Privacy Policy

Exbrush is operated by [legal entity name], which decides how the personal data described here is used. Reach us at support@exbrush.com.

• Account details. When you sign in with Google or GitHub, we receive your name, email address, profile picture and that provider’s ID for your account. We never receive your password. You can change your name and picture in settings.
• Sign-in sessions. Each session records the IP address and browser (user agent) it was started from.
• What you make. Your prompts, the images you upload, reference images and sketches, the images generated or edited for you, and the settings of each run (studio, size, model, style).
• Credits and purchases. A ledger of every credit granted, bought, spent and refunded, and for a purchase the PayPal transaction ID and amount. Card and bank details stay with PayPal; we never see them.
• Email verification. If your provider gives us an unverified email address, we send it a one-time code and keep a hashed copy until it expires.
• Technical logs. Our hosting provider records requests and errors so we can keep the service running and investigate failures.

We do not run advertising or third-party analytics trackers, and we do not buy data about you from anyone.

• To run the service: sign you in, generate and edit images, and keep your library.
• To charge and refund credits correctly and take payment.
• To keep the service secure, prevent abuse and enforce our policies.
• To answer you when you contact us.
• To meet legal duties, such as keeping financial records.

Where the law asks for a legal basis, these are: performing our contract with you, our legitimate interest in running a secure service, and compliance with the law.

To make or edit an image, your prompt and any images that go with it are sent to the AI models that do the work. We do not use your prompts or images to train AI models. The providers handle what they are sent under their own terms.

Runs are checked automatically for prohibited content. See the Acceptable Use Policy.

We share data only with the providers the service runs on:

• Cloudflare — hosting, image and profile-picture storage, session storage, recent-activity storage, email delivery and request logs.
• Neon — the database holding accounts, image records and the credit ledger.
• Runware — runs the AI models. It receives your prompts and the images a run needs, and passes them to the model that produces the result.
• PayPal — takes payment. It receives the amount and an identifier for your account.
• Google and GitHub — sign-in, whichever you choose.

We do not sell your personal data. We may disclose it where the law requires, or to protect the rights and safety of our users, the public or ourselves.

• Images. Until you delete them. Deleting an image from your library removes it, every version made from it, and the stored files.
• Sessions. A sign-in lasts up to 30 days without use, then expires.
• Recent activity. Only your 20 most recent paid runs are kept in the usage list.
• Credit ledger and purchases. Kept for as long as we need them as financial records.
• Account. Until you ask us to delete it.

Depending on where you live, you may have the right to see the data we hold about you, correct it, have it deleted, receive a copy, or object to how we use it. To use any of these, write to support@exbrush.com from the address on your account. You can delete your account yourself at any time under Settings → Account, which permanently removes it along with your images, credits and everything else stored for it. You can also complain to your local data protection authority.

Our providers operate in several countries, so your data may be processed outside the country you live in. Where the law requires safeguards for such transfers, we rely on those our providers put in place.

Connections are encrypted and verification codes are stored hashed. Your images are kept in storage that cannot be browsed or listed, and Exbrush shows them only to you. Each one is served at a long, random address that is not protected by your sign-in, so anyone you give that address to can open the image. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Exbrush is not for anyone under 13. If you believe a child has given us personal data, tell us and we will delete it.

The cookies the app sets are listed in the Cookie Policy.

We may update this policy. The date at the top shows the latest version, and we will tell you about significant changes in the app or by email.