Privacy Policy

Your files are yours. We delete them on a schedule unless you ask us to keep them, we do not train on them, and we share them with no one but the agent in the workspace, and only when you use it.

Your files remain your own

You keep everything you upload and everything we return. We claim no licence over your images or video beyond what running the job requires, and nothing you send is used to train, tune or evaluate a model.

How long we keep things

Uploads are deleted after one day. Each job keeps its own copy of the part of your upload it worked on, alongside any result, and both are deleted seven days after the job finishes. Once the window passes the data is gone, including for us. Download anything you want to keep before then.

The web app uploads a photo as soon as you choose one it can run, so it is ready when you press Run. A photo you choose and never run is deleted after one day, like any upload.

Two things you ask for are the exception, and they are the only ones: a result you tell us to keep, and an image you submit to the gallery. Both are described below. Everything you have not asked us to keep is on the schedule above.

Results you ask us to keep

Turning auto-delete off on a finished job (in the app, Keep past a week) asks us to keep your result, and we copy it to storage without a deletion schedule. We always remove embedded metadata such as camera details and location.

Turning auto-delete back on removes the kept copy and takes the job off the gallery if you had shared it. The job results go back on the original deletion schedule or are deleted at once if that window has passed.

Job results can be deleted immediately from your dashboard, which also takes them off the gallery if you had shared them. A record of the job and what it cost remains in your history, but your images are gone.

Submitting a result to the gallery allows anyone signed in to CraterView.ai to see and admire your images, and the description you add with them. We show a post to visitors who are not signed in only with separate permission from whoever owns the image. Sharing turns auto-delete off for the job, but you can unshare or delete what you've shared at any time.

A person reviews every submission before it appears. That is the one place a human being looks at an image you sent us, and it happens only because you asked for it to be published. Nothing is visible to anyone else while it waits, and a submission that is declined is never shown.

You can withdraw a submission at any time, published or not. It disappears from the page immediately. Your kept copies are untouched — withdrawing from the page is not deleting your work, and the job stays kept until you say otherwise.

What outlives the file is the job record: its id, which model ran, when, whether it succeeded and what it cost. That is what the dashboard shows you and what your credit balance is derived from. It does not contain the image. It does keep the settings the job ran with, among them any sentence you wrote to describe the photograph, which is never written to our logs.

What we hold about you

Opening a workspace on the website takes no email and no card. Until you sign in, the account behind it is a temporary one and the only thing tying it to you is your browser session. When you upgrade and sign in, we hold the email address your identity provider gives us, and your name if it gives us that too.

Your browser also remembers which provider you last signed in with, such as Google, so the sign-in page can point it out. It holds only that name, and it stays when you sign out.

Neither the website nor the app contains advertising or analytics, and nothing in either tracks you across other websites or apps.

Product update emails. Once you have signed in and run a few jobs, the website or the app asks, once, whether you would like an email when we improve CraterView.ai or publish a new guide. We send them only if you say yes, to the address you signed in with, and you can stop them whenever you like on the Account page of the website or the app, or with the unsubscribe link at the foot of every one. We keep your answer and when you gave it, and a record of which emails we sent you, and all of it is removed when you delete your account. A guest account is never asked. The emails are sent through Google Workspace, which handles your address to deliver them.

The iPhone and iPad app

The app uses the same account and the same rules as the website, so everything else on this page applies to it. What differs is how the app reaches your account, and what Apple passes to us along the way.

Your account. The first time the app opens, it asks Apple to confirm that it is a genuine copy of CraterView.ai on a real Apple device, and we create an account for it. Apple's answer is about the app and the device, not about you, and we do not keep it. The app keeps the keys that reach your account in the Keychain on your device. One of them is also saved to your iCloud Keychain, which Apple encrypts end to end, so that your other devices reach the same account; we never learn your iCloud account. Each device's key is labelled with the kind of device it is, such as "iPhone".

Sign in with Apple. If you sign in, Apple gives us an identifier for you that is unique to CraterView.ai, an email address (your own, or a private relay address if you choose to hide yours) and your name, if you choose to share it. Apple also gives us a token, which we keep encrypted and use for one thing: when you delete your account, we use it to ask Apple to remove CraterView.ai from your Apple Account's sign-ins.

Photos. The app sees only the photos you choose, through Apple's photo picker, and has no access to the rest of your library. Saving a result asks for permission to add photos, which does not let the app see your library either.

Purchases. Apple takes the payment for anything bought in the app, and we never see your card or your Apple Account. Apple gives the app a signed record of the purchase: which product, when, its transaction number and, for a subscription, when the period ends. The app passes it to us so that we can add the credit or start the subscription, and we keep it with your account's other payments. Apple also tells us directly when a subscription renews or a purchase is refunded. Each purchase carries a code we derive from your account so that those messages reach it; the code says nothing about who you are.

On your device. The app keeps a list of the jobs you have run, so your history is still there after the pictures expire. The list holds which treatment ran, when, what it cost and the job number, never the pictures themselves. It is removed when you delete the app, sign out or delete your account.

How we handle your files

Your files move between you and our storage provider on short-lived signed links, and never travel through our API. The machine that runs your job fetches your file, does the work, writes the result back, and keeps nothing.

When you use the agent in the workspace, your messages are sent to a third-party agent so that it can answer you, with what it needs to answer: the photo you chose and its file name, type and size, the model and settings on the workspace, and your account's credits. We delete the conversation an hour after your last message.

An automated content check is used to flag inappropriate content. Nothing is currently refused based on the check, but the platform will notify you if your content is flagged. Write to support@craterview.ai if you find the automated check is too strict.

A person at CraterView.ai looks at one of your images in a single case, and it is one you ask for. An image submitted to the gallery is inspected by a person before it is published; a submission is the only thing that puts your work in front of anyone at CraterView.ai.

Asking us about your data

You can delete your account yourself, from the Account page on the website or the Account tab in the app. Every photo and result on it is deleted at once, every device is signed out, and your email address and name are removed. What remains is the record of the jobs it ran and the payments it made, and our copy of it no longer names you. A payment made on the website is also recorded by Stripe, which processes it, under the name and email address given at checkout. The closed account keeps the reference to that record, so that a refund or a dispute that arrives after you have left can still be matched to its payment.

Write to support@craterview.ai and we will tell you what is held against your account or delete it.