Security & providers
Effective · 2026-11-03.
What stays on your device
FLOW, TRACE and DUEL run in your browser. Picking an image, previewing an effect and exporting a file do not upload the image. Local projects use browser storage. No AI provider receives your images.
Services used when you request them
- Cloudflare serves the site and runs private account databases and optional cloud project storage. A saved cloud project includes its source images and recipe; it is not end-to-end encrypted with a key held only by you.
- Paddle handles one-time checkout, receipts and payment records as the reseller. We receive the identifiers and verified billing state needed to provide access, not your full card details.
- Google Identity Services provides optional Google sign-in when configured. We verify the signed identity, audience and one-use browser-bound challenge before creating a session; no Google photo or file access is requested.
- Microsoft Authentication Library provides the optional Microsoft entry when approved and enabled. Signed tenant/object identity and a one-use browser-bound challenge are verified; matching email alone cannot claim another account. Only basic sign-in scopes are requested. \n
- Resend processes the recipient and content of sign-in and business emails. The operator's shared budget service receives only message hashes and usage counts for outbound mail.
- Zoho hosts the human support mailbox. Emailing support discloses the message and attachments you choose to send; avoid sensitive images and credentials.
This is the product's service inventory. Provider locations, agreements and retention differ; a business processing agreement or particular data residency is not included unless separately confirmed. Ask support before using cloud storage for regulated or third-party personal data.
Controls and limits
Sign-in links are short-lived and single-use; the database stores their hashes. Server sessions are revocable. Cloud and billing requests are checked against the signed-in account. Payment events are verified and deduplicated before they affect access. Backups and exports should still be kept securely by you.
These controls do not promise zero risk or certify your device. Browser extensions, shared-device access and exported files are outside the account session. Report suspected exposure promptly and sign out from shared devices.
Report a security issue
Email [email protected] with “Image Playground security” in the subject and a minimal description. Do not include live credentials, private customer files or exploitable access links. We can arrange an appropriate way to review evidence. Please avoid accessing other people's data or disrupting service while investigating.