Privacy

We keep this small. When you buy, Stripe's checkout collects your name, email and shipping address and passes them to us so we can fulfil the order. Your card number never touches our servers — Stripe holds it.

If you commission a myth, we keep the text you type and the images it produces, so we can show them to you and print the one you buy. A cookie holds an anonymous session id that counts your studio runs; it identifies a browser, not a person.

If you create an account, we keep your email and your order history so you can see your own orders and renders.

Each service does one job, and only sees what that job needs:

• Stripe — payment. Card details, billing and shipping address.
• Prodigi and Printful — print and apparel fulfilment. Your name, shipping address, email and the artwork file.
• OpenAI — renders commissioned art from the text you enter, and screens that text for prohibited content.
• Claid — enlarges the artwork file to print resolution. Image only, no personal details.
• Resend — sends order emails to the address you gave at checkout.
• Vercel — hosts the site and stores artwork images.
• Supabase — account sign-in, order records, and the anonymous studio-pass counters.
• Google (Analytics 4 and Ads), Meta (Facebook/Instagram) Pixel, and the TikTok, Pinterest and Reddit tags — measurement, conversion tracking, and advertising. These load only with your consent (see our Cookie Policy) and receive online identifiers and activity events such as page views and purchases.

We do not sell your personal information for money, and we never share it with data brokers or identity resolution vendors. We do use advertising and analytics cookies (Google, Meta, TikTok, Pinterest, Reddit) only after you consent, which under some U.S. state laws is considered "sharing" for cross-context behavioral advertising. You can withdraw consent, reject these cookies, or send a Global Privacy Control signal at any time — see Privacy Choices.

If you accepted advertising cookies, then when an order is paid our server also tells Meta that a purchase happened, with the amount and a one-way hash of the email you gave at checkout — never the address itself — so the ad that brought you here gets credit even if the pixel was blocked. Reject the cookies and Meta hears nothing.

Emailed download links stay live for 30 days; links in your account are minted fresh each visit and last an hour. Studio renders stay visible in your account for one year; after that they are hidden, and we do not yet delete them automatically, so ask and we will. Order records we keep as long as bookkeeping, tax and dispute handling require.

This site is not meant for children, and we do not knowingly collect information from anyone under 16. If you think a child has given us their details, write support@painted.app and we will delete them.

To see, correct or delete what we hold about you, or to close your account, write support@painted.app from the address you signed in with. We delete the account and its renders; order records we must keep for tax are kept and used for nothing else. That inbox is read by the people who run the shop, and it is the same address for every privacy question this page doesn't answer.

Residents of California and other U.S. states with privacy laws can opt out of sale or sharing on Privacy Choices, and a Global Privacy Control signal is honoured automatically. We never charge for a request and never treat you differently for making one.

PaintedApp, LLC, 1327 SE Tacoma St #394, Portland, OR 97202.

24 September 2026: operator and mailing address named; studio counters listed under Supabase, where they live; every tag the site can load is named; retention, children and account deletion added.