Privacy Policy
Effective August 26, 2026
We collect your email address, the media you upload, the prompts you write and the outputs you generate, plus billing and technical records. We use them to run the service. We do not sell them and we do not train models on your content. Everything we store about you is held in the United States. You can download a copy of your data or delete your account at any time.
1. Who we are
Qualia LP operates justpictur.ing, justinfluenc.ing and justshar.ing and is the controller of the personal data described here. You can reach us at privacy@justpictur.ing or by post at 2967 Dundas Street West, Suite 207d, Toronto, Ontario M6P1Z2, Canada.
This policy covers the justpictur.ing website and the app at app.justpictur.ing, the justinfluenc.ing website and the app at app.justinfluenc.ing, the justshar.ing permalink pages, and our API. They are one account and one set of records: signing in on the second site reaches the same account as the first, and everything described below is true of all of them.
2. What we collect
- Account data. Your email address, and, if you set them, a display name, a public @handle and an avatar URL. If you sign in with Google, we receive your email address and basic profile from Google; we never receive your Google password.
- Content you provide. Images, video and audio you upload, and the prompts, scene text, notes and titles you write. Uploaded photographs may contain personal data about you and about other people; you are responsible for having the right to upload them.
- Content you generate. The images, clips, audio and videos the models return, together with the settings used to produce them (model, dimensions, duration, credit cost).
- Billing data. Your plan, subscription state, order history and credit ledger. Payment card details go directly to our merchant of record and are never received or stored by us.
- Technical records. Request logs containing a request ID, your account ID, the route, method, status, latency and timestamp; product events recording which features an account used; and, when you authenticate, accept policies or begin checkout, the IP address and forwarding chain our server observes, your browser user-agent and a stable device digest made in your browser from browser, language, screen, time-zone and canvas signals. The digest is forgeable corroboration, not proof of identity and not an authentication factor.
- Dispute evidence. If a payment is disputed, we mirror the dispute state from Polar and may copy bounded, redacted account, transaction and service-activity records into a manual-review packet. Those copies exclude raw prompts and chat text and are never submitted automatically.
- Connected applications. If you connect Claude, Codex or another MCP client, we store the application's name, the permissions you approved, token digests and connection timestamps. We receive the prompts and media references that client sends to our tools and return the requested status and generated media to it.
- Support correspondence. Whatever you send us and our replies.
We do not use advertising cookies, third-party analytics or tracking pixels, and our marketing sites set no cookies at all. The app stores your sign-in session in your browser because it cannot keep you signed in otherwise.
3. Why we use it, and on what basis
| What | Why | Basis (GDPR Art. 6) |
|---|---|---|
| Account data, content, generation settings | To give you the service you asked for | Performance of a contract |
| Billing data | To take payment, apply credits and keep accounts | Performance of a contract; legal obligation for the accounting records |
| Request logs, product events | To keep the service up, find bugs, and stop abuse and fraud | Legitimate interests |
| Connection, checkout and dispute-evidence records | To prevent fraud and establish or defend payment claims | Legitimate interests; establishment or defence of legal claims |
| Transactional email (sign-in links, low-credit notices, payment and renewal notices) | To operate your account | Performance of a contract |
| Marketing email | To tell you about the product | Consent, which you can withdraw at any time |
4. Where it is processed
Everything we store about you is in the United States. Our database runs in Supabase's us-east-1 region, our API and rendering worker run on Fly.io in Virginia, and media is stored in Cloudflare R2. We are established in Canada, so if you are in the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred outside your country to the United States to be processed.
Two things sit outside that, and neither of them holds your account or your media. Our mail provider is a Swiss company, so email between you and us, including the sign-in links you ask for, passes through it. And the two typefaces every page here, in the apps and on justshar.ing uses are served from a type foundry in India rather than from our own servers, so your browser contacts it, and it sees your IP address and user-agent, each time a page loads. Both are named in the table below.
We rely on our providers' own transfer safeguards, including the Standard Contractual Clauses they incorporate into their data-processing terms. We are reviewing our transfer documentation, and our position on whether an EU representative under Art. 27 is required, with legal counsel; if that review changes anything material we will update this section and tell affected users.
5. Who else processes it
We use the providers below. They act on our instructions and may only use your data to provide their service to us. We do not sell personal data and we do not share it with advertisers.
