Privacy Policy

This page covers what ImageToMP4 gathers, why it exists, and what control you keep. Two sign-in paths exist: Google OAuth (limited to the openid, email and profile scopes) or a plain email address with a self-chosen password.

1. What we hold

• Identity, minimally: via Google sign-in we receive your account email, display name and Google user ID at the moment you consent — never your Google password, never your Google files or mail. Via email sign-up we store the address you typed and a salted hash in place of the password; readable passwords do not exist in our systems.
• What you create with: the images you upload and prompts you write, kept for the sole purpose of rendering your videos.
• Account economics: credit balances, purchase receipts and generation records (timestamps, engine, outcome).
• Connection facts: IP address and request metadata, used for rate limiting and abuse defense.

2. What it is used for

• Standing up and protecting your account.
• Carrying out the video generations you request.
• Keeping balances accurate and payments reconciled.
• Keeping the service abuse-free.

Straight prohibitions: no advertising profiling on your data, and no selling or renting personal information to anyone, ever.

3. Google APIs disclosure

Use of data received from Google APIs complies with the Google API Services User Data Policy and its Limited Use requirements. Only the openid, email and profile scopes are requested, and only to operate sign-in.

4. Who processes data alongside us

• Cloudflare — hosting, object storage for uploads and results, database.
• Google — the sign-in flow only.
• Model providers (fal.ai and similar) — handed exactly your submitted image and prompt, for the single purpose of producing your video.
• Waffo — payment processing; receives the email and payment details attached to a transaction.

5. Retention

Both halves of a generation — the uploaded image and the delivered video — are auto-deleted after 7 days. Account records persist while the account does. Want everything gone sooner? Ask us; full account deletion completes within 30 days.

6. Your rights

Depending on where you live (GDPR, CCPA and similar frameworks), you can ask to see, correct, export or erase your personal data, or object to specific processing. Any of these starts with a message to us; we answer within 30 days.

7. Cookies

One essential item: a session token in your browser's local storage that keeps you signed in. There are no third-party advertising or tracking cookies on this site.

8. Minors

The service is not offered to children under 13 (or the equivalent local age), and we do not knowingly collect data from them.

9. Abuse

The tool must not be used for non-consensual intimate imagery of real people, deceptive deepfakes, or any unlawful material. Accounts that cross this line are terminated. Detail lives in the Terms.

10. Updates & contact

Policy changes land on this page, material ones conspicuously. Reach us via the contact page or at [email protected].