ToolOrbit AI Privacy Policy

1. Information we collect

Account and identity information

Your email address, username, password hash, email verification status and, when you choose Google sign-in, the verified email and basic profile returned by Google. We do not store your Google password.

Creative content and service data

Prompts, selected models and parameters, uploaded reference images, generated results, task status, generation history, and Credit changes and subscription periods recorded for billing.

Security and operational information

Session identifiers, request times, necessary network source information, error logs and verification-code sending records. Verification codes are stored only as irreversible hashes, never in plain text. Sending records used for rate limiting are periodically cleared according to implementation rules.

2. How we use information

• Create and verify accounts and provide sign-in, password recovery and account security.
• Submit generation requests to model services, return results and save generation history.
• Calculate Credits and manage task reservations, subscription periods and account balances.
• Prevent fraud, mass registration, abuse, attacks and other security risks.
• Investigate faults, improve the product experience and meet legal obligations.

3. Third-party processing and sharing

To provide the service, we may transmit necessary information to these providers:

• Image and text model providers process prompts, reference images and generation parameters. Current image model vendors include OpenAI, xAI, Alibaba (Qwen), Zhipu and ByteDance. Refer to the model shown in the workspace when submitting a task.
• Cloud infrastructure, database and file storage providers operate the service and store necessary data.
• Google authenticates you when you choose Google sign-in.
• Resend sends registration verification and password reset emails.
• Waffo Pancake processes your email address, order number, product, amount, currency and payment status when you make a purchase. We do not receive or store card numbers, complete payment credentials or payment passwords.

We do not sell your personal information. We do not disclose it to unrelated third parties unless you authorize it, it is necessary to provide the service, or it is required by law.

4. Retention

Account information is retained while your account remains active. Subscription and Credit records are retained as necessary to provide the service, resolve disputes and reconcile finances. Actual retention of generation history and images depends on the account page and service capabilities; permanent storage is not currently promised.

Email verification codes are valid for 10 minutes and allow a limited number of attempts. Code-sending and security records are retained as needed to prevent abuse and periodically cleared. Legal requirements, disputes or security investigations may require longer retention of some information.

5. Security measures

We use password hashing, HttpOnly session cookies, access controls, single-use verification codes, request rate limiting and database transactions to protect information. No internet service can guarantee absolute security. Do not share your password, verification codes or API keys with others.

6. Your rights

You can view or change your username, view account and Credit information, and change or reset your email-based password in your account settings. Self-service account deletion and bulk data export are not currently available. Requests to access, correct or delete data require identity verification and are handled according to applicable law and security, financial and dispute-resolution requirements.

7. Minors

If you have not reached the age required to give independent consent where you live, use this service with your guardian's consent and guidance. We do not knowingly collect personal information from minors in circumstances that do not meet applicable legal requirements.

8. Policy updates and contact

When processing purposes, information categories or third-party services change materially, we will update this policy and provide reasonable notice. For privacy or data-rights questions, email luowj1998@gmail.com or visit our Contact us page.