| Provider | What it does | Where |
|---|---|---|
| Supabase, Inc. | Managed Postgres database, authentication, and realtime updates. Holds accounts, prompts, generation metadata and the credit ledger. | United States (us-east-1) |
| Cloudflare, Inc. | Object storage (R2) for uploaded and generated media, static site and app hosting (Pages), DNS and CDN, and privacy-preserving traffic analytics (Web Analytics) on our marketing sites. The analytics beacon runs in your browser and reports page performance; it sets no cookie and does not track you across sites. | United States, with a global edge network |
| Fly.io, Inc. | Compute for the API and the rendering worker. | United States (iad) |
| Replicate, Inc. | Runs the image, clip and audio generation models. Receives your prompt and any reference media you attach to a generation. If you switch the Organizer on, it also receives each finished file and each file you upload, so a naming model can write a title, a description and keywords for it. | United States |
| ElevenLabs, Inc. | Generates speech with an account voice selected by its ElevenLabs ID. Receives the spoken text, voice settings and selected voice ID. | United States |
| OpenRouter, Inc. | Routes our requests to the language model behind storyboard drafting, the studio assistant and the influencer surfaces, and passes them to the model's own provider. Receives the text you write in those surfaces, and any picture you attach to them. | United States |
| Polar Software Inc. | Merchant of record for paid plans. Receives your email address and billing details; we never receive or store card numbers. | United States (Delaware), and other countries its notice permits, including Canada |
| Migadu-Mail GmbH | Mail to our published addresses. Carries anything you send to support@, privacy@ or abuse@, and our replies. Receives your email address and the contents of those messages. It does not carry the mail we send you. | Switzerland; it does not publish the locations of its mail servers |
| Loops | All email we send you. Sign-in links, password resets and email-change confirmations, plus product mail about your account: the welcome message, low-credit notices, payment-failure notices and credit-renewal notices. Receives your email address. Payment receipts do not go through Loops. Those come from our merchant of record. | United States |
| Functional Software, Inc. (Sentry) | Crash reporting for the apps at app.justpictur.ing and app.justinfluenc.ing. When an app fails, your browser sends it the error message, the stack trace and the path of the page you were on. It also sees your IP address and user-agent, because the report goes straight from your browser rather than through us. It receives no prompts, no media, no email address and no account data. | United States (ingest.us.sentry.io) |
| Fontshare (Indian Type Foundry) | Serves the two typefaces every page of our sites, the apps and justshar.ing loads. Your browser fetches them from Fontshare's own domains, so your IP address and browser user-agent reach it on every page view, including this one. It receives no account data and nothing you make. | India |
Fontshare is the exception to the paragraph above: it is not acting on our instructions and we send it nothing. Our pages simply reference its webfonts, so your browser requests them from its domains directly and it sees your IP address and user-agent the way any site you visit does. We list it because that request happens on every page, this one included.
Claude, Codex and other MCP clients you choose to connect are not our subprocessors. They act at your direction as the client through which you use the service. Conversation content they hold before a tool call, and the tool results they receive from us, are handled under that client's own terms and privacy policy. Disconnecting a client stops future access but does not delete copies already held by that client.
If we add a synthetic-voice provider, or any other processor, we will list it here before the feature that uses it ships.
We may also disclose data where the law requires it, or to establish or defend legal claims. If we are ever acquired, your data would move with the service and we would tell you first.
6. Training
We do not train any model on your prompts, your uploads or your outputs, and we do not license them to anyone for training. Our model providers receive your prompt and any reference media in order to return your result; what they retain and for how long is governed by their own terms, which are linked in the table above.
7. How long we keep it
| Category | Retention |
|---|---|
| Account record | For as long as your account exists. Erased or pseudonymised when you delete it (see section 9). |
| Uploads, generated media and rendered videos | Until you delete them or delete your account. Deleting an item removes the stored file as part of that request; anything left over is swept hourly. |
| Prompts, scene text and generation settings | Same as the media they belong to. |
| Videos you have moved to the bin | Marked deleted immediately and hidden from you. Their stored files are not yet purged automatically; they are removed when you delete your account, and you can ask us to remove them sooner. |
| Credit ledger | For as long as your account exists. |
| Orders, refunds and completed checkouts | Kept after account deletion, detached from your identity, for as long as tax and accounting law requires, which in Canada is generally six years from the end of the tax year they relate to. |
| Dispute-evidence packets | Held while a legal hold is active. When an authorised admin releases the hold, the packet and its copied sources are deleted after 90 days. Raw connection and policy-acceptance ledgers are removed when the account is erased; a packet copy already under hold is preserved in pseudonymised form. |
| Request logs with an account ID | 30 days, then deleted. |
| Aggregate traffic counts with no account ID | 13 months. |
| Share links you created | Until you revoke them or delete your account. |
| OAuth connections and personal access tokens | Until they expire, you revoke or disconnect them, or you delete your account. We store only token digests, not reusable token plaintext. |
8. How your media is protected
Uploaded and generated files are stored in a private bucket. They are not reachable by a public URL. Every view or download is served through a link we sign for you that expires within minutes. Making something public is an explicit action: a share link you create yourself, which you can revoke.
9. Your rights
Depending on where you live, you may have the right to get a copy of your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent you have given. Exercising any of them costs nothing and we will not treat you differently for it.
- Delete your account. In the app, go to Settings → Profile → Delete account. This signs you out, removes your content and starts erasing your stored files immediately. It cannot be undone.
- Correct your details. Name, handle and avatar are editable in Settings → Profile.
- Everything else (a copy of your data, a portable export, restriction, objection): email privacy@justpictur.ing from the address on your account. We answer within one month and will tell you if we need longer.
We keep some records even after erasure where the law requires it: the order, refund and held dispute-evidence records described in section 7, held without the account's name or email attached. If you are in the EEA or the UK you can complain to your local supervisory authority; in Canada, to the Office of the Privacy Commissioner.
10. Age
The service is not for children. You must be at least 18 to create an account. We do not knowingly collect data from anyone younger; if you believe we have, email privacy@justpictur.ing and we will delete it.
11. Automated decisions
We do not make decisions about you by automated means that produce legal or similarly significant effects. Automatic rate limits and abuse controls may temporarily block a request; email us and a person will look at it.
12. Security
Data is encrypted in transit and at rest by our providers. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority where the law requires it.
13. Changes
If we change this policy we will update the effective date at the top, and for material changes we will tell you by email or in the app before they take effect.
14. Contact
Qualia LP, 2967 Dundas Street West, Suite 207d, Toronto, Ontario M6P1Z2, Canada. privacy@justpictur.ing.