Privacy Policy

1. About this policy

VfxSmith is the AI pixel art VFX creation and asset-management service at vfxsmith.com. This policy explains how we collect, use, store and share information when you browse the library, sign in, create effects, collaborate or purchase credits. The operator of VfxSmith is responsible for the processing described here. For privacy questions and requests, contact xu250618@gmail.com.

2. Information we collect

Google sign-in and account information. When you choose Google sign-in, Google and our authentication provider, Supabase, provide us with your account identifier, email address, name and profile picture when available. We store account and session information to recognize you and secure access to your projects. We do not receive your Google password. Our login requests only basic identity scopes (openid, email and profile), not access to Gmail, Google Drive, contacts or calendars.

Creative content. We process the prompts, conversation messages, reference content you submit, generated effects, source code, previews, settings, project versions, favorites and team information needed to provide the features you use. A generation request can include relevant earlier messages and assets from the same project so that the AI can refine the effect.

Billing information. We retain account and payment references, subscription status, credit balances, usage and transaction records. Stripe collects payment details directly through its hosted checkout and billing portal. VfxSmith does not store your full payment-card number or card security code.

Technical and support information. Our infrastructure may process IP addresses, browser and device information, request times, error reports, security logs and generation usage such as model and token counts. If you email us, we receive the information and attachments you include.

3. How we use information

We use information to authenticate you, save and retrieve projects, generate and refine effects, provide the team features you choose, deliver downloads, administer subscriptions and credits, answer support requests, diagnose failures, prevent abuse and meet legal obligations.

We use Google account information for sign-in, account management and the related service functions described above. We do not sell personal information, use Google user data for advertising, or use Google user data to train generalized AI models. We do not send your Google password or authentication tokens to AI generation providers.

Where data-protection law requires a legal basis, we process information as needed to provide the service you request, for legitimate interests such as security and reliability, to comply with legal obligations, or with your consent where required. You may withdraw consent without affecting processing that was lawful before withdrawal.

4. Service providers and sharing

We share information only as needed for the purposes described in this policy:

• Google and Supabase: sign-in, authentication and account or application data storage.
• Cloudflare: website hosting, request delivery, application execution, generation infrastructure, asset storage and operational security.
• AI service providers: the configured AI gateway (currently TeamoRouter) and the model provider used for your selected generation mode receive the prompt, relevant project context and reference or generated content needed to run and review the generation. Providers may process requests on infrastructure outside your country. Their handling of those requests is also subject to their applicable terms and privacy practices. Do not include passwords, payment details or sensitive personal information in prompts or reference content.
• Stripe: payment processing, subscription management, billing support and fraud prevention. We may provide your email address and account or transaction references for these purposes.
• People you share with: projects and assets placed in a team space may be accessible to its authorized members according to their roles. Exported files can be shared by their recipients.

We may also disclose information when required by law, to respond to lawful requests, or where reasonably necessary to protect users, prevent fraud or enforce our terms. If the service is transferred to another operator, information may be transferred as part of that transaction, subject to applicable law and notice of material changes.

For provider information, see Google’s privacy policy, Supabase’s privacy policy, Cloudflare’s privacy policy and Stripe’s privacy policy. These services maintain their own policies.

5. Browser storage and cookies

VfxSmith uses browser local storage and session storage to maintain sign-in sessions, preserve local drafts and preferences, and return you to the right page after login. Google, Supabase, Cloudflare and Stripe may use cookies or similar technologies when providing their services. Blocking or clearing necessary storage can sign you out or remove locally saved drafts. We do not use Google sign-in data for cross-site advertising.

6. Retention, security and international processing

We keep account and saved project data while it is needed to provide your account and the features you use. Operational records are kept as needed for troubleshooting, security, abuse prevention and service administration. Payment and credit records may need to be retained after account closure for accounting, disputes, fraud prevention or legal obligations.

You can request deletion as described below. Deletion from active systems does not necessarily remove copies immediately from backups, records we must retain, or content you have already shared or exported. Retained records are limited to the purposes that require retention; backup copies follow the relevant provider’s retention and deletion processes.

We use HTTPS, authenticated access and access controls to protect data, but no online service can guarantee absolute security. Our providers may process or store data in countries other than your own. Where required, transfers are subject to applicable legal safeguards. Contact us for information about a particular processing or transfer arrangement.

7. Your choices and privacy requests

You can browse the public library without signing in. You can sign out, clear browser storage, manage your subscription from your account page, and revoke VfxSmith’s Google access in your Google account connections. Revoking Google access does not by itself delete your VfxSmith account or cancel a paid subscription.

To request access, correction, export or deletion of your personal information or account, email xu250618@gmail.com from the address associated with your account. Describe the request and the relevant project if applicable. We may ask for information needed to verify ownership before acting; never send us your password or authentication token. We respond within the time required by applicable law and explain any lawful reason that prevents full completion.

Depending on your location, you may also have rights to restrict or object to processing, withdraw consent, or complain to your local data-protection authority. Requesting account deletion does not automatically cancel a subscription: use Manage subscription first or ask us for help with both actions.

8. Children

VfxSmith is not directed to children under 13 or anyone below the minimum age for online consent in their location. We do not knowingly collect their personal information. If you believe a child has provided information to us, contact xu250618@gmail.com so we can investigate and take appropriate action.

9. Changes and contact

We may update this policy as the service changes. We will update the date above and provide additional notice of material changes when required. Questions about this policy or your information can be sent to xu250618@gmail.com. See also our Terms of Service.