Privacy Policy
Last Updated: September 8, 2026
Effective Date: September 8, 2026
We ("we," "us," or "our") operate this application and its related services (collectively, the "Service"). We value your privacy and the security of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you use the Service, and how you can manage that information.
Please read this Privacy Policy carefully before using the Service. If you do not agree with it, please stop using the relevant Service. Where device permissions or processing activities require separate authorization, we will request it when you enable the relevant feature.
1. Scope
This Privacy Policy applies to the Service, including its mobile applications, websites, account features, content-generation features, favorites, memberships, payments, and customer support.
Information collected directly by a third party through its own page or service is governed by that third party's privacy policy. For example, information collected by a login or payment provider on its own interface is independently processed by that provider.
2. Personal Information We Collect and Use
We process the following information only as reasonably necessary to provide, maintain, and improve the Service.
2.1 Account Registration and Sign-In
When you sign in with a third-party account, we may receive and process:
- A unique account identifier;
- Your email address, including a private relay address supplied by the login provider;
- Your name or display name and avatar URL, if supplied by the login provider;
- Your sign-in status, identity token, and security verification information required for authentication.
We use this information to create and maintain your account, authenticate you, synchronize account entitlements, prevent unauthorized access, and display or allow you to update account information.
2.2 AI Image Generation
When you use image-generation features, we process:
- Prompts that you enter or select, and a case or template identifier and interface language;
- Generation task identifiers, task status, creation and completion times, failure reasons, result expiration, and service cost;
- Generated images or image URLs;
- Free-generation usage, credit deductions, and associated transaction records.
We use this information to submit and complete image-generation requests, report task progress, recover interrupted tasks, prevent duplicate charges, display local works, and address service failures.
To generate images, we send necessary information such as your prompt, language, and task callback URL to the third-party AI image-generation provider configured for the Service. The provider may process and temporarily retain the information under its own rules.
Do not include government identification numbers, financial account information, health information, precise home addresses, non-public contact details, another person's private information, or other unnecessary sensitive personal information in a prompt. If you voluntarily include such information, it will be processed to the extent required to provide the image-generation feature.
2.3 Local Works and Device Storage
The application may store the following information locally on your device:
- Prompts and generation task records;
- Generated images, local file paths, and task status;
- The current account identifier, theme and language preferences;
- Sign-in sessions and temporary security information required for authorization flows, stored using secure device storage.
Local works are stored in the application's data directory by default. The application requests permission to add an image to your photo library only when you select "Save to Photos," and it writes only the selected image. This feature does not require the application to read your entire photo library.
When you actively use the system share feature, the selected image is passed to the application or service that you choose. The recipient's handling of the image is governed by its own privacy practices.
2.4 Favorites, Usage Records, and Account Entitlements
When you are signed in, we may process favorited case identifiers and creation times; generation counts, times, and relevant case identifiers; credit balances and transaction records; membership plan and status; and order status, product type, amount, currency, purchased credits, and refund status.
We use this information to synchronize favorites, display account entitlements and transaction history, account for image-generation usage, process purchases or refunds, and prevent duplicate grants or suspicious transactions.
2.5 Payment Information
When you purchase a membership or credit pack, payment is handled by a third-party payment institution. Depending on the payment method, we may provide to or receive from that provider your user identifier, email address, display name, product details, amount, currency, payment customer, session, subscription, order, transaction, payment-status, and refund information.
Payment credentials such as a full card number, payment password, or biometric authorization are ordinarily processed directly by the payment provider. Our server does not store your full card number or payment password.
2.6 Network, Security, and Error Information
When you access the Service, our servers and hosting providers may automatically process information required to provide the network service and maintain security, such as request time, IP address, network request status, browser or operating-system User-Agent, API error details, and an account identifier.
We may use this information for authentication, rate limiting, fraud prevention, troubleshooting, and service reliability. We do not sell your information or use it for tracking across other companies' applications or websites for advertising purposes.
2.7 Website Analytics and Cookies
Where analytics is configured and enabled on a companion website, cookies or similar technologies may process page URLs, page titles, navigation paths, access times, and device and usage information. We use this information to understand website traffic and improve the website.
During third-party sign-in, the website may use necessary cookies to store sign-in state values, return addresses, and temporary security verification information. These cookies enable sign-in and help prevent cross-site request forgery; they are not used for advertising.
Where required by applicable law, we will obtain consent before enabling non-essential analytics cookies. You may delete or restrict cookies in your browser settings, although doing so may affect website sign-in or other features.
2.8 Customer Support
If you contact us by email or another published channel, we process the contact details, problem description, screenshots, and other information that you choose to provide and that is necessary to address your request. We use it to respond, diagnose issues, and retain necessary support records.
3. Device Permissions
The Service may request the following device permissions:
| Permission | Purpose | Can You Decline? |
|---|---|---|
| Internet access | Sign-in, account synchronization, loading content, and submitting or receiving generation results | Yes, but major online features will not work |
| Add to photo library | Save a selected generated image to the system photo library after you initiate the action | Yes, without affecting other core features |
The current version does not request access to your contacts, precise location, microphone, camera, or full photo library for its core features. If a future version adds such a feature, we will update this Privacy Policy and request authorization through the system permission prompt or another appropriate mechanism before access.
