects.

5. Photos and AI services

AI creation uses the GPT Image model configured by the platform. Relevant photos, prompts and necessary settings are sent through our server to technical providers delivering model access and content-safety checks. Users do not enter endpoint addresses or supply their own API keys.

We process these inputs for the creative function you request and do not ourselves train our own AI models on private inputs. Third-party retention, model-improvement use and processing locations depend on the provider’s policies and our service configuration. We cannot promise zero retention or no training across every third-party endpoint.

Upload only your own photos or photos you have explicit permission to use. A duly authorized adult must approve children’s materials. Avoid unrelated sensitive information. Necessary job references, state, input digests and moderation decisions support ownership, credit settlement and safety; reports and appeals are used to investigate and handle the relevant issue.

Authorized administrators may inspect these service records, prompts within their retention period and generated results still in temporary storage for safety and support. Detailed inspections and temporary image access are logged. This logging feature does not add external moderation transfers of original reference photos.

6. Service providers and disclosure

We may also disclose necessary information when legally required, to protect legitimate rights of the service and users, or with your separate authorization. Using private project features does not by itself publish your work as a community contribution.

• Cloudflare: website hosting, content delivery and infrastructure processing.
• Supabase: email verification, sign-in and session authentication; Google authentication is also involved if you choose Google sign-in.
• Waffo Pancake and its payment providers: checkout, payment, fraud checks, receipts and refunds. We send the purchasing email, plan and identifiers needed to associate an order, not your creative photos.
• The AI provider you use: inputs needed for your requested generation, as described above.

Provider privacy notices: Cloudflare · Supabase · Google

7. Retention and deletion

Browser retention is described in section 4. Accounts, server-side projects, support conversations and account notifications are kept while needed to provide the relevant service. Request deletion through our contact email. Necessary transaction, security and dispute records may remain after account closure for legal obligations or rights protection. Signing out or clearing local data does not erase them.

Live generation results and temporary job caches are scheduled for deletion one hour after creation. Infrastructure recovery backups may remain for up to 30 days. Job IDs, input digests and settlement status remain with the credit ledger and do not contain the original photos. This does not delete browser projects or imply deletion by an AI provider; third-party records follow their policies and applicable law.

Prompt text in service records is scheduled for removal 30 days after task creation. Necessary checksums, model details, task status, moderation and settlement records remain for safety, support and disputes. Signing out does not erase these server records. Submit data requests through our contact email.

For a deletion request, we verify identity, explain data that must lawfully be retained and why, and respond within the period required by applicable law.

8. Security and international processing

The public website uses HTTPS. Payment keys are handled server-side and hosted payment services handle full card data. We use access and verification measures appropriate to the service. Internet transmission, browsers and third-party services cannot be guaranteed completely secure. We will notify affected users and authorities of personal-data incidents where and when required by law.

Cloudflare, Supabase, AI and payment providers may process data outside your location. Locations depend on enabled services, project regions and the endpoint you select. International processing is subject to applicable data-protection requirements. Contact us to ask about the provider and location involved in a particular processing activity.

9. Your choices and data rights

Depending on applicable law, you may have rights to access, correct, delete, obtain a copy of or port data, restrict or object to processing, and withdraw consent. Send requests to foldustory.support@gmail.com and identify the account concerned. We will reasonably verify identity and respond as required by law. Withdrawal does not affect earlier lawful processing based on consent.

You can clear generation history in the interface and local site data in your browser. Choosing not to provide inputs needed for generation affects that function. Public tutorials and templates can be browsed without AI. You may also complain to a competent data-protection authority.

10. Children

Accounts and purchases are for adults aged 18 or over. Adults should manage accounts and upload permissions for family craft activities. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate and act as required by law.

11. Policy updates

This page shows the policy version and update date. New data uses, material provider changes and other significant changes affecting your rights will be communicated through a website notice or account email as required by law. We will seek separate consent where required.

12. Contact us

Contact foldustory.support@gmail.com for support, privacy, access and deletion requests. Identify the account email and your request. Do not send passwords, verification codes or full payment card information.