Privacy Policy

• Guests generate nothing we can identify. The 20 free generations are counted in your browser's local storage. No account, no cookie, no server record.
• Accounts store an email and a balance. Provided by you through Google or GitHub, or by us if you use a magic link. Never a password — we delegate authentication entirely.
• Studio geometry never leaves your device. Generation, rendering, and export all run client-side.
• API calls are logged. The seed, the format, the credit movement, and a truncated IP address for abuse prevention.

Artemaze is operated by Artemaze Ltd. For data-protection purposes we are the data controller. Questions about this policy or a request about your data should go to privacy@artemaze.com.

Where we rely on processors — hosting, authentication, email, payments — the relevant section names them and explains what they receive.

Account data

• Email address — from Google or GitHub if you sign in with them; from you if you use a magic link. Used to sign you in and, if you opt in, to send transactional notices.
• Provider identifiers — the subject identifier Google or GitHub assign to you, so we can recognise a returning sign-in. No access to your Google or GitHub profile, contacts, or repositories.
• Credit balances — trial and purchased counts, the trial expiry date, and a record of when the account was created.
• API key metadata — a SHA-256 hash and a short display prefix. The plaintext key is shown to you once at creation and is never stored.

Generation history

When you generate in the Studio while signed in, we record the seed tag, the generator, and the timestamp, so your account can show what you have made. This is a functional record, not an analytics profile, and it is deleted with your account.

API request logs

Each API call records the key hash, the seed, the format, the response status, the credit movement, and a truncated IP address. Logs are used for rate limiting, abuse prevention, and debugging. We do not build advertising profiles from them.

What we never collect

• No passwords — authentication is delegated and we never see a credential.
• No card numbers or payment credentials — handled entirely by Paddle.
• No Studio geometry. Vertex buffers generated in the browser are never transmitted, and nothing about them reaches us.
• No third-party advertising or cross-site tracking pixels.

You can use the Studio without an account. In that mode the remaining guest credits and the seeds you have generated are kept in your browser's localStorage under keys scoped to this site.

Local storage is on your device and is not under our control. It is not encrypted, it is shared across tabs, it persists until you clear it, and clearing your browser data resets your guest allowance. It never leaves the device and we cannot read it.

Signing in does not migrate the guest balance — the two allowances are tracked separately, and the guest one is dropped once you sign in.

We support three sign-in methods. All three are handled by Supabase Auth:

• Google OAuth — Google returns your email address and a stable subject identifier. We request only the standard profile and email scopes.
• GitHub OAuth — GitHub returns your email address (or your primary verified address) and a stable account id. We request no repository scope.
• Email magic link — you enter an address, Supabase emails you a single-use link with a short expiry. The link contains a one-time token, not your address in the clear.

Each provider is a separate processor under our control and Supabase's own. Signing in with one does not create an account with the others, and we do not use any provider for advertising or profiling.

Account data, credit balances, and API key hashes are stored in a Supabase Postgres database. Access is governed by row-level security: the only component holding a privileged key is the server-side API route, and no client bundle contains it.

The application itself is served by Vercel. Auth traffic passes through Supabase's authentication service. Payment data passes through Paddle and never reaches our infrastructure.

Because these are infrastructure providers rather than storage locations you can choose, transfers outside the UK and EEA are covered by the providers' standard contractual clauses and adequacy decisions. You can request a copy of the applicable safeguards by email.

Artemaze sets no tracking or advertising cookies, and no third-party trackers. Two classes of browser storage are used:

• Strictly necessary — a Supabase authentication session cookie, set only when you sign in, required to keep you signed in. Not readable by client-side JavaScript, and essential to the service you asked for. No consent is required for these under GDPR.
• Local storage — guest credit counts and recent seeds, described above. Not a cookie, and never transmitted.

Blocking strictly necessary cookies will prevent sign-in but nothing else; the Studio works entirely without them.

Payments are processed by Paddle, acting as merchant of record. Paddle handles the card details, calculates and remits tax, and issues receipts.

We receive the transaction reference, the amount, the currency, the billing country Paddle provides, and your email address so we can associate the purchase with your account. We do not receive, store, or have any access to your card number, expiry, or security code.

We share personal data only with the processors needed to run the service:

• Supabase — database and authentication. Account data and auth events.
• Vercel — hosting. Request metadata and server logs.
• Paddle — payments. Transaction records, and your email address for receipts.
• Google or GitHub — only if you choose them, and only the identifiers described above.

We do not sell personal data, and we have never done so. We do not share it for advertising. We will disclose it to a public authority only where we are legally compelled to, and we will tell you unless the law forbids us from doing so.

• Account data — until you delete your account, then removed from the production database immediately and from backups within 35 days.
• API request logs — 30 days, then deleted. Enough to investigate abuse; not long enough to build a profile from.
• Payment records — kept for as long as tax law requires. Paddle keeps its own records independently under its own policy.
• Guest data — in your browser, until you clear it. We hold no copy.

If you are in the UK, the EEA, or Switzerland, the GDPR applies to your data. If you are a California resident, the CCPA/CPRA applies. The rights are substantially the same:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of anything inaccurate, chiefly your email address.
• Erasure — deletion of your account and everything attached to it.
• Portability — your data in a machine-readable format.
• Objection and restriction — of processing based on legitimate interests, and a request to pause it while a concern is resolved.
• Withdraw consent — withdraw it at any time, which does not affect processing already done.
• Complain — to your supervisory authority. In the UK that is the Information Commissioner's Office; elsewhere, the authority in your country.

California residents additionally have the right to know what personal information is collected, used, disclosed, and sold, and the right to opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of. We do not serve targeted advertising.

We respond within 30 days, and usually within a week. There is no charge unless a request is manifestly unfounded or excessive.

Delete your account: use the delete control in account settings. It removes your profile, credit balances, API keys, and generation history.

Everything else: email privacy@artemaze.com from the address on the account, so we can verify who you are before disclosing anything. We will not ask you for a password — we do not have one, and anyone who does is not us.

We do not currently run a data-portal or standard contractual clause form; the route to a machine-readable copy is the same email, and we will supply one.

Artemaze is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has created an account, email us and we will delete it.

We update this policy when our practices change. The "last updated" date above is authoritative. Material changes are announced in the changelog and, for account holders, by email.

Questions, requests, and complaints: privacy@artemaze.com.