Privacy Policy

Information we process

When you create stickers, we process your descriptions, reaction captions, settings, and uploaded images. We store the resulting files, creation IDs, timestamps, and error details needed to provide the service. If you create an account, make a purchase, or contact us, we also process the information described below.

How information is used

We use this information to create and deliver your stickers, manage accounts and credits, respond to support requests, prevent abuse, and troubleshoot service problems. We do not sell your uploaded photos or generated content.

AI processing

Images and animations are generated with gpt-image-2.5 through Tuzi, which routes your descriptions and any images needed for the request to an AI model provider. Do not upload confidential information or images you are not authorized to share with these services.

We save a generation-request record before sending its effective descriptions and captions to Waffo Prompt Sift for safety checks. That record contains the request settings and source-file metadata, but not uploaded image bytes. We keep the request, state and safety verdict eligible for deletion after 180 days. Waffo states it does not retain prompt text after the check.

Tuzi and its upstream providers have their own data-processing and retention practices. Deleting a creation from our service does not by itself confirm deletion from an upstream provider. See Tuzi’s data-handling guidance for its explanation of these boundaries.

Accounts and sign-in

For email sign-in, we store your email address, a salted password hash, verification status, and the security records needed for verification, password resets, and sessions. We do not store your password in plain text. If you choose Google sign-in, Google provides an account identifier, email address, and display name; we do not receive your Google password.

Signing in connects the anonymous browser identity you are currently using to your account so eligible creations and credit usage can be associated with it. It does not extend the retention period for creation files.

If you save a reaction set, we store its name, ordered emoji, action descriptions, caption text and language with your account so you can use it across devices. These settings do not include your character images and are separate from the 72-hour creation-file cleanup. You can delete a set from My reaction sets.

Email and support

We use Resend to deliver account verification, password-reset, and support emails. A support request includes the email address and message you enter, its topic, any creation ID you provide, and page and browser details used to investigate. Your images are not attached automatically. Email delivery and support correspondence are also processed by our email providers; see Resend’s Privacy Policy.

Payments

If you buy credits, Waffo Pancake processes checkout and payment details. We keep purchase identifiers, amounts, payment and refund status, and credit adjustments to provide your balance and purchase history. Do not send payment-card details through our contact form.

Storage and retention

Creation files, including uploads, generated images, animations, and prepared downloads, are eligible for automatic deletion 72 hours after the creation was started. Cleanup runs periodically, not at an exact second. Account history does not make these files permanent, and continuing a creation does not restart this period. Download anything you want to keep.

Account, credit-usage, payment, security, and support records are separate from creation files and are not deleted by the 72-hour cleanup. We retain them as needed to operate your account, handle support and disputes, prevent abuse, and meet applicable record-keeping obligations. Provider records and backups have separate retention schedules. You can request deletion; we may need to verify your identity and retain records that are still required for those purposes.

Your browser stores the current creation ID and your place in the process for recovery, as well as your chosen sticker text language, not copies of your uploaded or generated image files. Saved reaction sets are stored with your account, not only in this browser.

Essential cookies and abuse prevention

We use a signed, HttpOnly cookie to remember this browser and manage its one-time free trial. Trial credits and the additional one-time verified-account credits do not refresh daily. This browser cookie normally lasts one year and contains a random identifier, not your email, images, or balance. Separate session cookies keep you signed in. When Cloudflare Turnstile is used, a signed cookie records a passed security check for the current UTC day.

Cloudflare processes connection and security information, including IP address and browser details. We derive a protected identifier that changes daily for shared-network limits; credit-usage records store that identifier rather than the original IP address. Hosting and security logs may still process IP addresses and request metadata. We do not use these security identifiers for advertising or cross-site tracking.

First-party product measurement

We record a small first-party set of page and product events: page view, browser-session link, tool start, tool completion or failure, verified signup, and completed purchase. These records contain an event name, a route from our allowlist, a coarse source bucket such as direct, search, social, referral, internal, or paid, a random visit identifier, an account identity where applicable, environment, and timestamp. We do not include prompts, uploaded images, filenames, email addresses, full URLs or query strings, or raw referrer addresses in these analytics records. Browser measurement respects Global Privacy Control and Do Not Track. Raw analytics events are scheduled for deletion after 90 days. Advertising and cross-site tracking pixels are not currently used.

Your choices

You can use text-only generation, sign out, and request access to, correction of, or deletion of information associated with your account or creation ID. We may verify your identity before acting on sensitive requests. Our service providers may process information in countries other than yours under their own applicable terms and safeguards.

Contact

For privacy questions or a data request, contact us or email hello@stickerpackmaker.com.