Legal
Privacy policy
What we collect, what we deliberately do not, and who else sees any of it. Written to be read rather than to be survived.
Last updated 2 September 2026
The short version
Your music is analysed inside your browser and is never uploaded. Recordings are rendered on your own machine and never reach us.
The one exception is AI subtitles: to find the words in a track, that track has to be transcribed, so its audio is sent to our transcription provider. We do not keep it. Nothing else about the visualiser sends your audio anywhere.
Who we are
imageyAI Inc., a Delaware C‑corporation, is the controller of the personal data described here. Contact us at hello@imagey.ai.
Using the visualiser without an account
You can open imageyFX-360 and use every visual feature without signing in. In that state we do not create a record of you. Your settings, your saved looks and any artwork you add are kept in your own browser's local storage, on your device. We cannot read them, and clearing your browser data deletes them.
What we collect when you sign in
| What | Why |
|---|---|
| Email address, name, profile picture | To identify your account. Supplied by Google when you choose to sign in; we never see your Google password. |
| Artwork you upload | So your emblems follow you between devices. Stored privately - only your account can read them. |
| Subscription status and Stripe customer ID | To know which tier you are on. We never see or store your card number: Stripe handles payment details directly. |
| Usage counts per month | To meter the AI tools against the fair usage policy. A running total per month, not a log of what you made. |
What the AI tools send
AI features run on our servers rather than in your browser, so that our provider keys are never exposed. When you use one, the following leaves your device:
- Artwork, shapes, grid packs and palettes - the text prompt you typed. Sent to OpenAI or Anthropic depending on the tool.
- Subtitles - the audio of the track you are transcribing, sent to OpenAI's transcription model, which returns the words and their timings. We pass it straight through and do not store the audio.
Generated images are stored in your private library so they are there next time. Prompts are not kept by us beyond the request. What our providers do with data sent to them is governed by their own terms; at the time of writing, both OpenAI and Anthropic state that API content is not used to train their models by default.
What we never receive
- The music you play through the visualiser, except for the subtitle case above. Frequency analysis happens in your browser.
- Anything you record. The recorder writes frames on your own machine.
- Your card details. Those go from your browser to Stripe.
- Your Google password.
Cookies and local storage
We use no advertising cookies and there is no advertising pixel on this site. We would like to count visits, and that is the one thing we ask for: a Google Analytics cookie, set only if you say yes to the bar that appears on your first visit.
If you say no, or simply do not answer, no analytics cookie is set and nothing is measured - the tag is configured to refuse before it is even loaded, so there is nothing to undo later. Saying yes tells us how many people arrive, which pages they read and roughly where in the world they are. It never tells us who you are, and it is never used for advertising or shared with anyone for it.
You can change your mind whenever you like: . What we use either way:
- Local storage in your browser, to remember your settings, saved looks and artwork. This never leaves your device.
- A sign‑in session, set by Google Firebase Authentication once you sign in, so you stay signed in.
- Stripe sets its own cookies on its checkout and billing pages, which are hosted by Stripe, for fraud prevention.
None of those three are used for advertising or cross‑site tracking, and none of them are optional: the first is how the app remembers your work, and the other two only exist once you have chosen to sign in or to pay. The analytics cookie is the only one you are asked about, because it is the only one we could do without.
Who else processes your data
| Processor | What for |
|---|---|
| Google (Firebase) | Sign‑in, database, file storage, hosting and server functions |
| Google Analytics | Counting visits - only if you allow it |
| Stripe | Payments, subscriptions and billing portal |
| OpenAI | Image generation and audio transcription |
| Anthropic | Shape, pack and palette generation |
| Cloudflare | DNS for this domain |
We do not sell personal data, and we do not share it for advertising.
Where your data is held
Our database and file storage run in Google Cloud, and our server functions in the europe‑west2 (London) region. Our providers may process data in the United States and elsewhere. Where personal data moves out of the UK or EEA, that transfer relies on the standard contractual clauses in our providers' data processing agreements.
How long we keep it
- Account details and artwork - until you delete them or ask us to close your account.
- Usage counts - kept as monthly totals so we and you can both check a bill.
- Billing records - retained by Stripe and by us for as long as tax and accounting law requires, normally seven years.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, and to receive a copy of it in a portable form. If you are in the UK or EEA, our lawful bases are performance of a contract (running the service you signed up for), legitimate interests (keeping the service working and preventing abuse) and legal obligation (tax records).
If you are a California resident, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA.
Exercise any of these by writing to hello@imagey.ai. We will respond within 30 days. If you are in the UK or EEA and are unhappy with our response, you may complain to your data protection authority.
Children
imageyFX-360 is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.
Security
Uploaded artwork is stored so that only your own account can read it, enforced by server‑side rules rather than by the interface. Provider API keys are held in Google Secret Manager and never sent to the browser. Subscription and usage records can be written only by our server, never by a signed‑in client.
No system is perfectly secure. If you find a vulnerability, please tell us at hello@imagey.ai before disclosing it publicly.
Changes
We will update this page when what we do changes, and the date at the top will say when. Material changes will be notified by email to account holders.