Privacy Policy

This Privacy Policy explains what information the operator of Covelorn ("Covelorn", "we", "us"), an individual acting as sole operator of the service, collects when you use Covelorn (the "Service"), and how it's used, shared, and protected. It should be read alongside our Terms of Service.

We collect the following categories of information:

• Account information. Your name, email address, and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address, whether Google has verified that email, and your Google account ID; we don't receive your Google password. If you enable two-factor authentication, we store the related secret and recovery codes in encrypted form.
• Your projects. Everything you create or upload in the Service: stories, scripts, characters, places, pages, panels, uploaded images (including pose reference photos you take with your phone), images generated for you, and the ideas and instructions you give the AI collaborator.
• AI usage records. The prompts sent to AI models on your behalf, which model was used, and how many credits each request cost. These records let you see your history and usage, and let us manage costs and investigate problems.
• Payment information. Subscriptions are processed by Stripe. We never receive or store your full card number. We keep the identifiers Stripe gives us to manage your subscription, and the card brand and last four digits so you can recognise the card on file.
• Technical information. The IP address you signed up from and last logged in from, and the time of your last login. We use these for security and to prevent abuse, such as one person creating many accounts to collect free trial credits.
• Signup statistics. When you visit the homepage, we note which signup steps a visitor reaches (for example, viewed the homepage, created an account, started a first comic), together with the campaign tags of the link you arrived from (such as utm_source and utm_campaign). This is linked to a random ID kept in your session and, once you sign up, to your account. Known bots are excluded.
• Contact form messages. If you contact us, we store the name, email, and message you provide.

We use the information above to:

• Provide, operate, and maintain the Service.
• Generate text and images you ask for, using the AI providers listed below.
• Authenticate you and keep your account and projects secure.
• Process subscription payments, track credits, and prevent abuse of free trials.
• Review stories you submit for public listing, and act on content that breaks our Terms of Service.
• Provide support, respond to messages, and diagnose problems. To fix a problem you report, we may view your account as you see it.
• Understand where visitors drop off when signing up, so we can improve the Service.
• Send emails about your account, such as password resets.

We do not sell your information or use it for advertising. Covelorn does not run third-party analytics or ad-tracking scripts.

We share information only in the following circumstances:

• With AI providers, to generate content. When you use an AI feature, the relevant text (your idea, script, and instructions) and images (such as character references and the panel being edited) are sent to the provider that does the work: Anthropic (writing and planning), OpenAI and Google (image generation and editing), and fal.ai and Replicate (image processing such as pose transfer). Your email address and payment details are not sent to them.
• With other service providers. Stripe (payments), Google (sign-in, if you choose it), Amazon Web Services (storage of your images), and our hosting and email delivery providers.
• When you publish. If you publish a story, anyone with its link can read it, with your account name shown as the author. Once it's reviewed and approved, it's also listed on the public stories page.
• If required by law. We may disclose information if required to by law, or to protect the rights, safety, or property of Covelorn, its users, or others.

Each provider handles data under its own terms and privacy policy. Some of them process data outside your country, including in the United States.

We use a small number of cookies: one to keep you signed in (session), one for security against cross-site request forgery, an optional "remember me" cookie, and one or two to remember interface preferences such as light/dark mode and whether the sidebar is open. The session also holds the random ID used for signup statistics. None of these cookies are used for advertising or cross-site tracking. You can block cookies in your browser, but you won't be able to sign in without the session cookie.

The app also saves a few preferences in your browser's local storage, such as your appearance setting, the last view you used in a project, and script editor settings. This stays on your device, and you can clear it at any time from your browser's site data settings.

We keep your information for as long as your account is active. When you delete your account, your account, projects, and images (including the stored image files) are permanently deleted, and any active subscription is cancelled. Payment records are kept where we're required to keep them for tax or accounting purposes. Signup statistics and contact form messages are kept without being linked to your account.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, to object to or restrict how it's used, and to complain to your local data protection authority. You can:

• Update your name and email, or delete your account, from your profile settings.
• Request a copy of, correction to, or deletion of your data through our contact form.
• Manage or cancel your subscription from your billing settings, or through Stripe's customer portal.

The Service is not directed at children under 13 (or the minimum age of digital consent in your jurisdiction, if higher), consistent with the eligibility requirement in our Terms of Service. We do not knowingly collect information from anyone below that age. If you believe a child has provided us with personal information, contact us and we'll delete it.

We take reasonable technical measures to protect your information, including hashing passwords, encrypting sensitive credentials, encrypting data in transit via HTTPS, and serving your images through short-lived signed links. No method of storage or transmission is completely secure, and we can't guarantee absolute security.

We may update this Privacy Policy from time to time. If we make material changes, we will update the "last updated" date above and, where appropriate, notify you through the Service. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Questions about this Privacy Policy, or requests about your data, can be sent through our contact form.