Summary
We collect the minimum data needed to run your account and generate your content. We do not sell your data, we do not use advertising trackers, and you can delete your content at any time.
Information we collect
- Account details: your name and email address. If you sign up with a password, we store only a salted bcrypt hash, never the password itself. If you use Google sign in, we store your Google account ID and profile picture URL.
- Content: the source material you submit, the outputs we generate, your favorites, video prompts, and links to videos generated for you.
- Usage data: your plan, credit balance, and timestamps of generations.
- Contact messages: the name, email, topic, and message you send through the contact form, plus the IP address used to send it.
- Technical data: IP addresses and basic request logs that our servers and hosting providers record to keep the Service secure and working.
How we use it
- To create and secure your account and keep you signed in.
- To generate content and videos, and to show your history.
- To meter credits and prevent abuse such as automated signups or spam.
- To reply to messages you send us.
- To fix bugs and improve the Service.
Service providers
We share data only with providers that help us run the Service, and only what each one needs:
- Neon: hosts our Postgres database, where your account and content are stored.
- Groq: processes your source material to generate text. Your input and the generated output pass through Groq's API.
- fal.ai: renders AI videos from your video prompts when you use the video generator.
- Google: verifies your identity when you choose Google sign in.
- Vercel and Render: host the website and API and may record request logs.
Retention and deletion
We keep your account and content until you delete them. You can delete any generation or finished video from your dashboard at any time, and it is removed from our database. To delete your entire account and all associated data, send a request through the contact page and we will complete it within 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. Send a request through the contact page and we will respond within 30 days.
Security
We protect your data with hashed passwords, signed session tokens, encrypted connections, and strict per-account access checks. The security page describes these measures in detail.
Children
Refract is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
Changes
If we change this policy we will update the date at the top of this page. Material changes will be highlighted on the site or sent by email.
Contact
Privacy questions and requests can be sent through the contact page at /contact.