1. Information we handle

• Photos and generated images. Youie uses one photo. Twoie uses a subject photo and a background photo. The Service processes these images and the resulting image. A selected photo stays in your browser’s local draft storage for up to two hours before submission; it is sent to our server only after you start generation.
• Account and profile details. If you sign in with Google, we receive account details made available through that sign-in, such as your name, email address, and profile image. Your point5 profile can also store the name you set and your image-history preference.
• Job and usage details. We create an internal job identifier and keep workflow/status timestamps, image dimensions and sizes, result references, and generation-limit counters to deliver the edit, show your account history, and protect the Service from abuse.
• Technical and cookie data. The Service uses sign-in cookies and an opaque, first-party session cookie for job ownership, rate-limiting, and daily usage controls. The server stores a hash of the anonymous session identifier. Hosting and security infrastructure may process request, device, and network metadata to operate and protect the website.

We do not ask for a free-text image prompt. The edit instruction and selected model are controlled by the Service. Server intake checks and normalizes images, applies orientation, converts accepted inputs to JPEG, and removes embedded image metadata such as EXIF data before storage and provider processing.

2. How we use information

We use the information above to:

• authenticate accounts and provide requested image edits and downloads;
• show private generation history when you choose to retain it;
• apply daily usage allowances, rate limits, and concurrent-job limits;
• maintain, troubleshoot, secure, and prevent abuse of the Service; and
• meet legal obligations and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, processing may be necessary to provide the Service you request, to pursue legitimate interests in security and reliable operation, to comply with law, or to act on consent where consent is required. The applicable basis depends on your location and the specific processing.

3. Who receives information

We disclose information only as needed to operate the Service, protect users, or meet legal requirements. Current or configured infrastructure providers include:

• Google, when you choose Google sign-in;
• Supabase, for authentication, profile, usage, and account-history records;
• Vercel, for application hosting and server execution;
• Cloudflare R2, for private image and job-object storage when configured;
• Upstash, for distributed rate limits, usage controls, and temporary job state when configured; and
• the selected image provider, OpenAI or AIHubMix, to perform an image edit.

These providers process information under their own terms and privacy practices, and some may process it in countries other than yours. We may also disclose information if required by law or when reasonably necessary to protect people, rights, or the Service. The current application does not include advertising, a payment checkout, or an analytics SDK.

Provider references: Google Privacy Policy, Supabase Privacy Policy, Vercel Privacy Notice, and Cloudflare Privacy Policy.

4. AI image processing

When generation is enabled and you request an edit, the Service sends the normalized input image or images and a server-controlled instruction to the selected provider. The provider returns an image that we validate before making it available to you. We do not use customer photos or outputs to train a point5 model. This statement does not control any separate handling by the selected provider under its own terms, including safety, abuse-prevention, or retention practices.

OpenAI describes API data handling and retention controls in its API data controls documentation. The provider may change based on deployment configuration; review the selected provider’s current terms before submitting sensitive images. AI edits can be inaccurate or change details, and should not be treated as a verified record of an event.

5. Storage, retention, and deletion

• Browser drafts: captured or selected images are kept in browser-local storage for up to two hours to support the capture flow. The browser or device may remove that data sooner.
• Standard generation: original and result images and their storage references have a 24-hour expiry target after upload. A scheduled cleanup sweep deletes expired objects and scrubs their storage references; because the sweep runs periodically, deletion can happen after the target time rather than at the exact hour. Limited generation metadata may remain for service analytics. Private storage and a secondary storage lifecycle rule are deployment requirements.
• Optional account history: signed-in users can choose to retain future generations in their profile. Those items are configured for long-term retention rather than the standard 24-hour expiry. Turning this setting off applies to future generations; it does not delete items already retained.
• Account and security records: profile, authentication, usage, and limited job metadata are kept while needed to operate the account, enforce limits, resolve issues, and meet legal requirements. The anonymous session cookie has a configurable lifetime; loss of that cookie can make an anonymous job inaccessible.
• Optional generation feedback: ratings and optional text comments are used to evaluate service quality. Do not include names or other personal details in comments. Feedback is stored with generation history; deleting an individual history item also deletes its feedback. If you close your account, image files and direct account links are removed, while scrubbed generation and feedback records may be retained for up to 12 months for analytics before deletion.

The current interface does not provide a self-service control to delete an individual saved image or close an account. A privacy request can be made to the point5 operator using its published contact details, but a contact address is not currently configured on this site. Do not email photos or other sensitive image files. Deletion may be delayed by scheduled cleanup, provider retention, backups, or legal obligations.

6. Your choices and privacy rights

You can decline camera permission, keep a photo on your device without submitting it, use the upload alternative, and choose whether new generations are retained in your signed-in history. You can update your display name and history preference in your profile. You can revoke Google access through your Google account and sign out of point5.

Depending on where you live, applicable law may give you rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, or to complain to a regulator. Requests may require identity verification and may be subject to lawful exceptions. The way to submit a request must be published by the operator before the Service accepts public images.

7. Security and children

The application is designed to keep image buckets private, limit image access to the job owner, remove unnecessary image metadata, and avoid putting image bytes, raw session identifiers, or signed image links in application logs. No internet service can guarantee absolute security. Do not upload images you are not comfortable sending to the selected AI provider.

The Service is intended for adults aged 18 or older and is not directed to children. If you believe a child has provided account information or an image without appropriate authorization, contact the point5 operator through a published privacy contact so it can be reviewed.

8. Changes and contact

We may update this policy as the Service, providers, or legal requirements change. We will update the date above and provide additional notice when required by law. The operator’s legal identity, postal address, privacy contact, and applicable legal jurisdictions have not been provided in the project materials. Those details must be added here and reviewed before this page is treated as a final legal notice.