What we collect
- Account: email, hashed password (if email signup) or Google subject ID (if OAuth), display name.
- Usage: your prompts, generated images, credit transactions, timestamps.
- Technical: hashed IP and user-agent (for rate limiting and abuse prevention); raw values are not stored.
- Payment: handled by Stripe. We only store order IDs and amounts — never your card number.
How we use it
- To run the Service (show your images, charge credits, send transactional emails).
- To prevent abuse (rate limiting, fraud detection).
- To improve the Service (page visits, user journeys, and aggregate usage metrics).
Cookies and analytics
The site uses cookies for your login session (imlab_sid) and language preference (locale). Google Analytics 4 and Microsoft Clarity may also set analytics cookies. You can manage or block cookies in your browser settings.
We use Google Analytics 4 to analyze page visits and usage events using browser or device identifiers. After you sign in, we also use a system-generated internal user ID to associate visits across sessions with your account. We do not send your email address to GA4. Account-linked path events sent to GA4 exclude URL query parameters and fragments.
We use a short-lived first-party cookie (imlab_auth_event, up to 5 minutes) to report successful signups and logins and the method used (email or Google) to GA4. This cookie contains no email address, password, or session credentials and is not used for authentication.
We use Microsoft Clarity heatmaps and session replays to analyze interactions such as clicks and scrolling and improve the page experience. Clarity uses its own browser and session identifiers; we do not provide Clarity with your internal account ID.
Our first-party visitor analytics uses imlab_visitor (up to 90 days) and imlab_visit (30 minutes of inactivity) cookies to identify a browser and a visit. We retain page and article paths, tool names, visit order, foreground viewing time, scroll depth, and successful signup/login events for 365 days. Activity while signed in is linked to your account; the same browser identifier connects visits before and after sign-in. We do not collect prompts, form contents, URL queries or fragments in these records. The last recorded page indicates a possible exit; it does not prove when a tab was closed. Clearing cookies creates a new browser identifier.
Who we share with
- Cloudflare — content delivery (CDN), object storage, and edge security.
- Stripe — payment processing.
- AI image infrastructure — your prompt is sent to our image-generation backend to produce the image. Reference images you upload are sent along.
- Resend — email delivery (verification, alerts).
We do not sell your data. We do not train models on your prompts or images.
Your rights
To request a copy of the data we hold on your account (profile, prompts, generated images, transactions), email [email protected] — we'll respond within 30 days. You can also delete your account at any time from Account Settings; this removes your profile, images, and transactions within 30 days.
Contact
For questions or suggestions, please reach out to us at [email protected] — we'll respond as soon as we can.