4. Service Providers, Sharing, and Disclosure
We do not sell your personal information. We provide necessary information to a third party only in the following circumstances:
- Service providers. To cloud infrastructure, identity, database, AI image-generation, payment, website hosting, analytics, and security providers as required for the purposes described in this Privacy Policy.
- At your direction. For example, when you choose a system share destination, proceed to a third-party payment page, or authorize a third-party account for sign-in.
- Legal requirements. To comply with applicable law, a court order, or a regulatory request, or to protect the lawful rights and interests of users, the public, us, or our partners.
- Organizational change. In connection with a merger, acquisition, asset transfer, or restructuring. We will require the recipient to protect the information in accordance with applicable law and this Privacy Policy, and provide notice where required by law.
The principal categories of third parties that may be involved in the Service include:
| Third Party | Purpose | Information That May Be Involved |
|---|---|---|
| Account, identity, and database providers | Account authentication, data storage, and account synchronization | Account identifiers, contact details, profile information, authentication information, favorites, generation tasks, credits, memberships, and order records |
| Third-party sign-in providers | Allow you to use an authorized third-party account to sign in | User identifier, name, avatar, contact details returned by the provider, and authorization information |
| AI generation providers | Generate images and return task results | Prompts, language, task information, generated results, and callback information |
| Payment providers | Process memberships, credit purchases, payments, and refunds | User and order identifiers, product, amount, currency, transaction status, and refund information |
| Website, API, analytics, and security providers | Deliver the Service, analyze website traffic where enabled, maintain logs, and protect security | IP address, request time, access path, User-Agent, errors, security-event information, and website usage information where analytics is enabled |
The details of a third party's processing, server locations, and retention periods may depend on that party's privacy policy and the configuration of the relevant service.
5. Storage and Retention
We retain personal information for the period reasonably necessary to fulfill the purposes described in this Privacy Policy. The specific period depends on account status, operational and security needs, and applicable law.
- Account details, favorites, credits, memberships, and generation task records are generally retained while your account remains active;
- Sign-in sessions, preferences, prompts, task records, and downloaded images may remain on your device until you delete your account or uninstall the application;
- Image URLs returned by a third-party generation provider may expire, after which the cloud result may no longer be recoverable;
- Temporary authorization-state information is used only for the period necessary to complete or end the sign-in process;
- Some order, payment, security, and log records may be retained after account deletion for the period required to comply with legal obligations, resolve disputes, support audits, or prevent fraud.
Unless otherwise required by law, information that is no longer necessary will be deleted or anonymized. The cloud and third-party services used by the Service may process data outside your country or region. Where data is processed across borders, we will take measures required by applicable law.
6. How We Protect Personal Information
We apply security measures appropriate to the sensitivity of the information, including:
- HTTPS transport encryption and secure device storage for mobile sign-in sessions;
- Identity-token verification for protected API endpoints and access controls for backend credentials and administrative endpoints;
- Database access policies that restrict ordinary users from accessing another user's data;
- Rate limiting, parameter validation, and payment-notification signature verification for relevant endpoints;
- Deletion or anonymization when information is no longer required.
No internet service can guarantee absolute security. If a personal information security incident may affect your lawful rights, we will take remedial action and notify you and the relevant regulator where required by applicable law.
7. Your Choices and Rights
Depending on applicable law, you may:
- View account details, membership information, credits, and recent usage records;
- Update your display name, add or remove favorites, and view local works;
- Save or share images when you choose, withdraw permissions in system settings, and sign out on the current device;
- Request access to, correction of, a copy of, restriction of processing of, or deletion of your personal information;
- Withdraw consent where processing is based on consent, ask questions, or make a complaint about our handling of personal information.
Account Deletion
You may select "Delete Account" in the application and confirm the permanent deletion request. Account deletion removes the account and deletes account-related profile, credit, favorite, membership, order, and generation-task data. The application also clears the account's locally stored task records and generated images located in the application's data directory.
Images saved to the system photo library or shared with another application, information retained by third-party providers under their own legal obligations and policies, and minimum records that must be retained to comply with law, resolve disputes, support audits, or prevent fraud may not be removed automatically.
Account deletion cannot be undone. If you cannot complete deletion in the application, contact us using the details at the end of this Privacy Policy. To protect the account, we may first need to verify your identity.
8. Children and Minors
The Service is intended for users who have the legal capacity required in their jurisdiction. If you are below the age at which you may independently consent to the processing of personal information, use the Service only after your parent or legal guardian has read and agreed to this Privacy Policy.
We do not knowingly collect personal information from a child who does not meet the applicable age requirement without appropriate consent. If a guardian believes that a child has provided personal information without appropriate consent, please contact us using the details below. After verification, we will delete the information or take other action required by law.
9. Changes to This Privacy Policy
We may update this Privacy Policy because of changes to features, processing practices, third-party services, or legal requirements. For material changes, we will notify you through an in-app notice, website announcement, or another appropriate method, and obtain consent again where required.
The Last Updated date at the top identifies the most recent revision. An updated Privacy Policy applies from the stated Effective Date.
10. Contact Us
If you have a question, request, opinion, or complaint regarding this Privacy Policy, our processing of personal information, or your privacy rights, contact us at:
- Email: support@hkbsg.com
After verifying your identity, we will process and respond to your request within the period required by applicable law. We generally aim to respond within 15 business days.