Privacy Policy

1.Who handles your data

Prepaper is operated by The Magic of the Desert Business, which is the controller of the personal data described here.

This policy covers the Prepaper website and the signed-in application. It is written to be read rather than to be defensible, so it names actual services and actual tables instead of categories.

2.What we store

Account and identity:

• your email address, and a display name if you set one
• if you sign in with GitHub, your GitHub account identity, plus a few public facts about that account that we read once to decide whether you qualify for free credits (roughly, how established the account is). We do not store your GitHub repositories or read anything private.

Your work: project names, the brief you write for each project, the style you pick, the sets the model draws, the transparent cut-outs taken from them, and the slide layouts you compose. Artwork is held in private storage that only your account can read, through short-lived links.

Generation records: for each run, the prompt, the style, which model was used, how many sets were asked for, how many credits were charged, whether it succeeded, and what it cost us to run.

Billing and credits: your credit history, which is an append-only record of every grant, purchase, spend and refund with a timestamp and a reason; your plan, its status and when the current period ends; and the payment events we receive from our payment provider.

Ordinary server logs generated by our hosting provider, which include IP addresses, and are used for security and debugging.

3.What we do not store

We never see or store your card details. Payment is taken on our payment provider’s own pages.

Prepaper runs no advertising trackers, no session replay and no cross-site profiling. The only cookies we set are the ones that keep you signed in. We do measure how the product is used, which is the next section.

We do not sell personal data, and we do not share it for advertising.

4.Product analytics

We measure how the product is used, through PostHog. It is how we find out that generations are failing, that an export format nobody opens can go, or that a page is broken for everyone rather than for one person.

• when you act: your account id, the name of the action (a generation started, an export downloaded, an order paid) and a few plain facts about it, such as how many sets were asked for or which export format you chose
• when you read a page: the path of that page, sent with a random id kept in your browser that belongs to no account and names nobody

We never send your brief, your artwork, your project names or your email address. None of this uses cookies. If your browser sends a Do Not Track signal we send no page views from it, and clearing your site data throws the random id away. The account events above are recorded on our servers when you act, whichever browser you use.

5.Where your brief goes

This is the part worth knowing. When you generate, the brief you wrote is sent from our servers to a model provider that draws the sets, and it passes through automated moderation on the way. It leaves our infrastructure. Do not put anything confidential in a brief, including unreleased product names you are not ready to have processed by a third party.

We send the text of the brief and the style you chose. We do not send your email address or your name with it.

The provider processes the request under its own terms and privacy policy, which govern how long it retains what it receives.

Publishing is the other way a brief leaves. If you publish a tour from the studio or your dashboard, its slides, artwork, project name and brief are public at that link for anyone who has it, and if you also list it they are in the gallery at /explore and open to search engines, until you unpublish. Nothing about your account travels with it: no email, no name, no id.

6.Why we hold it

• to run the product you signed up for: drawing props, cutting them out, keeping projects so they reopen, and building your export
• to take payment, apply your plan, and keep an accurate credit history
• to stop abuse of the free-credit system, which is the one place a small product can be drained by someone acting at volume
• to keep the service secure and to debug it when it breaks
• to meet accounting and tax obligations on the payment records

We do not use your briefs or your artwork to train models, and we do not use them to improve Prepaper for anyone else.

7.Who else is involved

Prepaper is a small product built on a few services. Each one sees only what it needs:

• Supabase: the database, sign-in, and the private storage your artwork lives in.
• Vercel: hosting for the site and the application, and the server logs that come with it.
• Polar: payments. Polar acts as merchant of record, takes your payment details directly, and tells us only that an order happened and what it was for.
• OpenRouter: routes the generation request to the image model that draws your sets.
• GitHub: only if you choose to sign in with it.
• PostHog: the product analytics described above. It receives an account id and the name of an action, never anything you wrote or drew.

These providers process data on our instructions. Our servers and database are hosted in the United States, so if you are elsewhere your data is transferred there in order to run the service.

8.How long we keep it

Projects, briefs, sets, cut-outs and layouts are kept until you delete them or close your account.

Your credit history is append-only by design, because a balance that can be quietly edited is a balance nobody can trust. When you close your account we delete your content and your profile, and retain the minimum record of paid transactions that accounting and tax rules require, without the content attached.

Server logs are kept for a short period by our hosting provider and then discarded.

9.Your rights

You can ask us to give you a copy of your data, correct it, delete it, or stop a particular use of it. Depending on where you live you may have these rights by law; we offer them to everyone regardless.

Two you can exercise without asking: your export gives you your artwork and layouts in a folder you keep, and your credit history is visible on your settings page at any time.

For anything else, write to us from the address on your account, using the contact details at the end of this page. We aim to answer within 30 days, and we will not charge you for a reasonable request.

If you are unhappy with how we handled a request, you can complain to your local data protection authority.

10.Security

Every table that holds something you own is protected at the database level, so a query can only ever return your own rows, and that check runs regardless of what our application code does. Artwork sits in private storage and is served through links that expire.

No system is perfect. If we ever discover a breach affecting your data, we will tell you and the relevant authority as the law requires, and we will tell you what we actually know rather than as little as we can get away with.

11.Children

Prepaper is not intended for children. Do not use it if you are under 16, and do not create an account for someone who is.

12.Changes to this policy

We will update this page when what we do changes, and the date at the top will tell you when that was. If a change materially affects how your data is used, we will email account holders rather than rely on you noticing.

13.Contact

For a copy of your data, a correction, a deletion, or any question about this policy, write to hello@prepaper.dev.