Privacy policy

Prepared October 14, 2026. This policy describes Smalltown Boy AI at smalltownboyai.online.

What we collect

We store your account name, email, password hash, session information, uploaded photos, generation settings, output videos, task status, and credit and payment records. We do not receive your full payment card details.

How your photos are used

When you generate, we send a prepared copy of your two uploaded photos and scene instructions to our AI service provider, Kie. It processes the request through the selected video model. Only upload photos you have permission to use. We do not use your uploads to train our own models. Provider retention and processing practices are separate from ours.

Local photo drafts

Photo selection stays on this device. Before sign-in we may save both photos, cast and optional direction in browser storage for up to one hour. Permission is not carried over. Expired drafts are discarded when the studio is reopened; use Clear photos or browser site-data controls to remove a saved draft. A draft is not an account upload and is not shared between devices.

Other service providers

Stripe processes checkout. Our email delivery provider sends account verification and password reset messages. Hosting and database providers store the service’s operational data. Google sign-in is used only if offered and chosen. These providers process the information needed to deliver their services.

Storage and access

Your output downloads require your signed-in account. We keep input photos and outputs for 30 days from the request date for completed or failed tasks, then remove them from our storage. An unresolved task may be retained while we investigate its outcome. Provider copies may follow a different retention schedule. Account and transaction records are retained while needed to operate the account, handle disputes, or meet applicable obligations.

Cookies and analytics

Essential cookies keep you signed in. Google Analytics loads automatically to measure visits and site conversions and may use analytics cookies to distinguish visitors and sessions. We disable Google Signals and advertising personalization and respect Do Not Track and Global Privacy Control. Analytics records page visits, registration, upload and generation outcomes, download clicks and confirmed purchases, including purchase amounts and hashed transaction identifiers. We do not send uploaded images, prompts, email addresses, passwords, private account URLs or payment card details to analytics.

Our private site statistics record anonymous visitor and visit identifiers, entry and action pages, referring sites and campaign labels, country, device category, event order, duration, generation settings and error categories. After a verified account signs in, its visits can be linked to actual tasks and confirmed payments for administrators to diagnose the journey. Account links stay in our private database and are not sent to Google Analytics. We do not store full IP addresses, raw error messages, uploaded media or payment card data in these statistics. Visitor identifiers expire in this browser after 30 days and visits after 30 minutes of inactivity. We respect Do Not Track and Global Privacy Control.

Your choices

You can request access, correction or deletion through the contact page. Deletion may exclude records we need to keep for payment disputes or legal obligations. Download any videos you want to keep before requesting deletion.

Contact

Use the contact page for privacy questions and account requests.