Privacy Policy

Account data: When you sign in with GitHub, we receive your GitHub username, email address, and profile picture. We store this in our database to identify your account.

Generation data: We store the prompts you submit, the images generated, and metadata (tool used, provider, size, timestamp). This lets us show you your generation history.

Billing data: If you purchase a plan or credits, Stripe processes your payment. We store a Stripe customer ID and subscription status but never see or store your full card details.

Usage data: We log generation counts per billing period to enforce plan quotas. We do not sell usage data.

Guest usage: If you generate without signing in, we do not collect any personally identifiable information. IP addresses are used only for rate-limiting and are not stored long-term.

• To provide and operate the service (authentication, generation, billing)
• To send transactional emails (welcome, low-credit warnings, payment receipts) via Resend
• To enforce plan quotas and rate limits
• To detect and prevent abuse
• To improve the platform (aggregate, anonymised analytics only)

We do not sell, rent, or share your personal data with third parties for marketing purposes.

• Vercel — hosting. Your requests are processed on Vercel infrastructure. Privacy policy →
• Neon — serverless PostgreSQL database hosting your account and generation data. Privacy policy →
• Stripe — payment processing. Governed by Stripe's privacy policy. Privacy policy →
• Resend — transactional email delivery. Privacy policy →
• GitHub OAuth — authentication. We receive only your public profile and primary email. Privacy statement →
• AI Providers — your prompts are sent to Replicate, fal.ai, Together.ai, or Pollinations to generate images. Their privacy policies apply to prompts processed by their models.

We retain your account data and generation history while your account is active. If you delete your account, we will delete your personal data within 30 days, except where required by law (e.g. payment records may be retained for tax/accounting purposes).

Depending on your location, you may have rights to access, correct, or delete your personal data, or to object to or restrict processing. To exercise these rights, emailprivacy@wokspec.org. We will respond within 30 days.

You can delete your account and all associated data from the Account settings page.

We use a single HTTP-only session cookie for authentication (NextAuth JWT). We do not use tracking cookies or third-party analytics cookies. Provider API keys entered in the Studio are stored only in your browser's localStorage and never sent to our servers.

WokGen is not directed to children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us immediately.

We may update this policy. We will post the new version here with an updated date and announce material changes on the platform.

Privacy questions: privacy@wokspec.org

General contact: team@wokspec.org