Privacy policy

What we record

To understand which pages are useful, the site records anonymous usage events: a page being viewed, a tool being used, or a link to another website being clicked. Each event carries a random identifier created in your browser tab when you arrive. It is kept in session storage, disappears when you close the tab, and is not linked to your name, email address or device. We also record the address of the page, the website that referred you and any campaign tags in the link. With each event our server adds your country and the network your connection comes from (for example a mobile carrier or a cloud provider), both as reported by Cloudflare, whether you are on a phone or a computer, whether the visit comes from an ordinary browser or an automated tool, and the language of the page. Your browser keeps two small markers in local storage: one that only says you have visited this site before (it is not an identifier), and, in our own team's browsers, one that marks the visit as ours so we can leave it out of our statistics.

We also use Cloudflare Web Analytics to count page views and measure page load times. It does not use cookies, does not use local storage to identify you, and does not collect personal information; it only reports aggregate figures such as which pages were viewed and how quickly they loaded.

Your photo and your Christmas portraits

This service is for adults (18+). Upload only a photo of yourself, or of you and another adult who has agreed to it. Do not upload photos of children or of anyone who has not agreed. We do not recognize who you are, create a face template or any biometric identifier, or estimate anything about you.

Before your photo leaves your device, your browser shrinks it to a JPEG. For a free preview, it is sent once to our server and passed straight to Google's Gemini image model on Google Cloud (Vertex AI); the preview comes back to your browser and neither the photo nor the preview is saved on our server. Google says it may keep prompts and outputs for a limited time to detect abuse and does not use them to train its models under its Cloud terms.

When you make your paid set of six portraits, we keep your photo encrypted (AES-GCM) in Cloudflare R2 only while the six portraits are being made, then delete it. If you pay after a preview, we keep the photo encrypted for up to 72 hours so we can make your set after payment without you coming back, then delete it. The finished portraits are stored privately in Cloudflare R2 for 30 days behind an unguessable gallery link, then deleted by our hourly cleanup. Anyone you give the link to can see them, so share it only with people you trust; gallery pages are hidden from search engines. You can delete your portraits at any time with the Delete button in your gallery.

If you give us an email address, we use it only to send your gallery link and your purchase code. We keep only what we need to run the service: the gallery ID, the number of people and the scenes chosen, timings and costs, and the payment-code hash, never your photo after the set is made.

To count free previews per day and stop abuse, we use keyed hashes of your network address and of a random device ID stored in your browser. The address and device ID themselves are not stored. When many previews come from one network in a day, we ask Cloudflare Turnstile to check that a person, not a bot, is asking.

While your preview is being made, we keep a progress record for up to 7 days: which step it reached, how long each step took, whether you left the page while waiting, and the result link that brings you back to it. Step timings (only the step name and how many milliseconds it took) are kept for up to 30 days to show how long things usually take.

If you buy a portrait pack, checkout runs on the page of our merchant of record, Waffo Pancake (waffo.ai), which takes your payment and billing details under its own privacy policy and sends your payment receipt; we never see your card details. We receive the order number, amount, currency and the email address you paid with (or typed before checkout). We use that email only to send your pack code and, if you ask with "Lost your code?", to send it again, and we keep it for about 13 months. Your code is kept in your browser (local storage) so the pack works on this device.

Who we share data with: Google Cloud runs the AI model that makes the portraits; Cloudflare hosts the site, stores the portraits temporarily, counts page views (Web Analytics), runs the human check (Turnstile) and sends our emails. We do not sell or share data with advertisers or data brokers. Questions or deletion requests: hello@christmasportrait.app.

Tool usage records

Each time you run the AI Christmas portrait tool on this site, we keep one short record of how it went. We use these records only to understand what people actually come here to check or make, where the tool fails or falls short, and what to fix or build next. We do not use them for advertising, we do not sell them, and we do not use them to build a profile of you.

A record holds only: which tool and step was used; the kind of input (a file, a link, text or a choice) and where it came from (an upload, a pasted link, a sample); for files, the format, size and length; for links, only the supported platform and its hostname, never the full link; for AI Christmas portrait, a short excerpt of up to 200 characters describing the request (for example the occasion or style you chose, the details you typed, your quiz answers or the title of the song checked), with links, email addresses and phone numbers removed, while fields that only hold a name or a place are not recorded; each engine's score and the final result; how long it took; and, if it did not work, which of four kinds of problem it was (we needed something more from you, it stopped at a choice point such as a free limit, the item could not be found, or there was a fault on our side). We also keep the anonymous session, how you reached the site (for example from a search engine or directly), your country, whether you are on a phone or a computer, the page language, whether this browser has visited before, and what you did next with the result (for example sharing it, trying again, looking at prices or paying).

These records never contain the original photo, audio or video, the file name, the full link, your IP address, a browser fingerprint or payment details. They are deleted automatically after 180 days. You can ask us to delete a record sooner: email hello@christmasportrait.app with the tool, the approximate time and, if you have it, the result reference; we confirm the matching record and then delete it together with the follow-up actions linked to it.

What we never collect

We do not use cookies for tracking, we do not build profiles, and we do not store your IP address, browser fingerprint or any other personal information alongside these events. We do not sell or share data with advertisers.

Hosting

The site is served by Cloudflare. Like any web host, Cloudflare processes technical request data such as IP addresses to deliver pages and protect against abuse, under its own privacy policy.

Your rights

You can ask us what we hold about you, to correct it, to delete it, or to stop using it, and you can withdraw any consent you gave (for example to receive an email from us). If you are in the EU or UK you can also ask for a copy of your data in a portable format and complain to your data protection authority. Send requests to hello@christmasportrait.app; we reply within 30 days. We keep data only as long as described on this page.

Contact

Questions about this policy can be sent to hello@christmasportrait.app.