Privacy Policy

This policy explains what CreArt collects, why, and what you can do about it. It covers both the website at creartai.com and the CreArt mobile app for iOS and Android. Where the two differ — and they do, particularly around advertising — it says so.

1. Who is responsible for your data

YAWAI LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States — a limited liability company formed in Wyoming, United States, filing ID 2025-001813265 — is the controller of the personal data described here. You can reach us at yawaiapps@gmail.com.

Earlier versions of the app's terms named WAITOS AI SL as the provider. YAWAI LLC is the entity responsible for the service today.

2. What we collect

Information you give us

When you create an account: your email address, and your name and profile picture if you sign in with Google or Apple. Sign in with Apple lets you hide your address, and we work fine with the relay address it gives us.

When you use the tools: the prompts you write and any image you upload or photograph. In the app this needs access to your camera or photo library, which you grant per device and can revoke in system settings.

If you generate without an account

Generating without an account is free and limited to a number of generations per day. To apply that limit we need to recognise your device between visits — otherwise clearing your browser data would reset the allowance as often as anyone liked, and we could not offer anything for free at all.

So we calculate a device identifier: a code derived from technical characteristics of your browser, such as screen size, time zone, installed fonts and how it draws graphics. We store the resulting code, never those characteristics. It is kept on your device and on our servers together with the date you last used the service.

It is designed to persist, including if you clear cookies or browse in a private window. That is precisely its purpose: without it the free allowance cannot be enforced. We use it only to count your free generations and to prevent abuse — never for advertising, never to profile you, and it is never shared with third parties for their own purposes. It is deleted automatically after 7 days without activity, along with the images linked to it. The legal basis is our legitimate interest in preventing abuse of a free service. If you create an account, your limits move to that account instead.

In the app on Android, we link your guest profile to your device, so that reinstalling the app or clearing its data gives you back the same profile — your creations, your credits and what you have already used of today's free allowance — instead of starting over as a new guest, which would also let anyone reset the free allowance at will. For this the app uses the identifier Android gives each app (Android ID). It sends only a one-way hash of it, and only when it saves or recovers your guest profile; our servers transform it again with a secret key, so what we store cannot be traced back to your device. The link lasts while the guest profile exists. It is removed when that guest profile itself becomes a Google or Apple account, or when the profile is deleted; signing in to another account that already existed keeps it, so that you get your guest profile back when you sign out. On iPhone no device code is used: the guest key stays in your device's keychain, which survives reinstalling the app. The legal basis is our legitimate interest in keeping your guest profile and in preventing abuse of a free service.

When you contact us: whatever you put in your message.

Information created by using the service

The images the tools generate for you, your generation history, your credit balance and plan, and — when a creation is in the community — that public post and its engagement. Text-to-image generations from a signed-in account are published to the community by default, including the prompt. Creations that start from a photo you upload stay private.

Information collected automatically

Your IP address, which also tells us your approximate country; device and browser type and version; and records of what you did in the service and when. In the app we also collect crash diagnostics through Firebase Crashlytics, and a push notification token if you allow notifications.

The app additionally uses your device's advertising identifier (IDFA on iOS, Advertising ID on Android). Section 5 explains what for and how to stop it.

Payment information

We never see your card. Purchases in the app are processed by Apple or Google and recorded through RevenueCat. Purchases on the website are processed by Stripe; website subscriptions started before 15 September 2026 are processed by Paddle, who act as merchant of record. What reaches us is the outcome: which plan you are on, whether it renewed, and whether it was refunded.

3. Why we use it, and on what legal basis

To provide what you asked for — running generations, keeping your history, applying your plan's limits, and letting you sign in. This is necessary to perform our contract with you.

To keep the service working and safe — preventing automated abuse of the generators, investigating misuse, fixing crashes, and protecting against fraud. This is our legitimate interest in a service that stays available and is not exploited.

To comply with the law, including tax and accounting obligations attached to purchases.

For advertising and attribution in the mobile app, and for analytics on the website, we rely on your consent, which you can withdraw at any time.

4. What the website does

The website sets no advertising or cross-site tracking cookies. Traffic is measured with Vercel Analytics and Vercel Speed Insights, neither of which uses cookies or builds a profile of you.

If — and only if — you accept analytics in the cookie banner, we also load PostHog, hosted in the European Union. PostHog measures how the site is used and records browsing sessions: which pages you visit, what you click, and how the interface behaves. Text you type into fields is masked and not recorded. Nothing of PostHog is downloaded until you accept, and you can withdraw your consent at any time from the link in the footer.

With the same consent we also load Google Analytics 4, from Google Ireland Limited — the same analytics the app uses. It counts the pages you visit and what you do on them, such as starting a creation or completing a purchase (with its amount), and sets the cookies "_ga" and "_ga_SV2KME0XR5" to recognise your browser. If you are signed in, it also receives your CreArt account identifier, so that your visits on the website and in the app count as one person. Nothing from Google Analytics is downloaded before you accept, and you can withdraw your consent at any time from the link in the footer.

When an error occurs we send a diagnostic report to Sentry, hosted in Germany. Prompts, email addresses and identifiers are stripped out before the report leaves your browser. If you accepted analytics, that report also carries a link to the corresponding PostHog session so we can see what led to the error.

Google reCAPTCHA Enterprise runs through Firebase App Check to stop the generators being driven by scripts. It sets its own cookies and is governed by Google's privacy policy. Fonts are served from our own domain, not from Google.

Our Cookie Policy lists everything stored in your browser, by name.

5. Advertising in the mobile app

The free tier of the app is supported by advertising through Google AdMob, and we work with Meta to understand which campaigns bring people to the app.

