Privacy Policy
How this site handles account information, uploads and video generation.
Last updated: 2026-11-05
Video generation and uploaded media
Choosing a photo file first creates a local preview on your device. Clicking Generate uploads the photo to the site's configured object storage. When you submit a generation, the server sends your prompt, video settings and media URLs to Metaso (metaso.cn), which provides access to the MiniMax-H3 video model. Use media you have permission to share, and avoid sensitive personal information. Public media URLs must be accessible to the provider; do not use a URL for confidential content.
We record your account ID, prompt, generation options, provider task ID, status and credit settlement. Completed videos are copied into our object storage. Generated media uses publicly accessible URLs: treat anyone with a URL as able to access it. Account ownership checks protect task records, but do not make a public media URL private.
Account and payment data
Registration and sign-in process the account information required by your chosen login method, such as email address and display name. Session cookies maintain sign-in. When checkout is available, the payment provider selected at checkout processes payment details; our order records track the purchase and credits. Do not send card details through support messages.
Providers and retention
Hosting, configured object storage, Metaso and the selected payment provider process data needed for their services. Metaso describes task queries as covering the most recent seven days; this is a query window, not a promise that source media is deleted after seven days. We do not claim a verified supplier deletion period. Refer to the provider's current terms before submitting sensitive media.
Account, media, order and operational records may be retained as needed to provide the service, investigate abuse and satisfy applicable obligations. We do not yet offer an automatic deletion schedule for uploads or generated videos. Contact the operator through the contact page to request access, correction or deletion.
Browser storage and choices
A photo carried through sign-in is stored locally in IndexedDB with a 30-minute recovery window; it is cleared after recovery or when an expired draft is next read; it is not uploaded by the sign-in action. The browser stores language and appearance preferences and may keep an unfinished generation request and the latest task ID so you can recover a lost response. This can include a prompt and media URLs. Avoid shared devices for sensitive content. Signing out ends access to protected tasks; browser preferences and recovery records can be removed through your browser settings.
Website analytics
We use PVUV (pvuv.ai) to measure page visits, referral sources, device and browser information, approximate location, time on page, scrolling, link clicks, form interactions and site performance. Its script also reports technical errors and signals used to distinguish automated traffic. PVUV uses first-party cookies and browser storage for visitor and session identifiers. Google Analytics and a configured Plausible integration also measure website usage. After consent where required, an opaque account identifier links browser visits with server-confirmed account creation, generation outcomes and checkout/payment events. Conversion records may include the selected video pack, resolution, amount and currency; they do not include uploaded media or generation prompts. These analytics help us understand usage and improve the site. We do not intentionally send uploaded media, generation prompts, passwords or payment details as analytics events.
For requests identifying as search or AI crawlers, the server reports the page path without query parameters, user agent, response status and time to PVUV. The edge-provided IP address is used by PVUV to verify the crawler operator, rather than treating a user-agent claim as proof of a real crawler.
When the site's cookie consent banner is enabled, PVUV loads after you accept. You can change your choice through Cookie settings; withdrawing consent reloads the page to stop the tracker. You can also clear cookies and site storage in your browser.
Contact and security
The contact form creates an email draft to support@bicep-heart.org in your own email application. Account support tickets keep your question and replies in your account. It does not silently send a message. Never include passwords, API keys or full payment details. Account features use the project's authentication and access controls; no online system is free of risk.