Privacy Policy

We collect an email address when you request a sign-in code or create an account. When you choose Google sign-in, we receive your verified email address and Google's stable account identifier; we do not receive your Google password. We collect the name, email, topic, and message you submit through the contact form. Payment checkout is created for an authenticated account, but full card or PayPal credentials are handled by Yito Pay and its enabled payment providers rather than DepthCarve.

When you choose Generate, the browser compresses your selected PNG, JPEG, or WebP image and sends that data to our Worker, which forwards it to the selected inference provider. DepthCarve does not store the original source image in D1. We store a one-way input fingerprint, job type, provider, status, temporary output metadata, error code, and timestamps so the operation and credit outcome can be explained.

D1 stores account identifiers, email, connected Google account identifiers, short-lived hashed login codes, hashed session tokens, credit ledger entries, payment order references, entitlements, and webhook event IDs. API keys are displayed once and stored only as hashes with a visible prefix, name, creation time, revocation state, and last-use time.

The credit ledger is retained to prevent duplicate charges, grants, and refunds and to answer billing questions. Payment callback payload hashes and identifiers support idempotency. DepthCarve does not receive or store complete card numbers or payment-provider passwords.

Essential internal events measure the path from page view to upload, generation, download, sign-in, checkout, and API-key creation. An anonymous browser identifier is stored locally and sent with these bounded event names. Cloudflare may process network and security logs needed to serve and protect the site.

Google Analytics is loaded only after you choose Allow analytics. click.pageview.click provides site-level page measurement. Google AdSense code is present on public pages and may operate subject to consent, location, and Google's policies. You can choose Essential only in the consent prompt and review the Cookies page for browser storage details.

Cloudflare provides Workers, D1, security, and content delivery. Fal and Replicate process images for model inference. Yito Pay coordinates checkout and entitlement callbacks; Stripe or PayPal may process the selected payment. ZeptoMail sends login, contact, and operational email. Feishu receives bounded operational notifications. Google provides sign-in, Analytics, Search Console, and AdSense. click.pageview.click provides page analytics.

These providers may process information in countries outside your own. Their handling is governed by their terms and privacy commitments. Do not upload an image you lack permission to process, or regulated and highly sensitive content that is not suitable for these third-party inference services.

DepthCarve stores job metadata, fingerprints, and credit-ledger rows in D1. It does not store source images or production ZIP binaries. Provider asset links (raw EXR and related files) are temporary and typically expire in about one hour. Rebuild the same approved job without another debit while those links remain available. After they expire, keep the ZIP you already downloaded; DepthCarve will not re-run the provider or invent a second charge. Encrypted R2 history is not offered until paid users show material recovery demand.

Login codes expire after ten minutes and sessions after thirty days unless ended earlier. Account, ledger, order, entitlement, security, and contact records are retained only as needed to operate the service, meet legal obligations, prevent abuse, and resolve disputes.

You may request access, correction, deletion, or another applicable privacy right by contacting us. Some ledger, transaction, fraud-prevention, and legal records may need to be retained. We use HTTPS, secure HttpOnly session cookies, input validation, hashed credentials, strict origin checks, security headers, and bounded rate limits, but no internet service can promise absolute security.