Privacy Policy

Last updated 30 July 2026

This explains what we collect, why, who else sees it, and how to get it deleted. We collect as little as we can get away with.

What we collect

• Account information. When you sign in with Google we receive your email address, display name, and profile picture. We store those and a Google account identifier. We never receive or store your Google password.
• Your content. The prompts you write, files you upload, project graphs you build, and the output you generate.
• Usage and billing records. Which generations you ran, what they cost in credits, and your credit balance history. We keep this so your billing is auditable and so the app can show you your spend.
• Diagnostics. Error reports and basic technical logs (timestamps, request paths, IP address) used to keep the service working and to prevent abuse.

We do not use advertising trackers, we do not sell your data, and we do not run third-party analytics on this website.

What we do not collect

We never see your card number. Payments are handled entirely by Stripe; we receive only a customer reference, the last four digits, and whether a charge succeeded.

Who your data is shared with

Only the providers we need to run the service:

• Atlas Cloud — receives the prompts and input media for each generation, because it performs the generation.
• Google Firebase Authentication — handles sign-in.
• Stripe — handles payments and stores your payment method.
• Google Cloud — hosts our servers and database, in the United States.

We disclose information to law enforcement only where we are legally required to, or where content involves child sexual abuse material.

Model training

We do not use your prompts or generated output to train AI models, and we do not grant our providers the right to do so for our traffic where that option is available to us.

How long we keep things

• Account and projects — while your account is active, and for 90 days after you cancel so you can come back or export your work.
• Generated output — 90 days after cancellation, then deleted.
• Billing records — 7 years, because tax law requires it.
• Technical logs — 30 days.

Your rights

Wherever you live, you can ask us to:

• Give you a copy of your data.
• Correct something that is wrong.
• Delete your account and content.
• Stop processing your data, and close your account.

Email privacy@downsen.com and we will action it within 30 days. We will not make you jump through hoops or ask why.

If you are in the EU, UK, or California, you have these rights under the GDPR, UK GDPR, or CCPA respectively. We honour them for everyone regardless of location. We do not sell personal information, so there is nothing to opt out of under the CCPA's sale provisions.

Security

Traffic between the app and our servers is encrypted with TLS, and the desktop app pins our server's public key so it cannot be intercepted by a proxy. Our database is not reachable from the internet. Access to production systems is limited to accounts that need it.

No system is perfectly secure. If we ever suffer a breach affecting your personal data, we will email affected users promptly and tell you what happened.

Children

Downsen is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has created an account, email us and we will delete it.

International transfers

Our servers are in the United States. If you use Downsen from elsewhere, your data is transferred to and processed in the US.

Changes

If we change this policy in a way that materially affects you, we will email you before it takes effect.

Contact

Privacy requests: privacy@downsen.com
General support: support@downsen.com