On iOS, personalised advertising requires your permission through Apple's App Tracking Transparency prompt. If you decline, you still see ads, but they are not personalised using your device identifier. You can change this at any time under Settings › Privacy & Security › Tracking.

On Android you can reset or delete your Advertising ID under Settings › Google › Ads.

Buying a paid plan removes the ads.

The website carries no advertising at all.

6. Who else processes your data

We use other companies to run the service. They act on our instructions and may only use the data to provide their service to us:

Google (Firebase and Google Analytics) — accounts, database, file storage, push notifications, crash reporting, abuse prevention, analytics in the app, and analytics on the website if you accept it. Vercel — website hosting and cookieless traffic measurement. Cloudflare — storage of generated images in R2. fal.ai and our own GPU servers — running the image and video models. OpenRouter — improving the prompts you write: it passes them to the company that runs the language model (currently CoreWeave, ModelRun or DeepInfra), and we only allow providers that neither store them nor train on them. The same route also sends the final prompt to TypeSafe (its Jev model), which decides whether a creation can appear in Community (real people, copyrighted characters, sexual or suggestive content), also without storing it or training on it. Google (Gemini) — the same step when OpenRouter is slow to answer or unavailable, and generating advertising copy in the ad tools. PostHog — product analytics and session recording, only with your consent. Sentry — error diagnostics. RevenueCat, Apple, Google Play, Stripe and Paddle — purchases and subscriptions. Meta — attribution and campaign measurement, in the app only.

Your prompts and uploaded images are sent to the provider that runs the model you chose, because there is no other way to produce the result. fal.ai is the platform that gives us access to third-party models rather than the company running them: depending on the model you pick, the provider behind it may be OpenAI, Google, xAI, ByteDance, Kuaishou, MiniMax, Black Forest Labs, Alibaba, ElevenLabs or HeyGen. Each tool’s model selector tells you which one you are about to use. In the avatar generator we send the photograph together with the words you want the person to say. We do not sell your personal data, and we do not use your images to train AI models; what each provider may do with what it receives is set by our contract with them.

7. Where your data goes

We are established outside the European Economic Area, and several of the providers above process data in the United States and other countries. Our own generation servers run on infrastructure rented from third parties; depending on availability it is located in Canada, Taiwan, the United States or the European Union. Where data leaves the EEA or the United Kingdom, transfers rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, as applicable to each provider. You can ask us for details of the safeguards that apply.

8. How long we keep it

Account data, generation history and credit balance are kept while your account exists, and every change to the balance of an account or app guest profile — what a creation cost, a refund, a credit pack or a plan top-up — is recorded for 400 days. When you delete your account we delete them, other than what we must keep for tax and accounting purposes, and a limited billing record — including your email address and, until its 400 days run out, the record of the credit packs you bought or had refunded — that we keep to stop paid credits and refunded balances from being reset by deleting and recreating an account, and to answer a claim about a payment. The legal basis for that record is our legitimate interest in preventing fraud.

If you use the generators without an account, the images are deleted 24 hours after they are created, and on the website the rest of the guest record is deleted after 7 days without activity. These jobs run daily. In the app, the guest profile itself — its credit balance and, on Android, the link to your device — has no expiry date: it is kept so that you find it again when you come back, and you can ask us to delete it at any time.

Requests that reach our servers and that our safety filters block or soften, and those whose image our safety check discards, are kept for one year together with the account or guest record that sent them: what was written, which filter acted and why. We use this record only to review the filters' mistakes and to act against repeated abuse, and it stays for that year even if the account is deleted. The legal basis is our legitimate interest in keeping the service safe.

Images you upload as input are stored separately from the ones you generate, and are removed once the generation that used them has finished. If you delete your account, they go with it.

In the app, each phone's push notification token is kept while the app keeps renewing it, which it does when you open it, and is deleted 60 days after the last renewal or when you delete your account. If we are testing a change — for example a different daily free allowance — we record which group your account or guest record was placed in and the figures it got, for 400 days or until you delete your account.

Generation history is also capped by plan: older items are removed once the stored history exceeds your plan's allowance.

Text-to-image generations from a signed-in account appear in the community when they finish, unless they are ineligible (for example they started from an uploaded photo). They stay visible until you hide them, delete them, or delete your account. Hiding a post so it is no longer public is a Premium feature; on the free plan a published creation stays public until you delete it.

9. Your rights

You can ask us to give you a copy of your data, correct it, delete it, or send it to another provider. You can object to processing we base on legitimate interest, ask us to restrict processing, and withdraw any consent you gave — withdrawing consent does not undo what was done before.

Write to yawaiapps@gmail.com and we will respond within one month. We may need to confirm who you are before acting, so that nobody else can make requests about your account.

If you are in the EEA or the UK you can also complain to your national data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es); in the UK, the Information Commissioner's Office (ico.org.uk).

If you are a California resident, you may request the categories and specific pieces of personal information we collected, ask for deletion, and not be discriminated against for asking. We do not sell or share personal information as those terms are defined by the CCPA.

10. Children

CreArt is not directed at children. We do not ask for your age or date of birth. You sign in with Google or Apple, and those services apply their own age rules. Purchases go through Apple, Google, Stripe or Paddle, which apply their own age and payment rules. If you believe a child has given us personal data, write to yawaiapps@gmail.com and we will delete it.

11. Security

Traffic is encrypted in transit. Generated images are served through links that expire rather than public URLs. Access to production systems is restricted, and the API routes that can delete data are behind separate credentials. No service can promise perfect security, and we do not.

12. Changes

We update this page when what we do changes, and revise the date below. If a change materially affects your rights we will tell you in the app or by email rather than relying on you to notice.

Last updated: 10 October 2026.