Privacy Policy

We collect:

• Account information: email address, authentication data (via Clerk), and account settings.
• User Content: reference images you upload, text prompts, and generated images/videos.
• Usage and technical data: IP address, device/browser information, timestamps, pages viewed, generation history, and similar logs.
• ToS acceptance records: User ID/email, timestamp, IP address, Terms version accepted, and related technical identifiers.
• Payment information: processed by Sora Labs Ltd and its payment partners (card payments), NowPayments (crypto), and Telegram (Telegram Stars). We receive the transaction status, amount, and a payment reference. We do not store full payment card numbers or crypto private keys.
• Communications: messages you send to support or abuse/reporting channels.

We use information to:

• Provide, operate, and improve the Service;
• Process generations and deliver outputs;
• Process payments and manage credits;
• Enforce our Terms, detect and prevent abuse, fraud, CSAM, and non-consensual intimate imagery;
• Monitor prompts and outputs for safety and legal compliance;
• Comply with law (including reporting to NCMEC and responding to lawful requests);
• Communicate with you about the Service;
• Maintain records of Terms acceptance.

We share information with:

• Service providers that help us operate the Service (e.g., RunPod for compute, BunnyCDN for storage/delivery, Railway and Cloudflare for hosting/infrastructure, Clerk for authentication, Google Analytics for usage analytics, and similar providers). These providers process data on our instructions.
• Payment processors: Sora Labs Ltd and its acquiring and payment partners for card payments, NowPayments for crypto payments, and Telegram for Telegram Stars. They receive the information needed to process, secure, and reconcile your payment, and to handle fraud checks, disputes, and chargebacks.
• Law enforcement and authorities when required by law or to protect rights, safety, or in response to valid legal process (including CSAM reporting).
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell your personal information.

• Data is processed and stored using providers that may be located in the United States, the United Kingdom, and other jurisdictions (RunPod availability, BunnyCDN, Railway USA, Cloudflare, and Sora Labs Ltd for card payments).
• Uploaded reference images and generated outputs remain available while your account exists (or longer if required for legal, safety, or dispute reasons).
• We may retain logs, ToS acceptance records, and data related to violations or legal holds for longer periods as needed for security, abuse prevention, and legal compliance.
• When you delete your account, we will delete or anonymize personal data within a reasonable period, except where retention is required or permitted by law or for legitimate business purposes (e.g., fraud prevention, legal claims).

If you upload an image containing a face to our image-to-prompt tool, we process it only to produce a text description of the scene and to screen it for prohibited content; it is not used to generate content. Generated character images are analysed to extract descriptive traits and estimate apparent age. We do not create or store long-term biometric templates for identification of individuals across the Service. You are solely responsible for ensuring you have the right to upload any facial images.

We and our providers use cookies, local storage, and similar technologies for authentication, security, analytics, and Service functionality. We group cookies into two categories:

• Strictly necessary (always on): keeping you signed in (Clerk), storing your cookie choices (“onlynudes_consent”, 180 days), remembering that you confirmed you are 18 or older (“age_verified”, 1 year), and remembering the referral link you arrived from (“ref_code”, 7 days).
• Statistics (optional): Google Analytics cookies (“_ga” and “_ga_” followed by our property ID, up to 2 years) that help us understand how the Service is used. If you are in the European Economic Area, the United Kingdom, or Switzerland, these cookies are set only after you accept them.

We do not currently use marketing or advertising cookies.

You can change your choice at any time through the “Cookie settings” link in the site footer or in your account menu. You can also block or delete cookies in your browser settings, although the Service may not work properly without strictly necessary cookies.

Depending on your location, you may have rights to access, correct, delete, or export certain personal data, or to object to or restrict certain processing. To exercise rights, contact legal@onlynudes.ai. We will respond as required by applicable law. Note that some data (e.g., generation history needed for abuse investigation or legal holds) may not be deletable in all cases.

You may close your account by contacting us.

We implement reasonable technical and organizational measures to protect data. No method of transmission or storage is 100% secure.

The Service is operated from the United States, and card payments are processed in the United Kingdom by Sora Labs Ltd. If you access the Service from elsewhere, you consent to the transfer and processing of your information in the United States, the United Kingdom, and other countries where our providers operate, which may have different data-protection rules.

The Service is not directed to anyone under 18. We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.

We may update this Privacy Policy. We will post the updated version and revise the “Last Updated” date. Continued use after changes constitutes acceptance where permitted by law.

For privacy questions or requests: