Privacy Policy

1. Information we handle

• Account: email address, account ID, hashed sign-in challenges and session tokens. We use emailed codes rather than a password.
• Draft: two adult photos, names, birthday or friendly-roast choice, story, lyrics, photo permission confirmation, draft ID, timestamps and account ownership where applicable.
• Security: request and network information provided by our host, including IP information for abuse controls. Email addresses are used for sign-in and email sending limits; persistent IP-related limit identifiers are hashed.
• Support: your email, message, draft reference and information you choose to send. Do not send identity documents, payment-card details or sign-in codes.

We use photos to support your requested creative draft, not to identify or authenticate a person.

2. Purposes and choices

We use this information to provide the preview, sign you in, save and recover your own drafts, prevent abuse and answer requests. Where required, the legal bases are providing the service you request, consent where required, legal obligations and legitimate interests in secure operation where permitted.

We do not sell personal information, use submitted photos in public samples or marketing without separate permission, or train our own models on your uploads. We do not run an advertising mailing list. This does not promise a future AI supplier's training or deletion practices.

3. Providers and international processing

• Cloudflare: website delivery, server-side processing, private draft photos and account/draft storage through Workers and SQLite-backed Durable Objects; network and security processing. See Cloudflare's Privacy Policy.
• Resend: your email address and authentication message for delivering sign-in codes. See Resend's Privacy Policy.
• Cloudflare Email Routing and our inbox provider: support messages are forwarded to the operator's private support inbox.

Our operator is in China and these providers may process information internationally. We do not claim a particular transfer safeguard or certification for every processing activity. Where additional legal safeguards or consent are required, they must be in place before that processing.

Operator-only generation tests: the configured operator account can explicitly send reviewed photos and lyrics to Floniks, using Seedream 5.0 Pro for a combined image and Seedance 1.5 Pro for a 10-second video with audio. Uploaded and generated supplier files use public CDN links: anyone who obtains those links can access them. We have not verified supplier deletion times, private access or no-training guarantees. We retain a private copy of the generated video for up to 7 days from completion, protected by account access; scheduled cleanup removes our active-store copy after expiry. That does not delete supplier copies, hosting recovery copies or downloads. An operator reviews output before private release. Ordinary visitor accounts cannot start these live tests.

Future paid service: Floniks and downstream models are intended for generation; Waffo Pancake is intended for hosted payments. Waffo receives no payment details through this public preview. Photo transfers for operator-only tests are described above; ordinary visitor drafts are not sent for generation. Before opening orders, we will disclose the active models, data transfers, supplier-link access and verified retention limitations. We may also disclose information where required by law, to address abuse or with your permission.

4. Cookies and browser storage

Necessary sign-in cookies hold a browser-bound challenge for up to 10 minutes and an account session for up to 7 days. Production cookies use Secure, HttpOnly and SameSite protections. Signing out revokes the session.

For a guest draft, browser session storage may hold its access token and the private link contains that token in its URL fragment. Anyone with the complete guest link can open the draft while it remains valid. Saving it to an account revokes guest access. Do not share private links publicly. Clearing browser storage may remove recovery access; it does not delete the server draft.

We do not add advertising pixels or marketing cookies to this preview. Hosting providers may process operational usage and security information.

5. Retention and deletion

• Photos: access expires 24 hours after draft creation, even when signed in.
• Draft details: guest drafts expire after 24 hours; account drafts after 30 days from creation. Signing in does not extend photo lifetime.
• Authentication: codes expire after 10 minutes, sessions after 7 days or earlier revocation. Expired sessions and challenges are cleaned by scheduled application activity; challenge records may remain for up to a day for abuse controls.
• Accounts and support: account email/ID and support correspondence do not share the automatic draft expiry. Contact us to request closure or deletion. Necessary security or legally required records may need to remain.

Automatic cleanup concerns our active application store. Expiry is not a promise of immediate erasure from hosting recovery copies, email systems, provider logs, or copies you or others saved. Providers apply their own retention practices. Signing out does not delete your account.

6. Security and your rights

We use HTTPS, hashed authentication secrets and access checks for draft and photo endpoints. Signed-in drafts require their owner account; guest drafts require the private token. No online service can guarantee absolute security.

Depending on applicable law, you may request access, correction, a copy, deletion, restriction, portability, objection or withdrawal of consent. Email support@yourairapvideo.com from your account address. We may verify ownership using the minimum information needed and will respond within applicable legal time limits, explaining any exception. You may complain to the relevant data-protection authority where available. Required incident notices will be provided under applicable law.

7. Adults and updates

The service is for adults aged 18 or older and adult photos only. You must have permission from both people pictured. Report a child's information or unauthorised photo to support so we can investigate.

Updates are dated here. Material changes will receive appropriate notice; changing this policy alone does not supply consent for a new purpose. Related document: Terms of Service.