Privacy Policy

To put your friends behind the desk in a Tiny Desk AI clip, Tiny Desk AI has to handle some personal data: who you are when you sign in, the photos you add to the band and the videos that come out. This page walks through each of them. For the data described here, Tiny Desk AI ("we") is the data controller.

The short version

• Your photos are used to make your video and to check it, nothing else.
• Uploaded photos delete themselves 30 days after upload.
• We never sell your data, never pass it on for ads, and never train AI models on your photos or videos.
• Your account, photos and videos can be deleted by you at any time on the account page.

The data involved

• Sign-in details. With email sign-up we hold your address and a hashed version of your password. With Google sign-in, Google shares your email address, name and profile picture with us.
• Band photos. Each image you place in a seat. A face is personal data, which is why a person in a photo must be you or someone who said yes to it. Any location or camera details hidden inside the file travel with it, so strip them before uploading if you would rather keep them private.
• Your videos. The finished clips, plus the details of each request: quality, length, status, any error message and the credits it cost.
• Check results. Every photo and every finished video goes through an automatic content check. We log the outcome, the rule involved if it failed, a one-line reason and the time. The log never contains the image or the video itself.
• Credits and orders. Your balance and every change to it, plus each pack you bought: the date, the amount and whether it was paid or refunded. Card and bank numbers are entered on the payment provider's page and are never sent to us.
• USDC payments. The sending wallet address and the transaction hash. Anyone can see both on the Base blockchain; we use them to link the payment to your order and, if a refund is approved, to know where to send it.
• Request logs. IP address, browser type and time of each request, recorded by our host and our server so the site can run, stay secure and be debugged.

The content check only decides whether an image breaks our rules. It does not work out who someone is, does not measure faces and does not build any biometric profile.

Why we use it

• Running the service (to perform our contract with you): signing you in, generating your videos, keeping track of credits and processing orders.
• Safety (our legitimate interest): checking content against the acceptable use policy, stopping fraud and abuse, enforcing the terms and fixing bugs.
• Bookkeeping (a legal obligation): keeping the order records that tax and accounting rules ask for.
• Support: replying when you write to us.

The only emails we send are ones your account needs, such as a password reset link. No newsletters, no ad networks.

Services that handle data for us

• Supabase runs sign-in and our database, in the United States.
• Cloudflare hosts the website and our server, stores uploaded photos and finished videos in R2 (United States), and provides Web Analytics, a cookie-free count of page visits and loading speed.
• Alibaba Cloud Model Studio, in mainland China (Beijing), runs the Kling model that makes the video and the Qwen vision model that checks content. It receives your photos to generate the video, and your photos and the finished video to check them, and treats that data under its own policies.
• Anyway sells card purchases as our merchant of record and runs the USDC checkout page. Payment details it collects fall under its own privacy policy.
• Resend delivers account emails such as password resets.
• Google, only if you pick Google sign-in.

Beyond these services, we share data only when the law requires it, when it is needed to protect someone's rights or safety, or if the service is sold or transferred, in which case this policy goes with it.

Where your data goes

Storage and sign-in are in the United States; video generation and content checks happen in mainland China. Data protection there may differ from the rules where you live. The model provider receives only what one video needs.

How long each kind of data stays

• Band photos: deleted automatically 30 days after upload.
• Videos and the account itself: until you delete the account.
• Order and credit records: as long as tax and accounting law says.
• Check results: as long as the order records, so we can show how the rules were applied.
• Request logs: only as long as security and troubleshooting need them.

Your choices and rights

You can remove your account, photos and videos yourself on the account page. Depending on where you live, you may also ask to see your data, receive a copy, correct it, have it erased, limit or object to how we use it, or take back a consent you gave. For any of these, or if you are locked out, contact us at support@tiny-desk-ai.pro; we may first check that the request really comes from the account holder. People in the European Economic Area or the United Kingdom can also complain to their data protection authority.

If someone else uploaded your photo

Everyone shown in a video must be the person making it or someone who agreed to it, but we cannot see who actually said yes. If you find out that your photo was used without your permission, write to support@tiny-desk-ai.pro with a link to the video or a description of it. We will delete the photo and any video made from it that is still stored with us, and the account that uploaded it may be suspended under the acceptable use policy. You do not need an account of your own to ask.

Google sign-in in more detail

If you choose Google sign-in, Google tells us your email address, name and profile picture so we can create and recognize your account. We do not get your Google password or access to your contacts, files or other Google services. You can remove Tiny Desk AI's access at any time in your Google account's security settings; your account here stays until you delete it.

Browser storage

Your sign-in session is kept in your browser's local storage so you do not have to sign in on every visit. Our host may set cookies that security strictly requires. There are no advertising or analytics cookies: visits are counted by Cloudflare Web Analytics, which sets no cookie and does not identify you.

Keeping data safe

Every connection uses HTTPS. Photos and videos sit in private storage and open only through links that expire, and the database can be read by our server alone. No setup is ever completely secure, so pick a strong password that you do not use anywhere else.

Age limit

Tiny Desk AI is only for people aged 18 or over, and we do not knowingly collect data from anyone younger. If you think a minor has sent us data, contact us at support@tiny-desk-ai.pro and it will be deleted.

Updates to this policy

When this policy changes, the date at the top changes with it. If an update makes a real difference to how your data is used, signed-in users will see a notice on the site before it applies.