Privacy policy

The company below is the controller of your personal data: it decides how and why it's used. For anything about privacy, write to privacy@outwow.app.

We will name our representative in the EU (GDPR art. 27) here once they are appointed. Until then, people in the EU can write to us directly at privacy@outwow.app.

We don't collect your precise location. We remove GPS coordinates and camera details from every photo when it's uploaded.

Under the EU and UK GDPR we need a legal basis for each use of personal data. These are ours:

We don't make decisions about you by automated means that have legal or similarly significant effects. Our content filters are automated, and you can always ask a person to review what they decided through an appeal.

• Uploads are deleted within 24 hours, automatically. Photos of children follow the same schedule and are used for nothing except the result you asked for.
• Results stay in My photos for your plan's history window — Free and Weekly Pass: 7 days; Mini: 30 days; Basic: 90 days; Premium and Ultra: 12 months — and are then deleted. You can delete any result sooner.
• No training. We don't use your photos, prompts or results to train, fine-tune or evaluate AI models, and we won't start without asking for your separate, specific consent.
• No faceprints. We don't create or store biometric identifiers or face templates. See the biometric data policy.
• No advertising. Nothing learned from your photos is used for ads, audiences or profiling.
• Who sees them. Only you, unless you share a link. Our staff open a photo or result only to handle a report, an appeal or a support request, or to run a safety check.

To make a result, we send the photo, the template or tool instructions and your prompt to an AI model provider, which returns the generated image. Our providers are based in the United States. We work only with providers that commit not to use the data we send to train their models.

Providers may keep inputs for a short time to detect abuse, under their own terms. We delete uploads from our storage within 24 hours; what each provider keeps, and for how long, is on the subprocessors page.

We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We share it only with:

• Service providers that host, store, send email, process payments or generate images for us, under contracts that limit them to our instructions. The current list is on the subprocessors page.
• Authorities, when the law requires it — for example reports of child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), or a valid court order.
• A buyer or successor, if the business is sold or merged. This policy keeps applying to your data.
• Anyone you choose, when you share a link to a result.

Our providers are based in the United States, so your data is processed there. For transfers from the EU, the UK and Switzerland we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework where a provider is certified. You can ask for a copy of these safeguards at privacy@outwow.app.

Wherever you live, you can do these yourself:

• Download your data. In Account, select Download my data for a copy in a machine-readable file (JSON).
• Delete your account. In Account, select Delete account. The delete account page explains what's removed.
• Correct your details. Change your name and email preferences in Account, or ask us.
• Stop marketing emails. Use the unsubscribe link in any of them, or switch them off in Account.

For anything else, email privacy@outwow.app from the address on your account. We reply within one month (45 days for California requests), may ask you to confirm it's you, and don't charge for it.

EU and UK

You have the right to access your data, to have it corrected or erased, to restrict or object to its use (including use based on legitimate interests), to receive it in a portable format, and to withdraw consent at any time without affecting what happened before. You can complain to the data protection authority where you live or work — in the UK, the Information Commissioner's Office (ico.org.uk).

California and other US states

We collect these categories of personal information: identifiers (email and IP address); customer records (name and billing details); commercial information (plans bought); internet activity (log and usage data); electronic and visual information (the photos you upload and your results); and sensitive personal information limited to your account login. We collect them from the sources and for the purposes described above, and disclose them for business purposes only to the service providers listed on the subprocessors page.

We don't sell or share personal information — including that of consumers under 16 — and we use sensitive personal information only to provide the service, so there's nothing to opt out of or limit. We treat a Global Privacy Control signal as an opt-out request anyway.

You have the right to know what we collect and how we use it, to access, correct and delete it, and not to be treated differently for using these rights. An authorized agent can make a request for you; we'll ask for your signed permission and may ask you to confirm your identity. Residents of Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws have similar rights. If we decline a request, reply to our answer to appeal, and a different person will review it.

Outwow is for adults. We don't knowingly collect personal data from anyone under 18, and we delete it if we find out we have. If you think a child has an account, write to privacy@outwow.app.

Parents and legal guardians can upload photos of their own children to templates made for families, after confirming they're the child's parent or guardian. These photos are deleted within 24 hours. Results that show a child are never used in our marketing, and nothing about a child is used for advertising or profiling.

We use a few first-party cookies to keep you logged in and remember your settings, and one to learn where visitors come from. We don't use advertising cookies. The cookie policy lists each one.

We protect your data with encrypted connections (HTTPS), passwords stored only as salted scrypt hashes, login links that work once and expire, production access limited to the people who need it, and a log of administrative actions. No system is perfectly secure. If a breach affects your data, we'll tell you and the relevant authorities as the law requires.

When we change this policy we update the date at the top. If a change is significant — for example a new use of your photos — we email you before it takes effect and, where the law requires it, ask for your consent.

Email privacy@outwow.app, or write to us at the registered address above.