Privacy Policy

Introduction

This Privacy Policy explains what information Tiny Desk AI ("we", "us") collects when you use the website tinydeskai.studio and its video generation service (the "service"), how we use it, and who we share it with. It applies to all visitors and account holders. Contact: support@tinydeskai.studio.

Information We Collect

1. Account information: your name, email address, and profile details you provide or that your sign-in provider (for example, Google) shares with us when you create an account. If you buy without an account (guest checkout), we create an anonymous guest account kept in your browser by a sign-in cookie, and Waffo Pancake sends us the email address you enter at checkout.
2. Photos you upload: the images you submit to generate a video. These may show your face and body.
3. Generated content: the illustrated reference images and videos created from your photos.
4. Payment information: records of your purchases, such as order amount, date, and status. Payments are processed by Waffo Pancake, our online reseller and Merchant of Record. We do not receive or store your full card or bank details.
5. Usage and device data: information such as pages visited, features used, browser type, and device type.
6. Cookies: small files used to keep you signed in, remember your language, and, when analytics is enabled, measure site usage.

How We Use Your Information

• To generate videos from your photos and deliver them to you.
• To create and manage your account and credit balance.
• For guest checkout: to email you your video and how to get back to it, using the email you entered at checkout, and to send sign-in links you request on Find my videos.
• To process payments and send purchase confirmations.
• To detect and prevent fraud, abuse, and violations of our Terms of Service.
• To respond to support requests and content reports.
• To understand how the service is used and improve it.

We do not use your photos to identify you, we do not use them to train AI models, and we do not sell your personal information.

How Your Photos Are Processed

To generate a video, we first send your uploaded photos (1 to 5) to a third-party AI API provider, APIMart. It uses Nano Banana 2 (Google's Gemini 3.1 Flash Image) to create one illustrated reference image from each photo. We then send those illustrations, not your original photos, to Volcengine Ark, ByteDance's cloud platform, where Seedance 2.0, a video model developed by ByteDance, generates the video. The Volcengine Ark API endpoint is in Beijing, China, so your data may be processed outside your country. Each provider processes the data on our behalf to produce your video. Their handling of data is also governed by their own terms and privacy policies.

Your uploaded photos, the reference images and generated videos are stored in our cloud storage so you can view and download them from your account.

Deepfake Prevention and Content Safety

The service only makes one fixed concert scene: you cannot enter prompts, change the scene or add speech or voices. Before each generation you must confirm that the photos are yours or that you have permission to use them, and that they do not show a minor or a public figure; our server rejects requests without this confirmation. Our AI providers run their own safety checks on the images they receive. Every video is AI-generated, fictional content. If someone has made a video from your photo without your permission, use Report this video on its share page or email us; we review reports within 72 hours and remove videos that break our rules. Details are in the Terms of Service.

Who We Share Information With

We share information only as needed to run the service:

• Hosting, database and storage: Cloudflare (website hosting on Cloudflare Workers, our database on Cloudflare D1, and photo and video storage on Cloudflare R2).
• AI processing: APIMart, which uses Google's Gemini image model (Nano Banana 2) to create illustrated reference images from your photos, and Volcengine Ark (ByteDance, API endpoint in Beijing, China), which runs Seedance 2.0 to generate the videos, and fal, which adds the song to the finished video (fal receives the generated video, not your photos).
• Payments: Waffo Pancake, our Merchant of Record, to process your purchases.
• Sign-in: Google, if you choose to sign in with your Google account.
• Email delivery: Cloudflare Email Service, to send video delivery emails and sign-in links.
• Analytics: Google Analytics, when enabled on the site, to understand site usage.
• Embedded video: our home page and guides embed NPR Music's official YouTube video of the original performance. Nothing is loaded from YouTube until you click play; after that, the player is served from youtube-nocookie.com and Google's privacy policy applies to it.
• Legal: when required by law, or to protect our rights, our users, or the public.

Data Retention

We keep your account information while your account is active. Uploaded photos, reference images and generated videos stay in our storage until you delete them, ask us to delete them, or your account is deleted; we do not delete them automatically. You can delete a finished video yourself in My videos: this removes the video (with and without music), its reference images, its share link and the photos you uploaded for it (a photo still used by another of your videos is kept until that video is deleted too). You can also ask us to delete them at any time (see "Your Rights" below), and we process deletion requests within 30 days. We keep purchase records for as long as required for accounting and legal purposes.

Data Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections (HTTPS). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children

The service is for users 18 and older. Photos of anyone under 18 must not be uploaded. If we learn that we have collected such a photo, we will delete it.

Photos of Other People

Upload only your own photos or photos you have permission to use. Photos of public figures, and photos of other people taken or used without their permission, are not allowed. If someone has made a video from your photo without your permission, use Report this video on its share page or email us: we review the report within 72 hours, delete the video and the photos used to make it from our storage, and permanently terminate the account that uploaded them. See our Content and Copyright Policy.

Your Rights

Depending on where you live, including under the EU and UK GDPR and the California Consumer Privacy Act (CCPA), you may have the right to:

• access the personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your personal information, including your photos and videos, or your whole account (you can delete videos and their photos yourself in My videos at any time);
• object to or restrict certain processing; and
• not be discriminated against for exercising these rights.

We do not sell or share your personal information for cross-context behavioral advertising.

How to make a request. Email support@tinydeskai.studio from the email address on your account and tell us what you would like us to do. We may ask you to confirm your identity. We respond within 30 days. You can also complain to your local data protection authority.

Changes to This Policy

We may update this policy. We will post the updated version on this page and change the date above.

Contact

If you have questions about this Privacy Policy, please contact us at support@tinydeskai.studio.