Privacy Policy

Last updated: August 14, 2026

VibeReskin ("Service") is operated by Oleksandr Sitnikov ("we", "us", "our"). This Privacy Policy describes the data flows in the current public website and private reskin tool. It does not replace rights or obligations that may apply under local law.

1. Data We Collect

Data Type	What	Why
Waitlist data	Email address submitted through the public waitlist form, plus the submission time recorded by the server	Manage the waitlist and contact you about access
Tool content	Uploaded assets, optional reference images, filenames, prompts, style briefs, and generated outputs	Run the processing operations you request
Operation records	Job status and history, selected mode and provider, timestamps, estimated provider cost, and error information	Operate the tool, show results, diagnose failures, and track provider spend
Private access data	HTTP Basic Auth credentials presented to the reverse proxy and authentication-related request metadata	Restrict access to the private tool
Technical and analytics data	Page views and request metadata that may include IP address, requested URL, timestamp, referrer, browser, and device information	Operate, secure, and understand use of the Service

The public waitlist form submits an email address only. VibeReskin does not currently offer Google Sign-In or an application account, profile, or session. The private tool uses an HTTP Basic Auth gate at the reverse proxy.

2. How We Use Data and Legal Basis

Where GDPR or similar law applies, the legal basis depends on the activity and context. It may include:

Providing a requested service: Processing files, prompts, and settings to perform the operation you selected
Legitimate interests: Service security, abuse prevention, troubleshooting, provider-cost control, and proportionate usage analytics where permitted
Your request or consent: Recording a waitlist submission and contacting you about that request, where required by applicable law

3. Services and Network Providers

The exact services used depend on the operation and provider configuration. Data sent may include images, prompts, style instructions, filenames, and technical request metadata.

Service	Current Use	Data That May Be Sent
Google Gemini	Image generation, including the ImageGen tool	Prompts, reference images, generation settings, and request metadata
OpenAI	Configured image-generation option	Source images, prompts, generation settings, and request metadata
Anthropic Claude	Asset analysis, prompt generation, style wizard, and optional style critique	Uploaded images where analysis requires them, text prompts, style briefs, and request metadata
fal.ai	Background removal, upscaling, file transfer, and ByteDance Seedream processing when selected	Images, prompts, operation settings, and request metadata
Alibaba Cloud DashScope / Qwen	Optional fallback for analysis and prompt generation when configured	Images, prompts, and request metadata
analytics.vibereskin.com	Website analytics script loaded by the landing, application, and legal pages	Page-view and related browser or request metadata
Google Fonts	Font delivery on the main website and application	Font requests and associated network metadata
Hetzner	Current application-server hosting	Files and server records stored or transmitted through the hosted server

Each external provider handles data under its own terms, privacy policy, settings, and retention practices. Provider configuration can change, so contact us if you need the current provider used for a specific operation.

4. Data Storage & Security

The current application server is hosted with Hetzner in Finland. Uploaded assets, generated outputs, waitlist entries, job records, style data, and provider-cost records are stored in server files.

Current technical controls include:

HTTPS/TLS for the public website and private tool
HTTP Basic Auth on the private application host
A backend API key injected server-to-server rather than embedded in the production browser bundle
The backend service bound to the server's loopback interface in the production configuration

No storage or transmission method can eliminate every security risk.

5. Data Retention

Waitlist entries: The current code has no automatic expiry schedule. Entries remain until they are removed through an operator action or a valid deletion request.
Uploaded assets and generated outputs: The current code has no account-based or automatic 30-day deletion workflow. Files remain until deleted through the tool, removed by an operator, or cleared during operational maintenance.
Job, history, style, and provider-cost records: These remain in server files until operational cleanup or a valid deletion request is completed. No fixed 12-month anonymization schedule is implemented in the current code.
Browser local storage: Remains in that browser profile until you reset the relevant setting or clear site data.
Server, analytics, and provider logs: Retention depends on the current server and external-provider configuration.

6. Your Rights and Choices

Depending on where you live and the law that applies, you may have rights to:

Access — Request a copy of your personal data
Rectification — Correct inaccurate data
Erasure — Request deletion of eligible data
Data portability — Receive your data in a machine-readable format
Restriction — Restrict processing of your data
Objection — Object to processing based on legitimate interest
Withdraw consent — Where processing relies on consent

To make a request, email alexan.sitnikov@gmail.com. Include enough information to locate the relevant waitlist entry, file, or run. We may need to verify the request before acting on it. Rights and response periods vary by jurisdiction.

7. Cookies, Authentication, and Local Storage

The current VibeReskin frontend does not create an application account or set an application authentication/session cookie. Access to the private tool uses HTTP Basic Auth: your browser sends an Authorization header to the reverse proxy and may remember the credential according to browser behavior.

The frontend uses browser local storage for:

Selected visual palette and an optional developer-tweaks flag
Favorite style-preset identifiers
Cumulative, last-job, and per-output provider-cost estimates
Paid-request safety records: random idempotency keys, operation labels, compact request fingerprints, timestamps, and associated job identifiers (not raw prompts or image bytes)

The frontend also uses session storage to remember an active generation job within the current browser tab.

The current frontend does not write uploaded image bytes to local storage. The Service also loads the analytics script described in Section 3. Its network requests and any browser storage it uses depend on the current analytics configuration and browser controls.

8. Children's Privacy

The Service is designed for professional game-asset workflows, not for children. Do not submit a child's personal data without any consent required by applicable law. If you believe a child has submitted personal data, contact us so we can review the request.

9. International Processing

The services listed in Section 3 may process data in countries outside your own. The location and transfer mechanism depend on the selected provider, its current infrastructure, and the law that applies. Review the relevant provider's privacy information before using an operation if cross-border processing is a concern.

10. Changes to This Policy

We may update this page when the Service, providers, or data flows change. The "Last updated" date at the top shows the date of this version. Material changes may also be posted on the Service.

11. Contact & Data Protection

For any privacy-related questions or to exercise your rights:

Oleksandr Sitnikov
Email: alexan.sitnikov@gmail.com
Location: Kyiv region, Ukraine

Where applicable, you may also be able to contact the data-protection or privacy authority in your jurisdiction.