Privacy Policy

When you choose a photo, it is resized in your browser and kept in your browser's session storage so the design page, and your return from checkout, can use it. Session storage stays on your device and is cleared when you close the tab or browser. We do not publish your photo and we do not sell it.

To create a design, the photo is sent to our server and on to fal (fal.ai), the image-generation provider, which processes it to produce the image. Our server does not save the photo. fal handles the image under its own terms and privacy policy, so please read those if you have concerns.

Before an image is generated, the text prompt for the request is sent to Creem's Moderation API to screen it against Creem's content policies. The server builds this prompt from the style and area you chose; you do not type a prompt. Your uploaded photo is not sent to Creem for this screening.

The image comes back as a web address (URL). To avoid generating the same design twice, we remember that address for about 7 days, together with a one-way fingerprint (hash) of your photo, the style, the area and the option number. The fingerprint cannot be turned back into your photo. After that period the entry expires. Your browser also keeps the generated image addresses in session storage while the tab is open.

We use only the cookies the service needs to work. We do not use advertising or analytics cookies.

• bd_unlock (unlock): set after a successful payment. A signed token that shows this browser has unlocked the designs. HttpOnly, lasts 30 days.
• bd_creem_req (checkout request): set when you start checkout, to match your return from the payment page to the checkout you started. HttpOnly, lasts 1 hour and is removed after a successful return.
• bd_cid (anonymous browser id): a random id used only to count free generations per browser per day. HttpOnly, lasts 365 days. Set for visitors who have not paid.
• bd_session (sign-in session): only if you sign in to the optional account. A signed token that keeps you signed in. HttpOnly, lasts 30 days or until you sign out.
• bd_oauth (Google sign-in check): only while you sign in with Google. A random value that protects the sign-in from forgery. HttpOnly, lasts 10 minutes.

Your browser's session storage (described above) is not a cookie and is not sent to us except for the photo when you generate a design.

To limit abuse of the free designs, the server reads your IP address (as provided by Cloudflare), turns it into a one-way hash and uses that hash to count free generations per day. We do not store the raw IP address in our counters. The counters expire after about 2 days. Counters are also kept per anonymous browser id and for the site as a whole.

Payments are handled by Creem, the merchant of record. Creem collects and processes your payment details and any contact information it needs, under its own privacy policy; we never see your card details. The checkout page shows the seller name "AI Backyard Design". After payment, we receive a confirmation containing a checkout reference. We store that reference for up to 90 days to confirm that a payment happened, and the number of generations used by a purchase is tracked against a hash of it. We do not store your name or card details.

You do not need an account to use the free or the paid design flow. If you choose to sign in, we keep your email address, a record of the purchases attached to your account, and a session (the bd_session cookie above) so you stay signed in for 30 days.

You can sign in with Google. Google receives the sign-in request and tells us your verified email address. We do not get your Google password. Or you can sign in with a link that we email you; those emails are sent through Resend, an email delivery service, which handles the address and message under its own privacy policy.

The site is hosted on Cloudflare, which processes requests (including IP addresses) to deliver and secure the site, under its own policies. fal processes your photos to create images, and Creem processes payments and screens prompts against its content policies. If you use the optional sign-in, Google (for Google sign-in) and Resend (for sign-in emails) are involved as described above. These are the only third parties involved.

You can clear your cookies and session storage at any time in your browser settings. Clearing the unlock cookie removes the unlock from that browser, and we cannot restore it. Because we do not keep your photo, there is nothing to delete on our side, apart from the short-lived records described above.

The service is not aimed at children, and we do not knowingly collect information from them.

We may update this policy. The date at the top shows when it last changed.

Email: support@aibackyarddesign.app

See also our Terms of Service.