Privacy Notice

Information collected

Account and authentication data includes email, auth identifiers, email-confirmation status and limited account/profile information managed through Supabase. Nodren also records launch reservations, founding-reward eligibility/history, beta/product access, generation suspension and operator membership or administrative audit records.

Legal acknowledgement records contain the authenticated account identifier, document/version identity, acknowledgement time and context (account acknowledgement, made after signup or at a later product entry, or checkout). Account acknowledgement includes a separate versioned record that you affirmed being at least 18. This evidence does not store your IP address, device details, date of birth or age; the 18+ control is an affirmation, not identity or age verification.

Creation data includes prompts, model/settings selections, uploaded images and references, generated media, generation/job status and history, output URLs and operational provider-attempt metadata. Request, security and hosting logs can include IP addresses, user-agent/request metadata, identifiers, error diagnostics and timestamps.

Billing records include purchase and Stripe payment/session identifiers, credit balances and transactions, reservations, refunds, dispute/debt or restriction records. Stripe processes payment details in its hosted Checkout; Nodren does not collect full card details through its own credit-purchase form.

Browser-local Studio data includes account-scoped prompts, references/URL history, draft settings and convenience state. Global non-content preferences may be shared within a browser profile. Sign-out hides account-local state from other accounts in the product; it does not physically erase or encrypt everything stored in that browser profile.

How information is used

Nodren uses information to authenticate accounts, provide access and reservations, fulfill generation requests, deliver/store outputs, show history, operate billing/credit accounting, investigate abuse and security incidents, respond to support requests and maintain product reliability.

Legal acknowledgement history documents which current Terms and notices you explicitly agreed to or acknowledged. Privacy acknowledgement is not blanket consent to optional marketing, analytics or model training.

Cloudflare analytics/performance measurement is currently present at the edge. Reliability and usage measurement may help improve the product. This notice does not imply that a granular analytics opt-in/preference system or advertising tracker exists.

Services involved in processing

Authentication/database: Supabase manages authentication and stores Nodren’s account, reservation, access, job and accounting records. Hosting/logging: Railway runs the application and retains operational/request logs. Storage/CDN and edge infrastructure: Cloudflare R2 and the media domain deliver durable outputs, with Cloudflare edge/analytics measurement.

AI/model fulfillment: available options may use integrations such as FAL, Replicate, WaveSpeed or Runway when enabled. The selected model service receives the prompt, required settings and reference content or URLs needed to fulfill that request; provider-hosted reference uploads and operational request/attempt metadata may also be involved. These integrations are not a guarantee that every provider or model is currently available.

Payments: Stripe receives Checkout/payment information and transaction identifiers. Support requests disclose the information you choose to send through the configured contact inboxes; do not send passwords or full card details.

Third parties may process information under their own terms and operational practices. Nodren has not verified a universal provider retention or training guarantee and does not assert one. Processing locations can differ from your location; worldwide availability is not a promise that your data stays within your country.

Model training

Nodren does not use customer prompts, uploads or outputs to train models unless the user explicitly opts in. No Nodren model-training opt-in is currently offered. This is Nodren’s own rule, not a representation about all third-party provider training, retention or reuse practices.

Media access and disclosure

Current durable output URLs are link-accessible, not authenticated private media. Anyone who obtains a URL may be able to access or redistribute its content. Provider-hosted uploads/outputs have provider-controlled access and lifetimes. Browser previews are not a private cloud-storage guarantee.

Account ownership protects database/history reads, but does not protect an already-issued public media link. Private/signed delivery is a future feature, not current behavior. Nodren may disclose relevant records to service providers for fulfillment and to investigate fraud, enforce acceptable use or comply with legally required requests.

Retention and deletion

Account/generation data is generally retained while the account exists. No fixed automatic account-generation deletion schedule is currently implemented. You may request deletion through the privacy contact; requests require review and identity verification rather than an in-app deletion button.

Financial, security, audit and legal acknowledgement records may be retained where legally or operationally required. Provider, backup and log copies may persist according to applicable operational/vendor retention.

Routine operational log retention target: 30 days. This is an operational target, not a guarantee that all copies are deleted after 30 days. Financial, security, audit, backup and provider records may follow separate retention requirements.

Remove from history, Remove reference and similar controls remove local entries or record associations. They do not necessarily erase durable jobs, R2 objects, provider-hosted media or logs. Existing link-accessible URLs may remain accessible after such an action.

Your choices and requests

Use the privacy contact in Help to request access, correction, account/data deletion or an export, or ask about privacy rights applicable to you. Describe the request and the account email; Nodren may ask for reasonable verification. Do not send your password. Applicable-law rights are not limited by the lack of a self-service interface.

Complete data export, account deletion, email/password changes and hosted-generation/media deletion are not self-service controls today. Media download and local history/reference management are available where shown. Requests and any required record-retention exceptions are handled manually; no unimplemented automated workflow or response deadline is promised.

Notice administration

Publication status and Policy administration show the approved document-set details. Legal operator identity and required contact particulars must be confirmed before publication. Contact privacy support for questions or concerns. Changes to material data practices should be reflected in this notice and communicated where required.