Privacy Notice

Data processing and your rights

We process registration and sign-in data, account identifiers, prompts and reference images you submit, generated results and job records, credit balances and changes, purchase and subscription references, and technical records needed to secure the service. If you sign in with Apple, we receive from Apple your email address, which may be a private relay address ending in @privaterelay.appleid.com if you chose to hide your email, and a unique user identifier that Apple assigns to your account for Methodhelm. Apple may also send your name the first time you sign in; we do not store it. If you sign in with Google, we receive your email address and the unique user identifier Google assigns to your account. We use these only to create your account, sign you in, keep one account per sign-in method, and prevent abuse. We never receive your Apple or Google password. To let us end your Sign in with Apple connection when you delete your account, we also keep a token that Apple issues for that purpose, stored encrypted. We use this data to authenticate you, perform requested AI work, provide results and history, account for credits, deliver purchased entitlements, answer support requests and prevent abuse. To make sure each person can claim welcome credits only once, we keep a keyed one-way hash (HMAC) of your normalised email address, not the address itself. It cannot be turned back into your email and is used only for this purpose. We keep it for 3 years from the day you claim the credits, and delete all of them when the welcome-credit offer ends. We rely on our legitimate interest in preventing abuse; you can object by emailing us. Paddle processes paid checkout; Methodhelm receives the transaction status and identifiers needed to provide the service and grant entitlements. Purchases in the iPhone app are processed by Apple. From Apple we receive transaction identifiers, the product you bought, purchase, renewal, expiry and refund dates, and the status of your subscription. To link a purchase to your account, we give the app a random identifier that reveals nothing about you, and Apple returns it with the purchase. We never receive your card details or other payment details from Apple. When you use an AI tool, your photo and any description you type are sent to our servers and to the AI service provider that runs that tool, to create your result. Our AI service providers are fal.ai (Bria, Google, Meta, Topaz, Kling) and OpenAI. fal.ai runs the Bria, Google, Meta, Topaz and Kling models for us. We do not keep the photos you upload, and we do not keep the text of your descriptions, only a one-way hash of it. We do not use your photos or descriptions to train AI models. Each AI service provider handles the data under its own terms and privacy policy. OpenAI states that data sent to its API is not used to train its models, and that it may keep that data for up to 30 days to monitor for abuse, or longer where the law requires. We ask fal.ai not to store the inputs and results of each request (fal's request-history storage is turned off), and files it creates for us expire after 24 hours; this does not cover any logs kept by the underlying model companies. Your results are kept for 24 hours so you can download them, then deleted, and are fully deleted from our storage within 7 days. Tools that run on your device (crop, resize, compress, convert, face check, straightening) do not send your photos anywhere. We use Cloudflare Web Analytics for cookieless, anonymous traffic statistics; it does not identify individual visitors. Generated results are kept in access-controlled private object storage and made available through member-authorized downloads. The currently deployed technical read-access period is 24 hours. This does not mean all objects, account records or transaction records are deleted after 24 hours. When you report an AI result, we keep the reason, any note you add, and the account and job it relates to, so we can review the content and improve the service. One year after the report, or when you delete your account, we remove everything that identifies you and keep only anonymous statistics, unless the law requires us to keep it longer. You may contact support@methodhelm.com to ask about, access or correct data relating to you. You can delete your account yourself on the account page of the website or in the app. When you do: - We do not keep the photos you upload. Your generated results are removed from your account when you delete it, and fully deleted from our storage within 7 days. - Remaining credits are forfeited and any website subscription is cancelled immediately. We cannot cancel App Store subscriptions; cancel them in your iPhone Settings. - If you signed in with Apple, we ask Apple to end your Sign in with Apple connection to Methodhelm. - Payment and credit records, including App Store transaction records, are kept without your email or other identifying details until the end of the 8th year after the year of the transaction, as tax law requires. After that, only monthly totals with no personal data remain. - The email hash (HMAC) that prevents welcome credits from being claimed twice: We keep it for 3 years from the day you claim the credits, and delete all of them when the welcome-credit offer ends. - Your reports of AI results are de-identified at once, as described above. If a step cannot finish right away, your account stays locked and the deletion completes automatically. Some service providers may process data outside Taiwan.