The plain-language version: we collect what's needed to run an image-generation account (your email, your prompts, your generations, payment records). We don't sell your data and we don't train models on your content. We do advertise, so if you arrived from one of our ads, Google's tag tells us the ad worked; that's the only third-party tag on the site, and section 4 explains it. Generated files don't stay with us long either: they expire from our servers when the download window shown on your account page closes. The sections below spell it out.
This policy covers logospell.com and the Logospell MCP server, operated by Logospell ("we", "us").
1What we collect
- Account. Your email address and sign-in records. If you sign in with Google or GitHub we receive your email and provider account id, nothing more. There are no passwords.
- Billing. Stripe processes payments; we keep transaction records (which pack, when, Stripe's ids) but card details never touch our servers.
- Generation content. The text you send (styles and subject descriptions), the images that come back, and per-call records: which tool, its parameters, credits spent, status, and timing.
- Technical. IP address, user agent, request logs, and Cloudflare Turnstile verification outcomes, kept for security and abuse prevention.
2How we use it
To run the service and your account, process payments, prevent abuse and fraud, send transactional email (sign-in links, access and purchase notifications), keep the service reliable, and measure our own advertising (section 4). We don't sell personal data, we show no ads on this site, and we don't use your prompts or images to train models.
3Services we rely on
Each of these processes only the data its job needs:
- AI providers: generating your images means sending the text you write to the third-party AI services that do the generation, such as Google and xAI. They receive that text and return the images.
- Stripe: payment processing and receipts.
- Cloudflare: the Turnstile check that keeps bots off our forms.
- Amazon Web Services: delivers our email to you (sign-in links and notifications).
- DigitalOcean: hosts the service.
- Google and GitHub: sign-in, if you choose one of them.
- Google Ads: measures whether our ads bring people who sign up, generate, or buy (section 4).
4Cookies
One session cookie keeps you signed in, and Cloudflare Turnstile may set a short-lived cookie of its own while verifying you're human. We set no analytics cookies of our own.
We advertise on Google, so the site carries Google's advertising tag. It records whether a visit that began with one of our ads led to a signup, a generation, or a purchase, which is how we tell which ads are worth paying for. On that measurement Google sets its own advertising cookies and may use the visit for its advertising products; if that isn't something you want, an ad blocker or your browser's tracking protection stops it, and nothing about your account or your images depends on it.
Visitors in the EU, UK, and EFTA countries are treated differently: the tag is told up front to store nothing on their devices, so no advertising cookie is set unless we later ask for and receive consent. Their results reach us only as Google's estimates.
5Retention
- Account records last while your account is active.
- Generated files stay downloadable for a limited window after each generation (your account page shows the current window). Generation records stick around to power your account history and abuse prevention.
- Logs and metrics are kept for a limited period for security and reliability work.
- Email us to delete your account; we'll remove or anonymize your data, except records we're required to keep (payment records for tax and accounting, for example).
6Your rights
Email us to access, correct, export, or delete your data; we honor these requests wherever you live. Depending on your residence (the EEA and UK under GDPR, California under the CCPA, among others) you may have additional statutory rights, including complaining to your local supervisory authority.
7Security
Traffic is encrypted in transit, secrets are encrypted at rest, and infrastructure access is kept to the minimum needed to operate. No system is perfectly secure; if you find a problem, please report it to our contact address.
8Children
The service isn't directed to children under 13 and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.
9Where data lives
We operate from the United States, and the providers above process data in their own regions. By using the service you understand your data is processed in the US.
10Changes to this policy
We'll update this page as the service evolves, change the date at the top when we do, and email account holders about material changes.
11Contact
Privacy questions and requests: email us.