Privacy policy

The company below is the controller of your personal data: it decides how and why it's used. For anything about privacy, write to privacy@outwow.app.

We will name our representative in the EU (GDPR art. 27) here once they are appointed. Until then, people in the EU can write to us directly at privacy@outwow.app.

We don't collect your precise location. For site statistics we work out an approximate location, no finer than a city, from your IP address, using a copy of the DB-IP database on our own servers (IP geolocation by DB-IP); your IP address isn't sent to them. We remove GPS coordinates and camera details from every photo when it's uploaded.

Under the EU and UK GDPR we need a legal basis for each use of personal data. These are ours:

We don't make decisions about you by automated means that have legal or similarly significant effects. Our content filters are automated, and you can always ask a person to review what they decided through an appeal.

Besides the emails you ask for, such as login links and receipts, we send a few automatic ones:

• Reminders to confirm your email, about an hour and about a day after you sign up, if you haven't confirmed it yet. Each one has a new confirmation link.
• A deletion notice, a day or two before results on the Free plan that you never downloaded or shared are deleted. It says what will be deleted and when, and doesn't advertise a plan.
• One email suggesting a first photo, about a day after you confirm your email, if you're on the Free plan, haven't made a photo yet and still have free photos. This one is marketing: we send it only if you agreed to news by email, except to accounts whose country is the United States, which get it unless they unsubscribed.
• One email about free photos you haven't used, a day or two after the last photo you made, if you're on the Free plan, haven't made anything since and still have free photos. It names one template to try next. It's marketing too, with the same rule as the first-photo email.

Apart from the first confirmation reminder, they go out between 9:00 and 20:00 in the capital of the country on your account, or New York time if we don't have your country.

Each of them has an unsubscribe option your email app can use in one click, and a link at the bottom: “Unsubscribe from news” on marketing emails, “Manage emails” on the others. Unsubscribing in one click from a confirmation reminder or a deletion notice stops the rest of that kind of email and our news emails.

If an email to your address bounces permanently, or you mark one as spam, we stop sending you these automatic emails. We keep a record of which of these emails we sent you, so you don't get the same one twice.

• Uploads are deleted within 24 hours, automatically. Photos of children follow the same schedule and are used for nothing except the result you asked for.
• Results stay in My creations for your plan's history window — Free and Weekly Pass: 7 days; Mini: 30 days; Basic: 90 days; Premium and Ultra: 12 months — and are then deleted. You can delete any result sooner.
• No training. We don't use your photos, prompts or results to train, fine-tune or evaluate AI models, and we won't start without asking for your separate, specific consent.
• No faceprints. We don't create or store biometric identifiers or face templates. See the biometric data policy.
• No advertising. Nothing learned from your photos is used for ads, audiences or profiling.
• Who sees them. Only you, unless you share a link. Our staff open a photo or result only to handle a report, an appeal or a support request, or to run a safety check.

To make a result, we send the photo, the template or tool instructions and your prompt to an AI model provider, which returns the generated image. Our providers are based in the United States. We work only with providers that commit not to use the data we send to train their models.

Providers may keep inputs for a short time to detect abuse, under their own terms. We delete uploads from our storage within 24 hours; what each provider keeps, and for how long, is on the subprocessors page.

We don't sell your personal information. Unless you turn ad cookies off (in the EU, the EEA, the UK and Switzerland, only if you accept them), we share signup, free-trial start and purchase events with Meta, TikTok and OpenAI to measure our ads (see Cookies below). Beyond that we share it only with:

• Service providers that host, store, send email, process payments or generate images for us, under contracts that limit them to our instructions. The current list is on the subprocessors page.
• Authorities, when the law requires it — for example reports of child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), or a valid court order.
• A buyer or successor, if the business is sold or merged. This policy keeps applying to your data.
• Anyone you choose, when you share a link to a result.

Our providers are based in the United States, so your data is processed there. For transfers from the EU, the UK and Switzerland we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework where a provider is certified. You can ask for a copy of these safeguards at privacy@outwow.app.

Wherever you live, you can do these yourself:

• Download your data. In Account, select Download my data for a copy in a machine-readable file (JSON). It includes your product activity and the list of automatic emails we sent you.
• Delete your account. In Account, select Delete account. The delete account page explains what's removed.
• Correct your details. Change your name and email preferences in Account, or ask us.
• Stop marketing emails. Use the unsubscribe link in any of them, or switch them off in Account. If your account's country is the United States and you never turned news on, Account already shows news as off, so use the unsubscribe link in the email to stop the first-photo email and the one about free photos you haven't used.

For anything else, email privacy@outwow.app from the address on your account. We reply within one month (45 days for California requests), may ask you to confirm it's you, and don't charge for it.

EU and UK

You have the right to access your data, to have it corrected or erased, to restrict or object to its use (including use based on legitimate interests), to receive it in a portable format, and to withdraw consent at any time without affecting what happened before. You can complain to the data protection authority where you live or work — in the UK, the Information Commissioner's Office (ico.org.uk).

California and other US states

We collect these categories of personal information: identifiers (email and IP address); customer records (name and billing details); commercial information (plans bought); internet activity (log and usage data, product activity and site statistics); approximate geolocation (country, region or city from your IP address); electronic and visual information (the photos you upload and your results); and sensitive personal information limited to your account login. We collect them from the sources and for the purposes described above, and disclose them for business purposes only to the service providers listed on the subprocessors page.

We don't sell personal information. Unless you opt out, we share signup, free-trial start and purchase events with Meta, TikTok and OpenAI, which the CCPA calls “sharing” for cross-context behavioral advertising. To opt out, choose “Reject” in “Cookie settings” at the bottom of any page; a Global Privacy Control signal opts you out automatically and the ad tags never load. Accounts are for adults only, and we use sensitive personal information only to provide the service.

You have the right to know what we collect and how we use it, to access, correct and delete it, and not to be treated differently for using these rights. An authorized agent can make a request for you; we'll ask for your signed permission and may ask you to confirm your identity. Residents of Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws have similar rights. If we decline a request, reply to our answer to appeal, and a different person will review it.

Outwow is for adults. We don't knowingly collect personal data from anyone under 18, and we delete it if we find out we have. If you think a child has an account, write to privacy@outwow.app.

Parents and legal guardians can upload photos of their own children to templates made for families, after confirming they're the child's parent or guardian. These photos are deleted within 24 hours. Results that show a child are never used in our marketing, and nothing about a child is used for advertising or profiling.

We use a few first-party cookies to keep you logged in and remember your settings, one to learn where visitors come from, and ad and analytics cookies from Meta, TikTok and OpenAI. In the EU, the EEA, the UK and Switzerland we set the measurement and ad cookies only if you choose “Accept”; elsewhere you can turn them off in Cookie settings. The cookie policy lists each one. We also count visits without setting a cookie for it; if you're logged in, we read the login cookie only to note logged in yes or no (see “Site statistics” above). “Reject” in Cookie settings turns that off too.

We protect your data with encrypted connections (HTTPS), passwords stored only as salted scrypt hashes, login links that work once and expire, production access limited to the people who need it, and a log of administrative actions. No system is perfectly secure. If a breach affects your data, we'll tell you and the relevant authorities as the law requires.

When we change this policy we update the date at the top. If a change is significant — for example a new use of your photos — we email you before it takes effect and, where the law requires it, ask for your consent.

Email privacy@outwow.app, or write to us at the registered address above.