Privacy Policy

We care about your privacy and we try to do the obvious right things: collect only what we need to run the Service, store it securely, never sell it, and never use your creative work or your prompts to train our own AI models. This document spells out the details so there are no surprises.

This Policy applies to information we collect when you visit our website, create an account, sign in, upload Content, run a generation, collaborate with teammates, contact support, or otherwise interact with the Service. It does not apply to third-party websites, services, or AI providers that you connect to or that we link from the Service — those are governed by their own privacy policies.

We use the information described above to:

• operate the Service: create your Account, authenticate you, store your Content, run generations, sync collaboration, deliver downloads, and similar core functions;
• route generation requests to the third-party AI providers needed to fulfill them, on your instruction;
• handle billing: charge subscriptions and top-ups, issue receipts, manage trials, prevent fraud;
• communicate with you: account notifications (email verification, billing receipts, security alerts), product updates we believe you actively need to know about, and responses to your support requests;
• secure the Service: detect and respond to abuse, suspected fraud, ToS violations, and security incidents;
• improve the Service: analyze aggregate, de-identified usage to fix bugs, prioritize features, and optimize performance;
• comply with our legal obligations and enforce our agreements.

We do not use your Content (including prompts and Output) to train our own AI models or third parties' foundation models. Generation requests are routed to the provider you select for that node, only for the purpose of producing the Output you requested.

Where data-protection law in your jurisdiction requires us to identify a legal basis for processing your personal information, we rely on the following:

• Contract — processing necessary to provide the Service to you under our Terms (e.g., creating your Account, running generations, billing).
• Legitimate interests — securing the Service, preventing abuse, improving features, and operating our business, where these interests are not overridden by your rights.
• Consent — where required, for non-essential analytics or for optional communications you can opt in or out of.
• Legal obligation — keeping invoices and complying with tax, accounting, and law-enforcement requests.

We do not sell your personal information. We share it only with the categories of recipients below, in each case under contracts that require them to protect your data and use it only as we instruct.

Piko Apps LLC is incorporated in Delaware, USA, and our infrastructure and subprocessors are located in multiple countries including the United States and the European Union. When we transfer personal information across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, equivalent UK and Swiss addenda, and the additional measures required by applicable law.

We keep personal information only for as long as needed for the purposes described above:

• Account data — for as long as your Account is active.
• Content — until you delete it or close your Account. Deleted Content is moved to a soft-deleted state for up to 30 days for recovery, then purged from active storage. Encrypted backups may persist for a bounded additional period for disaster recovery.
• Billing records — for the period required by tax and accounting law (typically 5–10 years depending on jurisdiction).
• Support tickets — for as long as needed to resolve and follow up on your request, and for a reasonable period thereafter for quality and audit purposes.
• Aggregated, de-identified usage data — may be retained indefinitely.

We use industry-standard measures to protect your information. These include encryption in transit (TLS), encryption at rest for media files and stored API keys, scoped access controls, audit logging, regular dependency updates, and careful review of subprocessors. No system can be guaranteed 100% secure, however, and we cannot eliminate every risk. If we become aware of a security incident that materially affects your information, we will notify you and the relevant authorities as required by law.

You can help by using a strong, unique password for the email address tied to your Piko Club Account, enabling two-factor authentication on that email and on your SSO provider, and keeping your devices and browsers updated.

Subject to applicable law, you have the right to:

• access the personal information we hold about you and request a copy;
• correct inaccurate or incomplete information;
• delete your information (we will honor this except where we must retain it to comply with law, resolve disputes, or enforce our agreements);
• restrict or object to certain processing, including direct marketing;
• port your information to another service in a structured, commonly used, machine-readable format;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with your local data-protection authority.

You can exercise most of these rights directly from your Account settings — including downloading your data, removing API keys, and deleting your Account. For anything settings does not cover, email [email protected] from the address on your Account and we will respond within the time frame required by applicable law (and usually faster).

We use a small number of cookies and similar technologies:

• Strictly necessary — to keep you signed in, remember your session, and protect against CSRF. The Service does not function without these.
• Preference — to remember your in-app choices (such as panel layouts and theme settings).
• Analytics — anonymized, aggregated metrics on feature usage and performance, which we use to improve the Service.

We do not use advertising cookies or sell your information to advertisers. You can block or delete cookies through your browser settings; doing so may break parts of the Service that depend on session cookies.

The Service is not directed to and should not be used by anyone under 18 (or the higher minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, contact [email protected] and we will promptly delete it.

The Service may include links to third-party websites, models, or services that we do not operate. We are not responsible for the content, privacy practices, or security of those third parties. Please review their policies before providing them with information.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. If a change is material, we will give you advance notice by email or in-app message at least 15 days before it takes effect. Your continued use of the Service after that date means you accept the updated Policy.

For privacy questions, requests to exercise your rights, or any other concerns, please email us at [email protected]. We will respond within the timeframes required by applicable law.