Kyutcode privacy

Your worlds are yours to keep.

Last updated September 3, 2026.

What we store

We store the account details needed to operate your account, your render prompts and QR destinations, internally randomized art direction and seed, generation and credit status, scan and quality-verification metadata, and the images in your private gallery. For reliability and quality review, we also privately retain attempt history, rejected candidate images, and the recorded reason an attempt was retried or failed. We store a hashed session token, not the session token itself.

For invitation campaigns, we store the prospect details supplied for the campaign, the intended website, creative prompts, delivery status, generated artwork, a protected invitation-code hash, and any unsubscribe preference. A recipient may register with a different email; possession of the one-time code determines which account receives the invitation artwork.

Payments and protection

Card details are collected by Stripe Checkout, not by Kyutcode. We retain purchase and credit records so we can fulfil purchases and resolve support issues. We use Cloudflare Turnstile to reduce automated abuse; its challenge is verified on the server before sensitive actions proceed.

How we use data

We use your information to provide the studio, run and verify requested generations, improve generation quality, diagnose failures, protect the service, deliver credit purchases, send invitation and account emails, and respond to support. We do not sell personal information. Gallery and attempt content is private to the account that created or claimed it and authorized service operators unless you choose to share or download a finished image. Marketing messages include an unsubscribe control, and a suppressed address is excluded from later campaigns.

Retention and requests

You may request account help or deletion at support@kyutcode.com. Some payment, fraud-prevention, suppression, operational audit, and legal records may need to be retained for a limited period. Read the terms for the service rules.

Language and regional display

We save your chosen site language in a preference cookie. If you have not chosen a language, we use your browser's language preferences as the default. We do not use IP addresses or geolocation lookups to select the site language.

Visitor analytics

Added September 19, 2026. We measure page categories, referring domains, campaign labels, device-size categories and visits from invitation links to understand how the website and marketing perform. A random identifier in session storage groups activity in a browser tab, with a 30-minute inactivity timeout. We do not record full browsing URLs, raw IP addresses, form contents or prompts in visitor analytics. Visit events are retained for up to 90 days. Invitation claims and purchases remain in the account and campaign records described above.

From September 23, 2026, we also measure design displays, download requests, signup and checkout attempts, and categorized errors. A signed first-party cookie links an anonymous visit to these actions for up to 24 hours. A download response does not prove that a file was saved or used. The analytics opt-out preference is stored in a cookie for up to one year.

We honor Do Not Track and Global Privacy Control. You can also disable visitor analytics on this browser below. This preference does not affect essential account, payment or security records.