Privacy policy

Effective October 8, 2026.

When you use the studio

Submitting an image request sends your prompt and, for editing, your source image to fal and its model infrastructure. Do not submit images or text you are not comfortable sharing with a third-party image provider. See fal’s privacy policy.

Browser storage and session cookies

For safety checks, prompts are also sent to Waffo Prompt Sift before generation. Source images and completed outputs are sent to the fal NSFW checker. Our database retains redacted safety decisions, provider correlation IDs and task references for 30 days, without raw prompt text or uploaded image bytes. Report and appeal emails are handled by our monitored support mailbox.

Your prompt draft, selected mode, image shape and current task reference are saved in this browser’s local storage so you can continue after a refresh. Source uploads are not saved in local storage. A necessary, HTTP-only session cookie associates requests with your browser.

Request records

We store a task identifier, a hashed session identifier, a keyed hash of your network address, request state, timestamps and temporary result URLs in Cloudflare D1. We use these records to enforce the preview allowance and recover your task. The application database does not store your prompt text or source image bytes.

Service providers and retention

Cloudflare hosts the application and may process connection data and technical logs. fal hosts inference and output files according to its own retention rules. Our application task records are automatically removed after 30 days for free previews. Paid request records are retained to reconcile usage and payments. Completed image links can expire sooner; download results you want to keep.

Analytics and payments

We use Google Analytics 4 for public-page visit statistics and Microsoft Clarity for masked session recordings and usability analysis on the production domain. These providers may use cookies and process technical connection and interaction data. Account pages are excluded; prompts, uploads, results and account-menu details are masked in Clarity. We send no names, emails, prompts or image data to Google Analytics, and strip query parameters and fragments from page-view URLs. We honor Do Not Track and Global Privacy Control. There is no advertising tracking. If you create an account, we store your name, email, password hash and necessary session records. Waffo Pancake processes checkout and payment details; the application stores order references and request allowances, never card numbers. Public paid checkout is currently pending payment approval. Sandbox test payments do not create real paid allowances.

Google privacy policy · Microsoft privacy statement

Clear local data

Clear this site’s cookies and storage in your browser to remove your local draft and session. Doing so prevents the studio from recovering tasks associated with that session. Provider processing and retention are governed separately by the provider.