Privacy policy

What this policy covers

This policy describes how image 2.5 handles personal data across all ten languages of the site. The site is operated by an independent developer, and support@image25.top is the address for every question or request described below.

The site's own pages are prebuilt static files with no user database behind them. Sign-in, uploads, generation, credit balances and payments run on services the pages call over HTTPS, so this policy separates what the site itself keeps from what those services keep.

Two files matter for reading the rest of this page. Your browser holds a signed-in session, and the services behind the site hold your account, task and order records.

Signing in, and what the account holds

Signing in uses a verification code sent to your email address. No password is created on this site, and the site never asks for one.

• The email address you enter, the code you receive and the sign-in itself are handled by the sign-in service. The sign-in screen also runs a Cloudflare bot check so automated sign-ups can be filtered out.
• After a successful sign-in the service issues an access token and a refresh token. Your browser stores them under the key image25top:site-18:auth_tokens, and the site reads that stored token to authorise every request it makes on your behalf.
• The path you were on before signing in is kept in the browser's session storage so you can be returned to it. It is removed once the sign-in completes.
• Signing out removes the tokens from the browser. Your account record itself, holding the email address and the profile fields you set, stays with the service until you ask for it to be deleted.

What you send when you generate

A generation only happens when you create a task, and the material needed to run it is sent to the generation service as part of that task.

• The prompt text, the model you chose and the parameters you set, such as aspect ratio, quality or duration.
• Any reference image or reference video you attach, uploaded to the service's upload endpoint together with your token.
• The result comes back as a link to the generated file, and the task record keeps the parameters, the status and the credit cost.
• Your uploads and results are not used to train models.

What is kept in your browser

Some state is deliberately kept locally so a reload does not throw away your work. All of it lives in your own browser and none of it is a hidden copy of your account.

• The signed-in session described above, in local storage.
• Your earlier tool runs, listed per account and per tool, so a repeat request can be re-opened instead of rebuilt.
• The last model you used, so the workspace opens where you left it.
• Preview thumbnails, held in memory only while the page stays open.
• Signing out from the personal centre, or clearing site data in your browser settings, removes all of it. Clearing it does not delete your account or your creations, which live on the services described below.

Payments

Checkout opens on the payment service. Card and bank details are entered there and never reach this site.

• The site receives the outcome of a purchase and the resulting credit balance. It never receives or stores a card number, a bank account or a wallet credential.
• The order record, holding the product, the amount, the time and the status, is kept by the payment service and is what a billing question is checked against.
• Subscription renewals and credit packs are charged by that service on the schedule you agreed to at checkout.

Analytics and cookies

Google Analytics 4 is the only third-party script on the site. Basic analytics loads automatically outside the EEA, the United Kingdom and Switzerland; visitors in those regions are asked first. If the site cannot determine the region, it also asks before loading Google Analytics.

• The visitor country is read from Cloudflare’s same-origin diagnostic endpoint only to choose the analytics rule. The lookup is not stored or forwarded by the site. The banner appears in the consent region, and also when that lookup does not return a country.
• When analytics loads, Google Analytics sets its own first-party cookies, named _ga and _ga_ followed by the measurement identifier, to tell one browser from another. IP anonymisation is enabled; advertising storage, advertising user data, ad personalisation and Google Signals are disabled.
• In the consent region, declining or ignoring the banner means Google Analytics is not loaded. A remembered refusal is honoured everywhere. Sign-in, uploads, generation and payment work exactly the same because none of them depend on analytics.
• The site’s own in-page event bridge is switched off, so no custom events are sent from this site at all. When it is enabled in a future build, it is limited by construction to a page identifier, a tool identifier and a language, and never carries prompts, file names, task identifiers, order identifiers or account identifiers.
• To change an answer you have already given, clear this site’s data in your browser settings. The banner then appears again in the consent region; outside it, basic analytics starts automatically.

Who else processes the data

The services below are the only places your data goes. Personal data is not sold, and it is disclosed to anyone else only where a law requires it.

• The sign-in service, which holds the account record and issues the tokens.
• The generation service, which accepts uploads, runs the tasks, quotes and deducts credits, and passes a task to the model provider that a chosen model belongs to.
• The payment service, which runs checkout and holds order records.
• Cloudflare, which serves the site's pages and static files, answers DNS for the domain, and provides the bot check on the sign-in screen.
• Google, for the analytics described above.
• The image delivery domain used for the site's own public pictures, which stores assets that belong to the site rather than to your account.

How long data is kept, and how to have it removed

Retention differs between the browser and the services, and a deletion request has one entry point, support@image25.top.

• In the browser, the session, the tool history and the last-used model stay until you sign out or clear site data.
• On the services, account, task and order records stay for as long as the account exists, because credit balances and task history are read from them.
• Individual creations can be deleted from the personal centre without closing the account, which removes the record tied to that task.
• To delete the account itself, or the records attached to it, send the request from the email address on the account. The request is confirmed before it is carried out, so it cannot be triggered by someone who does not control the mailbox.
• A record that is needed to answer a payment question or a dispute may be kept for as long as that question stays open, even after the rest is deleted.

Children

The site is not intended for children. If you are below the age at which you can agree to an online service on your own where you live, do not create an account.

If an account is found to belong to a child who could not lawfully agree to these services, it will be closed and its records removed on request.

Changes to this policy

The date shown at the top of this page is the date the policy last changed. When something material changes, the date changes with it.

Questions about this policy, and any request described here, go to support@image25.top. The terms of service describe the rules for using the site, and the contact page explains what to include in a message.