LEGAL
Privacy Policy
Last updated: October 13, 2026
This policy explains how Scary Face Generator handles information when you use the website and image-generation tool.
Images you upload
Your uploaded portraits and generated image or video are processed only to provide the requested transformation. In mock mode, an image is processed within the request and is not placed in persistent storage. When a third-party AI provider is enabled, your files are sent to that provider to perform the generation. We do not use uploaded files to train our own models.
Google sign-in
If you choose Google sign-in, we receive basic account information such as your name, email address, profile image, and Google account identifier. We use it to authenticate you and associate purchases and generation credits with your account. We do not receive your Google password.
Payments and credits
Waffo Pancake processes checkout and payment information. We receive transaction details needed to confirm an order, including your billing email, purchased product, amount, currency, order status, and payment reference. We do not receive or store your full card number. We retain an account credit ledger and payment references to provide purchased credits, prevent duplicate fulfillment, process refunds, and maintain financial records.
Your private gallery
If you go to checkout from the generator, we save one draft portrait and its selected style in the local browser database so you can return to your work. This draft is not uploaded for payment processing, is tied to the signed-in account, and is eligible for restoration for one hour. It is cleared when you replace or remove the photo, successfully submit generation, sign out, or when an expired or mismatched draft is next checked. You can also remove it by clearing browser data for this site.
Your original uploads are temporarily stored in private Cloudflare R2 so a background image or video task can continue after you leave the page. They are deleted when the task finishes; lifecycle cleanup is a backup if deletion is interrupted. Physical removal may take additional time. Successful generated images and videos are saved in private R2 storage and associated with your account in D1. Results become unavailable after 30 days and are removed by the storage lifecycle policy. Download results you want to keep. Generation records include your account identifier, selected settings, task status, creation time, expiry time and credits used. Payment and credit records are retained separately.
Abuse prevention and analytics
We may process short-lived network and browser information for rate limiting and fraud prevention. We may also use Cloudflare Turnstile and privacy-friendly analytics to protect the service and understand aggregate actions such as uploads, generations, failures, and downloads. We do not intentionally retain raw IP addresses for marketing profiles.
Third-party processors
Live transformations use Volcengine Ark Seedream. That company processes your image under its own privacy and retention terms; our no-training statement refers to our own models, not a guarantee about every third-party policy. Google processes the OAuth sign-in flow, Waffo Pancake processes payments, and Cloudflare processes traffic, security checks, database records, and temporary storage under their respective terms. A separate automated image moderation service is not currently enabled.
Content reports
When you submit a report, we store your account identifier, selected category, message, optional image identifier and submission time in D1 for manual review and handling disputes. Do not include unnecessary sensitive data. Reports do not automatically delete your images. For privacy requests about a report, contact support.
Your data rights
Depending on the law that applies to you, you may exercise the following rights by contacting us. This policy explains the information we collect and its uses, and you can ask for further details.
Access and portability: Request access to, or a copy of, the personal data we hold about you. Where applicable, request a portable copy in a commonly used machine-readable format.
Correction and deletion: Ask us to correct inaccurate or incomplete personal data, or request its deletion where applicable.
Restriction, objection and withdrawal of consent: Request restricted processing, object to processing based on legitimate interests or for direct marketing, or withdraw consent where processing relies on it. Withdrawal does not affect the lawfulness of earlier consent-based processing.
Viewing and deleting images yourself: After signing in, open My works from your account menu to view, download or permanently delete saved images. Open Credit history to view confirmed purchases, generation charges and failed-generation refunds. These pages do not contain every category of personal data we hold; email us to request a fuller copy. Deleting a saved image does not delete your account or payment records.
How to submit a request: Email zzwang920@gmail.com, preferably from the email address used for Google sign-in, with the subject “Privacy request.” Tell us whether you want access, a copy, correction, deletion, account closure or another right, and describe the relevant data. For corrections, include the information you want corrected. Do not send your Google password, API keys or full card number. We may ask for proportionate information to confirm your identity or authority before disclosing or changing data.
Account closure: There is currently no self-service account-deletion button. To request closure of your Scary Face Generator account and deletion of associated personal data, use the email process above with the subject “Account deletion request.” Requests are handled manually, not automatically when you send an email. We will explain the scope of deletion and any necessary retention, and confirm the outcome. Download images you want to keep beforehand, and ask us to resolve any unused-credit or refund questions before confirming closure. Signing out alone does not delete your account; closing this service account does not delete your Google account.
Response time: We will respond within 30 calendar days of receiving your request, or sooner if applicable law requires. If verification or an extension permitted by law is needed, we will explain what is needed, why and the expected timing within that response period. A response is not a promise that every request will be granted or all records immediately erased.
Retention and third-party records: Some transaction, credit, security or dispute records may need to be retained to meet legal obligations, prevent fraud or resolve claims. If we cannot delete or restrict particular information, we will explain the reason and applicable retention requirements. Google, Waffo and other providers separately control some records; we can explain which provider to contact for requests about data outside our control.
Complaints: Contact us if you disagree with our response. You may also complain to your local data protection authority where applicable. We will not discriminate against you for exercising rights protected by applicable law.
Your choices
Do not upload confidential images or photos you lack permission to use. You can stop processing before generation by removing the selected file and sign out at any time. Contact us at zzwang920@gmail.com with privacy questions.