Privacy Policy

Last updated: October 13, 2026

Imavro (“Imavro”, “we”, “us”) is an AI image creation service at imavro.com, run by an individual operator. This policy explains what information we collect when you use Imavro, why we use it, who we share it with and the choices you have. Questions or requests: support@imavro.com.

Information we collect

Account information

• Email address and a display name taken from your email or Google profile.
• Password, stored only as a salted scrypt hash. We never see or store the password itself.
• Google sign-in: if you use it, your verified Google email address, name and a Google account identifier.
• Passkeys: the public key and identifier of each passkey you add. Your fingerprint, face or screen lock never leaves your device.
• Two-factor authentication: an encrypted authenticator secret and hashed recovery codes.

Content you create

• The ideas you describe, the choices you make in the guided steps, and the creative briefs generated from them.
• Reference images you upload and the images we generate for you.

Billing information

Payments are handled by Stripe. We receive your Stripe customer and subscription identifiers, your plan, billing period and subscription status. We never receive or store your card number.

Technical information

• Your IP address, used to prevent abuse (for example rate limits and the one-time guest trial). Where we keep a record for these limits we store a keyed hash, not the address itself.
• Your usage of your plan allowance and storage.
• Service logs kept by our hosting provider for security and troubleshooting.

How we use your information

• To provide Imavro: create your account, sign you in, generate and store your images, and let you download them.
• To run your subscription: apply your plan, count your monthly images and manage billing.
• To send you account emails such as verification and password resets. We do not send marketing email.
• To keep Imavro secure and prevent fraud and abuse, including checks against automated sign-ups.
• To comply with legal obligations.

We do not sell your personal information, and we do not use it for advertising. We do not use your ideas or images to train AI models.

How your images are made

To create an image we send your description, your choices and any reference images you selected to AI model providers through OpenRouter. We pick the model for each image automatically. Every request asks providers not to use your content for training.

• Standard images, 4K images and model routing (ByteDance Seed, Google, TypeSafe) are sent only to endpoints that do not retain your data after the request (zero data retention).
• Transparent-background images are made by OpenAI and SVG vector images by Recraft. These providers do not offer zero data retention and may keep request data for a limited time under their own policies, for example to monitor abuse.

Who we share information with

We share information only with the service providers that run Imavro, and only what they need:

• Cloudflare: hosting, databases, image storage, network security, the human verification check for guest trials, and Cloudflare Web Analytics, which counts page views without cookies or cross-site tracking.
• OpenRouter and the AI model providers described above: creating your images.
• Stripe: payments. Stripe acts as the merchant of record for your subscription and handles your payment details and applicable taxes under its own privacy policy.
• Resend: delivering account emails.
• Google: only if you choose to sign in with Google.

We may also disclose information if required by law, or to protect the rights, safety or property of Imavro, our users or others.

Cookies and local storage

Imavro uses only cookies that are necessary for the service: to keep you signed in, to complete two-factor and passkey sign-in, to secure Google sign-in, and to keep a guest trial on your device. Your in-progress choices are kept in your browser tab’s session storage. We use no analytics, advertising or tracking cookies. Page-view statistics come from Cloudflare Web Analytics, which sets no cookies and does not fingerprint you.

How long we keep information

• Sign-in sessions expire after 30 days. Verification and password-reset links expire after one hour.
• Guest trial images and data are deleted 24 hours after the trial starts unless you sign in and keep them. A keyed hash of the trial network is kept so each network gets one free trial.
• Your account, images and billing records are kept while your account exists. Images you delete are removed from storage.
• When you ask us to delete your account, we delete your account information and images. We may keep records that we are legally required to keep, such as billing records.

Security

Your images are stored privately and are only served to your signed-in account. We use HTTPS, hashed passwords, encrypted two-factor secrets and rate limits. No system is perfectly secure, so please use a strong, unique password and consider adding a passkey or two-factor authentication.

Your rights and choices

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, and to object to or restrict certain processing. To make a request, email support@imavro.com from the address on your account. You can also complain to your local data protection authority.

International transfers

Imavro is operated from Hong Kong and our service providers process data in several countries, including the United States. When we transfer your information, we rely on the safeguards our providers offer.

Age

Imavro is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

Changes

We will post any changes on this page and update the date above. If a change materially affects how we use your information, we will tell you by email or in the app before it takes effect.