Privacy Policy
What SteadyEdit collects, why, who processes it, and how long it is kept.
Last updated: 2026-10-31
SteadyEdit (https://steadyedit.app) is an independent product operated by an individual developer ("we", "us"). This policy explains what personal data we collect when you use SteadyEdit, why we collect it, who processes it on our behalf, and how long we keep it. Questions: support@steadyedit.app.
What we collect
Visitor session. Editing and buying credits does not require an account. We store an anonymous visitor id in a cookie, a hash of your private recovery code, and an encrypted copy of that code so this browser can show it again. The recovery code restores unexpired credits and images on another device.
Optional sign-in. An account is not required. If you sign in with Google, we receive your name, email address and profile picture.
Images and prompts. The photos and reference images you upload, the instructions you write, and the generated or edited images we produce.
Moderation records. For every safety check we record the result, the category flagged and the score, together with the prompt text or an identifier of the image that was checked.
Billing information. Your orders and credit balance. Card details are entered on our payment provider's checkout and never reach our servers. Older subscription records, if you have one from before credit packs, stay only as long as that purchase requires.
Reports and support messages you send us.
Technical data. Our hosting provider processes standard request data (IP address, browser type, time of request) to deliver and protect the website.
How we use it
- To provide the image tools: store your uploads, generate and edit images, show your request history and keep your credit balance on your visitor session.
- To keep the Service safe: screen prompts and images before and after editing, review reports, and enforce our Acceptable Use Policy.
- To process payments, refunds and billing questions.
- To answer support requests.
- To prevent fraud and abuse of the Service.
We do not sell your personal data, and we do not use your images, prompts or results to train AI models.
Legal basis
Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the editor, your visitor session, credits and version history | Performance of our contract with you |
| Processing payments, refunds and keeping billing records | Performance of our contract, and legal obligations (tax and accounting) |
| Screening prompts and images, reviewing reports, enforcing our policies | Legitimate interest in keeping the Service safe and lawful, and legal obligations where they apply |
| Preventing fraud and abuse | Legitimate interest in protecting the Service |
| Answering support requests | Performance of our contract, and legitimate interest |
Who processes your data
We use the following providers to run the Service. Each receives only what it needs for its task.
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare | Website hosting, database, image storage, email forwarding | All data stored by the Service |
| fal.ai | Runs MOSS-Image, FLUX 3 Klein, Ideogram 4.5 and image safety checks | Your uploads, reference images, prompts and results |
| Ideogram | Provider of the Ideogram 4.5 model, accessed through fal.ai | Images and prompts sent for editing |
| Waffo Pancake (Waffo.com Limited) | Merchant of Record: checkout, payments, tax, refunds; prompt safety screening | Visitor id, order and payment details; prompt text |
| Optional sign-in | Your Google account name, email and picture, only if you sign in | |
| Google Analytics | Measures page visits and how the site is used | Pages viewed, device and browser details, approximate location, and events such as starting an edit or checkout. Never your images, prompts or recovery code |
These providers may process data outside your country, including in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the safeguards these providers offer, such as the European Commission's Standard Contractual Clauses in their data processing terms, together with their security commitments.
How long we keep it
- Uploaded images, reference images, results and edit history: 72 hours, then the files are overwritten and deleted. Please download anything you want to keep.
- Moderation records: up to 12 months, so we can review decisions, handle appeals and meet our payment provider's requirements.
- Billing records: as long as required by tax and accounting law.
- Visitor session and recovery code: while you use the Service, and deleted within 90 days after you ask us to delete the session. Credits expire 30 days after they are added, whether or not the session row is still there.
Cookies and local storage
We use an httpOnly cookie (se_visitor) so a refresh keeps your visitor session. Your browser also stores your theme preference and the most recent request id for each image tool so you can return to a running request. Before checkout, we save your current tool prompt, settings and selected source image in this browser's IndexedDB so you can continue after payment. This draft is removed after it is restored; you can also clear it through your browser's site data settings. We use Google Analytics cookies to measure visits and how the site is used. If you are in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, Google Analytics does not load unless you accept it. You can change your answer at any time under Cookie settings in the site footer; declining stops measurement and removes those cookies. Your answer is kept in this browser for up to a year. Elsewhere you can block these cookies in your browser settings or with Google's opt-out add-on. We do not use advertising cookies. The recovery code is shown in the editor so you can copy it; it is not stored in a cookie.
Your rights
You can ask us to access, correct, export or delete your personal data, or object to how we use it, by emailing support@steadyedit.app. Include your recovery code if you have one, so we can find the session. We respond within 30 days. Depending on where you live you may also have the right to complain to your local data protection authority.
Children
SteadyEdit is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has used the Service, contact us and we will delete the session.
Security
Data is transmitted over HTTPS. Stored images are kept under random identifiers and are served only to the visitor session that owns them, and only during the 72-hour window. Access to admin tools is restricted to the operator.
Changes to this policy
We will post any update on this page and change the date above.
Contact
- Operator: SteadyEdit, an independent individual developer
- Email: support@steadyedit.app