Privacy Policy

Last updated [Month D, YYYY]

This Privacy Policy explains what StarTurn (“we”, “us”) collects when you use starturn.app (the “Service”), how we use it, who we share it with and how long we keep it. That includes the photos you upload and the videos you make.

By using the Service, you agree to the collection and use of information described here. If you don’t agree, please don’t use the Service.

1. Information we collect

Account information

Your email address. If you log in with Google, we ask Google only for your basic profile and email address, and we keep your name, your profile picture link and your Google account ID. We don’t use passwords.

Photos you upload

The photos themselves, with their metadata removed (section 3). For each upload we also keep a record without the picture: whether it was a person or a pet photo, the file type, its size and pixel dimensions, a fingerprint of the file (a SHA-256 hash) and the result of the checks.

Before every video, you confirm a statement (quoted in our Terms of Service). We record each confirmation: the statement and its version, the fingerprints of the photos, a keyed hash of your IP address (not the address itself), your browser’s user agent, your account and the time.

Videos

The videos you make, the cover image made along the way for some templates (section 3), and a record of each video: the template, when it was made, whether it worked and the credits it used.

Purchases

Lemon Squeezy runs the checkout. It tells us about each order: the order number, the credit pack, the amount, the currency, its status and any refund. We keep these details, along with the payment notifications Lemon Squeezy sends us, which can include the name and email address used at checkout. You enter your card details on Lemon Squeezy’s checkout, and we never receive them.

Removal requests

If you send a removal request, we keep what you enter in the form (your name, your email address, who is in the video, links and any details) and a keyed hash of your IP address.

Analytics, only if you accept

If you accept analytics cookies, Google Analytics records the pages you visit and a few actions, such as logging in and buying credits (section 4).

Technical data

Our servers receive your IP address and browser details with every request. We use them to deliver pages and to stop abuse: for example, we count login link requests per email address and per network for one hour. Our servers also keep logs of errors.

2. How we use your information

We use it to:

Run the Service: log you in, check your photos, make and deliver your videos, and keep your credit balance
Process purchases, and send login links and receipts
Keep the Service safe: enforce our Terms of Service and Content Policy, prevent abuse and fraud, and keep records of consent
Handle removal requests and answer your questions
Fix errors, and see how the Service is used (analytics only if you accept)
Meet our legal obligations

We don’t sell your personal information. We don’t use your photos or videos to train AI models, and we don’t use them in our marketing.

3. Your photos and videos

Before a photo is stored

We remove the photo’s metadata, such as its GPS location, the time it was taken, the device, embedded thumbnails and comments, and any extra image or video saved inside the file. We keep only what the picture needs to display correctly, such as its color profile and, for JPEG photos, its rotation.

Photo checks

Sightengine checks every photo automatically for faces, apparent age, and nudity or sexual content. It deletes the photo once the check is done. A person photo must show exactly one face, and a pet photo must show no people. We keep only the result: how many faces were found, whether the photo passed and, if it was refused, the score that refused it, for example the estimated chance that the person is under 18. We don’t keep the faces themselves or their positions in the photo. If a photo is refused, we delete it right away.

Making the video

We send your photos to fal.ai, which runs the AI models that make your video. fal.ai downloads each photo from us through a private link that works only while your video is being made, and for no more than an hour. For some templates, an AI model first makes a still image that puts your people or pets into the scene. The video is made from that image, and we keep it as the video’s cover image.

How long we keep them

Photos are deleted as soon as your video is finished or fails, and no later than 24 hours after upload. This includes photos you upload before you log in.
Videos are kept for 30 days after they’re made and then deleted, together with their cover image. You can delete a video sooner from its page. We also delete a video when we accept a removal request about it.
After a video is deleted, your history still shows that it existed (the template, the date and the credits), without the video.

Who can see your videos

Your videos are private: only your account can open them, and we don’t publish them. If you open a video on your phone through the link on its page, that link and the video links it gives your phone stop working after about 15 minutes.

4. Cookies and similar storage

These cookies keep the Service working:

session (30 days, or until you log out): keeps you logged in.
anon_id (1 year): ties the photos you upload before logging in to this browser, so they move to your account when you log in.
login_return (1 hour): remembers the page to go back to after you log in.
oauth_state (10 minutes): protects Google sign-in against forged requests.
auth_event (5 minutes): tells the next page that you just logged in or signed up, so analytics can count it if you accepted analytics.

The Service also keeps a few items in your browser’s storage:

Your cookie choice.
Whether you’re logged in and your credit balance, so the page header shows them at once. Never your email address.
For up to 24 hours, the photos you added to a template and whether you ticked the confirmation box, so they’re still there when you come back from logging in or paying. This keeps references to your uploads, not the pictures.
References to the photos of your most recent videos, so a video’s page can show them while it’s being made.
For up to an hour after you start logging in from a template page, which page that was, so it can tell you you’re logged in when you come back.
In the current tab only, the credit pack you’re buying, so analytics can count the purchase if you accepted.
In the current tab only, until you make a cookie choice: the campaign tags and the referring site of the page you arrived on. This note is deleted when you choose or close the tab, and Google Analytics receives it only if you accept.

