Privacy Policy

Last updated: 2026-05-10

Iconkiln Studio, Inc. ("we") operates Iconkiln. This policy explains what we collect, why, and your rights.

What we collect

Account: email, hashed password, optional display name.
Usage: projects, anchors, icon sets, generated images, prompt text, credit transactions, IP address, user-agent.
Payment: processed by Stripe — we store a Stripe customer ID and receive event metadata. We do not store card numbers.
Diagnostics: error reports (Sentry), product analytics (PostHog) — pseudonymous unless you sign in.

Why we collect it

To run the Service (auth, rendering, exports, billing).
To enforce credit balances, rate limits, and abuse rules.
To investigate bugs and improve the product.
To send transactional email (sign-in confirmation, payment receipts, low-credits warnings).

Sub-processors

Google Cloud — Gemini image models (US)
Supabase — database + object storage (US)
Stripe — payments (US)
Vercel — hosting (global)
Resend — transactional email (US)
Upstash — rate-limit Redis (US)
Cloudflare — Turnstile CAPTCHA (global)
Sentry — error monitoring (US)
PostHog — product analytics (US)

Prompts and reference images are sent to Google's Gemini API. Per Google's API terms, these inputs are not used to train Google's models for paid API customers.

Data retention

Generated images and project data persist until you delete them or your account. Sentry events are retained 90 days; PostHog events 12 months. Backups roll for 7 days.

Your rights

You can export your data (Settings → Export, or /api/account/export) and delete your account (Settings → Delete account, or /api/account/delete). For users in the EU/UK: you have the right to access, correct, port, restrict, object to, and delete your data, and to lodge a complaint with your supervisory authority.

Cookies

We use a session cookie to keep you signed in. Optional analytics cookies are set only if you accept them in the consent banner.

Contact

Privacy questions: privacy@iconkiln.com.

Working template — have counsel review before production launch.

What we collect

Account: email, hashed password, optional display name.

Usage: projects, anchors, icon sets, generated images, prompt text, credit transactions, IP address, user-agent.

Payment: processed by Stripe — we store a Stripe customer ID and receive event metadata. We do not store card numbers.

Diagnostics: error reports (Sentry), product analytics (PostHog) — pseudonymous unless you sign in.

Sub-processors

Google Cloud — Gemini image models (US)

Supabase — database + object storage (US)

Stripe — payments (US)

Vercel — hosting (global)

Resend — transactional email (US)

Upstash — rate-limit Redis (US)

Cloudflare — Turnstile CAPTCHA (global)

Sentry — error monitoring (US)

PostHog — product analytics (US)

Prompts and reference images are sent to Google's Gemini API. Per Google's API terms, these inputs are not used to train Google's models for paid API customers.

Your rights