SERVICE INFORMATION

Privacy policy

Last updated: October 9, 2026. ZHAO JUNSHI, an individual operating LoftNum Studio under the LoftNum brand in China, is responsible for the information described here. Privacy contact: support@loftnumstudio.com.

Information and purposes

When you use an account, we process your email, account and request identifiers, credit balances, payment references, prompts, images and support messages to provide the service and resolve billing or delivery problems. We use hashed IP-based counters, sign-in verification and request limits to prevent abuse. We do not receive or store full payment-card details.

Where a legal basis is required, providing accounts, images and purchased credits is necessary to perform our agreement with you; fraud prevention and service reliability serve our legitimate interests; mandatory recordkeeping is a legal obligation. We do not sell personal information or use your private images in our public gallery without permission.

Service providers and locations

Cloudflare provides hosting, private image storage, security checks, email delivery and page-performance statistics. Supabase provides our database in the United States. To generate or edit an image, fal.ai and Ideogram receive the prompt and any input image. Waffo Pancake handles payment information and checkout. Prompt Sift receives prompts for safety checks; fal.ai receives input and output images for NSFW checks. Moderation outcomes and provider references are reviewed for deletion 12 months after resolution, except records required for disputes or legal obligations. Support email is forwarded to our operator mailbox hosted by Google. These providers may process data internationally and retain their own records under their policies.

Provider policies: Cloudflare, Supabase, fal.ai, Ideogram, Waffo Pancake and Google. Contact us about the safeguards applicable to a particular transfer.

Cookies and statistics

An essential session cookie keeps you signed in for up to seven days. Cloudflare Web Analytics measures visits and page performance without tracking individuals across sites. Google Analytics 4 loads only after you choose Allow analytics. It uses an analytics cookie lasting up to 180 days to measure visits, general device information, use of page sections, sign-in completion, example views, checkout steps and generation outcomes. For confirmed purchases it receives a random order reference, product, currency and purchase value (excluding tax); it does not receive prompts, images, filenames, account emails, sign-in codes, card details or billing identities. We do not record mouse movements or session replays. Advertising features and automatic form tracking are disabled. We omit URL queries and fragments. You can withdraw consent using Privacy choices at the bottom of any page. Your choice is saved on this device for 180 days. Google may process statistics in the United States and other countries. We currently use no advertising pixels.

Retention

• Image files: available for seven days, then removed by scheduled cleanup; private storage also has an eight-day expiry rule. Download images you want to keep.
• Completed request prompts: removed after 90 days. Unresolved requests remain until investigated.
• Sign-in codes: expire after ten minutes; sessions after seven days; abuse counters expire within 30 days.
• Account information: while the account remains active. Verified closure requests are normally processed within 30 days, after resolving any remaining paid credits.
• Order and credit records: three years after the related transaction, or longer where a legal recordkeeping obligation or unresolved dispute requires retention. Only necessary records are retained after account closure.
• Support correspondence: reviewed for deletion after 12 months from resolution, except records needed for an ongoing dispute or legal obligation.

Financial and support retention is handled by the operator, separately from automatic image cleanup. Provider backups and legally required provider records may follow different schedules.

Your choices and rights

Email support to request access, correction, export, deletion or account closure, or to object to or restrict processing where applicable. We may need to verify your account first. We aim to respond within 30 days and will explain any lawful exception or extension. You can contact your local privacy regulator if you believe your rights have not been respected.

Security and age

We use HTTPS, private image access, hashed sign-in codes and restricted database permissions. No service can guarantee absolute security. We will notify affected people and authorities of qualifying incidents as required by applicable law. The service is for adults aged 18 or over. Contact us if a minor has provided information.

Changes

Material policy changes will be announced here before they apply. The date above identifies the current version.