Privacy Policy — AI Fantasy

Overview

AI Fantasy ("we", "us", "our") operates the website aifantasy.site. This policy describes what data we collect when you use the site, what we do with it, and the choices you have. We collect the minimum data we need to operate the service, we do not sell it, and we let you delete your account at any time.

1. What we collect

Account data

When you create an account, we collect your email address and a password hash (the password itself is never stored in plaintext). We use your email to confirm the account, send you essential service messages, and (if you opt in) product updates.

Profile and content you create

AI characters you design, prompts you write, and images you generate are stored on our servers and associated with your account. You can delete any of these from your account at any time, and you can delete your entire account (which removes all of it) at any time.

Usage data

We log basic request metadata: the time of the request, the approximate region (country level), the page or endpoint hit, and the HTTP status code returned. We use this to operate the service, detect abuse, and improve performance. We do not log the content of your prompts to a separate analytics pipeline.

Device and browser data

Standard browser headers (User-Agent, Accept-Language, Referer) are received automatically. We do not fingerprint your device.

Cookies

We use a single first-party session cookie (PHPSESSID) to keep you logged in. We do not use third-party advertising cookies on this site, and we do not embed third-party trackers in page content.

2. How we use your data

To operate the service: render your AI characters, generate your images, run the chat, store your gallery.
To authenticate you and keep your account secure.
To detect and prevent abuse (credential stuffing, scraping, prompt-injection attempts, content-policy violations).
To respond to support requests when you contact us.
To comply with applicable law.

We do not use your private prompts or images to train any AI model. We do not sell your data. We do not share your data with advertisers.

We share data only with the third parties necessary to operate the service, and only the minimum each one needs:

AI providers — the image-generation and content-moderation services we use receive the prompt text you submit, plus basic request metadata. They process the request and return the result. Their use of your data is governed by their own privacy policies.
Cloud storage and CDN — generated images are stored in object storage and served via CDN so the site loads quickly. The CDN receives standard HTTP request data.
Email service — when we send transactional email (account confirmation, password reset), the email service receives your email address and the message.
Payment processor — if you upgrade to a paid plan, the payment processor receives your billing details. We do not see or store your full card number.
Law enforcement — if we receive a valid legal order, we may be required to disclose data. We will challenge over-broad requests and notify you when we are legally able to.

4. How long we keep your data

Account data: for the life of your account, plus a grace period of 30 days after deletion in case you change your mind.
Generated images and prompts: until you delete them or close your account.
Usage logs: 90 days, then aggregated or deleted.
Backups: 30 days rolling, then purged.

5. Your rights

You can, at any time:

Access the data we hold on you (download a copy).
Correct inaccurate data.
Delete your account and all associated data.
Opt out of any non-essential emails.

To exercise any of these, use the controls in your account settings or contact us through the support channels listed on the site. We respond within 30 days.

6. Security

We use TLS for all traffic, hashed passwords (bcrypt), and parameterized database queries. Access to production systems is limited to a small number of operators and logged. No system is perfectly secure; if you discover a vulnerability, please report it responsibly.

7. Children

AI Fantasy is not directed at children under 18, and we do not knowingly collect data from anyone under 18. If we learn we have collected data from a child, we delete it. If you believe a child has created an account, contact us and we will remove it.

8. Changes to this policy

If we make material changes, we will notify active account holders by email and update the "last updated" date at the top of this page. Non-material changes (clarifications, typo fixes) will be posted without email.

9. Contact

Questions about this policy? Contact us through the support channels listed on the AI Fantasy site. We will answer in plain English.

How AI Fantasy handles your data