Privacy Policy

Draft — last updated . This page has not been reviewed by a lawyer yet. Do not treat it as final until it has been.

1. What we collect

Account data: your email address, a securely hashed password (we never store your password itself), your subscription plan and billing status. Billing data: handled directly by Stripe, our payment processor — we store your Stripe customer and subscription IDs, not your card number. Usage data: the images, headlines, and photos you create or upload in the editor, and basic activity logs (login times, IP-derived rate-limit buckets) used for security and abuse prevention. Contact data: if you use our contact form, we store your message and reply-to email.

2. How we use it

To operate your account and the editor, to process billing through Stripe, to respond to support requests, to secure the service against abuse (rate limiting, fraud prevention), and to improve the product. We do not sell your personal data.

3. Who we share it with

Stripe (payment processing) and our hosting provider (to run the service). We don't share your account data with other outlets or customers, including images you create — outlet-locked templates are a starting design, not a place your content becomes visible to that outlet.

4. Cookies

We use a session cookie to keep you signed in (HttpOnly, Secure, SameSite-restricted — it isn't readable by page scripts and isn't sent cross-site). We don't use third-party advertising trackers.

5. Data retention

We keep your account data for as long as your account is active, plus a reasonable period after cancellation for billing records and legal compliance. You can request deletion of your account and associated data by contacting us.

6. Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete it, by contacting us through the contact form. If you're in a jurisdiction with statutory privacy rights (e.g. GDPR, CCPA), we'll honor requests consistent with those rights.

7. Security

Passwords are hashed (never stored in plain text). Traffic is encrypted in transit. Access to stored account data is restricted server-side. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, industry-standard measures to protect your data.

8. Changes to this policy

We may update this policy as the product changes. Material changes will be reflected here with an updated date.

9. Contact

Questions about this policy, or a data request: use our contact form.