The plain-language version: we collect what's needed to run an image-generation account (your email, your prompts and any reference images you upload, your generations, payment records). We don't sell your data and we don't train models on your content. We do advertise, and when you arrive from one of our ads we note which one: Google's tag does it for Google ads, and our own link does it for ads elsewhere, such as on X. Google's is the only third-party tag on the site, and section 4 explains both. Generated files don't stay with us long either: they expire from our servers when the download window shown on your account page closes. The sections below spell it out.
This policy covers logospell.com and the Logospell MCP server, operated by Logospell ("we", "us").
1What we collect
- Account. Your email address and sign-in records. If you sign in with Google or GitHub we receive your email and provider account id, nothing more. There are no passwords.
- Billing. Stripe processes payments; we keep transaction records (which pack, when, Stripe's ids) but card details never touch our servers.
- Generation content. The text you send (styles, character descriptions, and the subjects, variations and scenes you list), any reference images you upload, the images that come back, and per-call records: which tool, its parameters, credits spent, status, and timing.
- Technical. IP address, user agent, request logs, and Cloudflare Turnstile verification outcomes, kept for security and abuse prevention.
2How we use it
To run the service and your account, process payments, prevent abuse and fraud, send transactional email (sign-in links, access and purchase notifications), keep the service reliable, and measure our own advertising (section 4). We don't sell personal data, we show no ads on this site, and we don't use your prompts or images to train models.
3Services we rely on
Each of these processes only the data its job needs:
- AI providers: making your images means sending your text and images, including any reference images you upload, to the third-party AI services that do the work, such as Google, OpenAI and xAI. They return the results to us.
- Stripe: payment processing and receipts.
- Cloudflare: the Turnstile check that keeps bots off our forms.
- Amazon Web Services: delivers our email to you (sign-in links and notifications).
- DigitalOcean: hosts the service.
- Google and GitHub: sign-in, if you choose one of them.
- Google Ads: measures whether our ads bring people who sign up, generate, or buy (section 4).
4Cookies
One session cookie keeps you signed in, and Cloudflare Turnstile may set a short-lived cookie of its own while verifying you're human. Apart from the ad-link cookie below, we set no analytics cookies of our own.
We advertise on Google, so the site carries Google's advertising tag. It records whether a visit that began with one of our ads led to a signup, a generation, or a purchase, which is how we tell which ads are worth paying for. On that measurement Google sets its own advertising cookies and may use the visit for its advertising products; if that isn't something you want, an ad blocker or your browser's tracking protection stops it, and nothing about your account or your images depends on it.
Our ads elsewhere, such as on X, link through logospell.com, and that link sets one cookie of our own, ls_campaign, holding which ad first brought you, for 90 days. It lets us credit a later signup or purchase to that ad, and only our server reads it.
Visitors in the EU, UK, and EFTA countries are treated differently: the tag is told up front to store nothing on their devices, and our own ad links set no cookie for them, so no advertising cookie is set unless we later ask for and receive consent. Their results reach us only as Google's estimates.
5Retention
- Account records last while your account is active.
- Generated files stay downloadable for a limited window after each generation (your account page shows the current window). Generation records stick around to power your account history and abuse prevention.
- Reference images you upload expire on their own a set time after their last use, and you can delete them sooner.
- Logs and metrics are kept for a limited period for security and reliability work.
- Email us to delete your account; we'll remove or anonymize your data, except records we're required to keep (payment records for tax and accounting, for example).
6Your rights
Email us to access, correct, export, or delete your data; we honor these requests wherever you live. Depending on your residence (the EEA and UK under GDPR, California under the CCPA, among others) you may have additional statutory rights, including complaining to your local supervisory authority.
7Security
Traffic is encrypted in transit, secrets are encrypted at rest, and infrastructure access is kept to the minimum needed to operate. No system is perfectly secure; if you find a problem, please report it to our contact address.
8Children
The service isn't directed to children under 13 and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll remove it.
9Where data lives
We operate from the United States, and the providers above process data in their own regions. By using the service you understand your data is processed in the US.
10Changes to this policy
We'll update this page as the service evolves, change the date at the top when we do, and email account holders about material changes.
11Contact
Privacy questions and requests: email us.