Last updated: November 10, 2026
Scope and information
This policy explains information handled by Unlucid AI at unlucidai.cc across accounts, generation, storage, Credits, purchases, and support.
- Account data includes authentication identifiers, email, profile information, sessions, account status, and security events.
- Creation data includes prompts, uploaded reference media, generated images and videos, settings, task statuses, provider references, and Credit transactions.
- Commerce data includes customer and payment references, offers, amounts, currency, renewals, cancellations, refunds, and disputes. Payment providers handle full card and banking credentials.
- Technical data can include IP address and derived country, browser, device, language, timestamps, logs, and security or fraud-prevention signals.
- Communications include information supplied in billing, support, safety, privacy, and deletion requests.
Media and prompts can reveal sensitive information. Minimize unnecessary personal information and obtain required rights, consent, and a lawful basis before submitting someone else's data. Public availability does not authorize processing a person's likeness or intimate media.
Purposes and providers
We use data to authenticate accounts, fulfill generation requests, maintain creations and task status, manage Credits and payments, provide support, diagnose problems, prevent fraud and prohibited content, enforce Terms, and comply with law. Applicable legal bases may include contract performance, legitimate interests in secure operation, consent where required, and legal obligations or claims.
Our infrastructure uses Cloudflare for hosting and media storage, Supabase for authentication and Product database services, Stripe for payments, and WaveSpeed for generation. Google handles authentication data when Google sign-in is enabled and you choose it. Required prompts, reference media, and settings go to the generation provider to fulfill your request. Providers process information under their applicable terms and privacy practices.
We do not sell customer prompts or media or use customer inputs and outputs to train general-purpose AI models under this policy. Materially different uses require appropriate disclosure and a legal basis. We may disclose relevant information to service providers, at your direction, for abuse or dispute investigations, to protect people, in a lawful business transfer, or as legally required. Processing can occur internationally, with applicable legal transfer safeguards where required.
Content safety and access
Automated systems and authorized personnel may inspect relevant prompts, media, and records to assess adulthood, detect prohibited material, investigate reports, secure the service, or comply with law. Access is limited to operational, safety, and legal purposes. Do not resubmit rejected material to bypass safeguards.
Content is private within the service by default. Sharing downloaded results outside Unlucid AI places them under the practices of your chosen recipients and services. Obtain required permissions before sharing.
Retention and deletion
Retention depends on data category, account and subscription status, operational purposes, accounting obligations, safety and security needs, provider capabilities, backup cycles, disputes, and legal holds.
Under the current Product rule, generation results completed without a subscription entitlement expire after seven days. Results completed with subscription entitlement, or still-unexpired results covered by a settled subscription before expiry, are not subject to that seven-day expiration. Maintenance cleans up expired results at least one day after expiry and actual deletion can be delayed. This applies to generation results, not every account or transaction record. Download results you want to keep.
Removing a creation from a view or closing an account does not immediately erase all related copies. Payment, Credit, security, safety, backup, provider, and legal records can have separate retention requirements. When no longer needed, information is deleted or de-identified under the applicable process. We do not promise immediate deletion from every system.
Browser storage and analytics
Cookies and browser storage support authentication, security, checkout, navigation, preferences, and supported draft recovery. For an adult audience configuration, the unlucidai-cc:age-confirmation local-storage key records a declaration version and a fixed 30-day expiration on the current origin. Revisits do not extend it. If storage fails, confirmation lasts only for the current document. This self-declaration does not verify identity or age.
Preview does not load production analytics. When a production Google Analytics identifier is configured, the production shell loads Google Analytics for usage measurement and attribution. Optional technologies are subject to applicable disclosure and consent requirements before use.
Rights, security, and contact
Depending on location, you may have rights to access, correct, receive, delete, restrict, or object to processing, withdraw consent, and complain to a regulator. A person depicted in content can report unauthorized use or request privacy assistance without having an account. We may verify identity and authority and retain information where legally permitted or required.
Use the verified contact channel below for privacy, safety, deletion, and support. Do not email passwords, session credentials, full card details, or unnecessary intimate media.
We use safeguards such as access controls and private media storage, but no online system can guarantee absolute security. The service is for adults. Prohibited minor-related information may be restricted, deleted, or preserved for safety and law. We will provide notice of material policy changes where required.