Privacy policy

Last updated: October 18, 2026

Contact support@picmira.com about this policy or the service.

Information we handle

For signed-in accounts, Picmira stores your Google account identifier, name, email and session records. To deliver the service we also store uploaded images, generation instructions, task status and results, credit activity, and relevant order and subscription records. Support correspondence contains the information you choose to send us.

Google sign-in and essential cookies

Google is the only sign-in provider. We verify your Google identity and create an account on first sign-in. We do not receive your Google password or request access to Gmail or Drive. Protected cookies maintain account or guest access. Guest sessions are stored using hashed tokens. Rate-limit identifiers are hashed to help prevent automated abuse. Google sign-in also processes information under Google’s privacy policy.

How visitors find Picmira

For visitors who are not signed in, a first-party cookie can retain the first observed source and latest non-direct source for up to 30 days. We record the referring domain, entry page path, time, and limited campaign parameters (source, medium and campaign). We do not retain the full referring URL, search query, or unrelated URL parameters for this purpose. On first registration, these observations may be linked to the new account so administrators can understand acquisition channels. The cookie is cleared after successful sign-in; the account record is retained with account data. Existing accounts are not assigned a guessed historic source. Missing referrals are labelled direct or unknown. This attribution is distinct from Google sign-in, can be incomplete, and is not used to determine account permissions or credits. We skip collection when the request sends Do Not Track or Global Privacy Control signals.

Website analytics

We use Google Analytics to understand visits and interactions on Picmira. Its measurement code can collect page addresses and titles, referring pages, usage events, browser and device information, and pseudonymous cookie identifiers, and send them to Google for reporting. This is separate from Google sign-in and our first-party acquisition and purchase-click records. We do not add account names, email addresses, uploaded files or generation prompts to our Google Analytics configuration. Browser privacy settings or blocking tools may limit this collection. Learn more about how Google Analytics works and how Google uses information from sites that use its services.

Uploaded images and generation

Uploads are processed on our servers and service providers, rather than solely on your device. Uploaded references are stored in Cloudflare R2 and associated with your account or guest session. Generation sends instructions and time-limited image references, when supplied, to third-party AI services. Their processing, output storage and retention are governed by their own terms. We download successful results into Picmira storage; temporary output URLs from those services can exist separately from our copies. Avoid uploading sensitive information or images you lack permission to use.

Public and private gallery choices

Signed-in results default to private; guest results default to public. When Private gallery is disabled, a completed result may appear in our public gallery. Uploaded references and prompts are not part of the public gallery response. Private assets require the matching account or guest session. Signed-in users can restore privacy for their own account results from the result card. This removes new public listing and access through Picmira, but does not recall copies others already obtained. Earlier guest results do not transfer to your account on sign-in.

Content screening

When Creem content screening is enabled, user-controlled generation instructions are sent to Creem for a pre-generation decision. We record the result identifier, decision, input hash, configuration revision and associated user or task for audit. Audit records do not store a second copy of the screened prompt; task records can still contain the generation instructions. Creem’s handling of submitted instructions is subject to its privacy notice. Requests that fail screening are blocked before a new task reserves credits.

Billing and purchase interest statistics

Payment providers handle their checkout forms; Picmira does not collect card details through its own forms. We store relevant order, subscription, refund and credit records to deliver paid services and resolve billing issues. Selecting a plan or its sign-in link records the plan, action, time and whether the click came from a guest, signed-in user or administrator sandbox test. These click records do not contain a name, email, account ID or uploaded image, and do not establish that a payment occurred.

Infrastructure and sharing

Picmira uses Vercel for hosting, Neon for database storage, Cloudflare R2 for image storage, Google for sign-in and analytics, and configured AI and payment providers for their respective services. Data may be processed in countries other than your own. We share information needed to operate these services, comply with applicable obligations, investigate abuse or respond to lawful requests. This policy does not mean third-party services follow identical storage or privacy practices.

Retention

Account data, uploads and results currently have no fixed automatic deletion schedule. They are retained to provide account and gallery access unless removal is arranged or the service changes. Task and safety records are retained for operation, abuse investigation and dispute resolution. Billing and credit records may need to be retained after account closure for legal, accounting or payment-provider obligations; For Creem purchases, its merchant terms require sales records to be retained for at least seven years; this does not set a seven-year retention period for uploaded images. Expiry of a browser session or image access link does not itself delete the stored data. Keep your own copies; retention is not a guarantee of permanent availability.

Access, correction and deletion requests

Email support@picmira.com from the address used for your account to request access, correction, deletion or account closure. For guest requests, include the relevant task identifiers and available evidence of ownership; never send session cookies or credentials. Requests require manual review and verification; there is no self-service account deletion feature at present. We explain any information we must retain for legal obligations, security or unresolved disputes. Rights and response requirements depend on applicable law. Logging out or clearing a browser cookie does not delete server-side records.

Policy updates and contact

Updates will be published with the revised date. For privacy concerns, contact support@picmira.com. Also read the Terms of use and Acceptable use policy.