Google Analytics

Google Analytics runs only if you choose Accept in our cookie banner. If you choose Decline, or don’t choose, it doesn’t load. Your choice is saved in your browser. To change it, use “Cookie settings” at the bottom of any page. If you decline after accepting, we delete the Google Analytics cookies for this site.

When it runs, Google Analytics records:

The pages you visit and the page you came from. Your account, login and video pages are recorded without the rest of their address.
Logging in or signing up, and starting or completing a purchase (the pack and its price).
Standard device details, such as browser, device type, screen size, language and approximate location.

This data is tied to a random ID in a Google Analytics cookie, not to your name, email address or account. It never includes your photos, file names or anything you type.

Turnstile and checkout

Our login and removal request forms use Cloudflare Turnstile to tell people from bots. It runs in your browser, and we send Cloudflare your IP address to verify the result. The Lemon Squeezy checkout opens over our page but runs on Lemon Squeezy’s own site, under its own policies.

We don’t use advertising cookies or tracking pixels.

5. Service providers

We share information with these companies only as needed to run the Service:

Cloudflare: hosting, our database, file storage and Turnstile bot checks. Everything we store is stored with Cloudflare.
fal.ai: runs the AI models that make your videos. It receives your photos and makes the cover images and videos from them.
Sightengine: checks every uploaded photo for faces, apparent age, and nudity or sexual content. It deletes each photo once the check is done, and may process it in the European Union, Canada or the United States.
Lemon Squeezy: our merchant of record. It processes payments and handles sales tax, invoices and refunds. When you buy, it receives your email address and our ID for your account.
Resend: sends login links and receipts, so it receives your email address and the email.
Google: sign-in, if you choose it, and Google Analytics, only if you accept analytics cookies.
Sentry: receives a report when an error happens on our servers: the error, the address of the request and technical details such as your browser type. It doesn’t receive your IP address or cookies.
Telegram: delivers alerts to the people who run StarTurn. An alert about a removal request includes the first part of the request, which starts with the name you entered.

Each provider handles this information under its own terms and privacy policy.

6. Data storage and security

We store your data with Cloudflare. Connections to the Service are encrypted (HTTPS), and scripts on the page can’t read the login cookie. Your videos are served only to your account, and the links that let fal.ai fetch a photo or your phone open a video are signed and expire. In consent records and removal requests, we store a keyed hash of your IP address instead of the address itself. Only the people who run StarTurn can use our admin tools.

No way of sending or storing data over the Internet is completely secure, so we can’t guarantee absolute security. Our service providers may process data in countries other than yours.

7. Your rights

You can ask us to:

Give you a copy of the personal data we hold about you
Correct data that is wrong
Delete your data and your account
Stop using your data where you gave consent, such as for analytics (you can also change that yourself in “Cookie settings”)

Depending on where you live, for example in the European Economic Area, the United Kingdom or some US states, local law may give you more rights.

To make a request, email hello@starturn.app from the address you log in with. We reply within 30 days.

Deleting your account

You can’t delete your account on the site itself. Email hello@starturn.app from the address you log in with and ask us to delete it. We then delete your account details (your email address, name and Google details), end your sessions and delete any videos still stored. Unused credits are deleted with the account; our Refund Policy covers refunds. We keep the records listed in section 8 that we need as proof of consent, for payments and refunds, for removal requests, or to meet legal obligations. Our database provider keeps a restore history for up to 30 days, so deleted details can remain there until it expires.

8. Data retention

Data	How long we keep it
Photos you upload	Until your video is finished or fails, and no more than 24 hours after upload
Refused photos	Deleted right away
Upload records, without the picture	Kept as a record of the checks
Videos and their cover images	30 days after they’re made, unless you delete them sooner
Video history (template, date, credits)	Kept with your account
Consent records	Kept as proof of consent, also after the photos and videos are deleted
Account details	Until you ask us to delete your account
Login links	Until they expire, 15 minutes after they’re sent
Sessions	30 days, or until you log out
Purchase records	Kept as records of the sale
Removal requests	Kept as a record of the request and what we did
Counters for our limits on login links, uploads, videos and removal requests	One hour

9. Children’s privacy

StarTurn is only for people 18 or older. We don’t knowingly collect personal information from anyone under 18, and photos of anyone under 18 aren’t allowed. Our photo checks refuse photos of people who look under 18. If you believe a child has used StarTurn or appears in a photo or video made here, email hello@starturn.app or use the removal request form, and we will delete that information.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we change the “Last updated” date at the top of this page. If a change is material, we tell you by email (if you have an account) or with a notice on the Service.

If you keep using the Service after a change takes effect, you accept the updated policy.

11. Contact

If you have questions about this Privacy Policy or about your data, write to us at hello@starturn.app.