Privacy Policy

Information We Collect

• Account data: Your name, email address, and profile details (such as an avatar, bio, or portfolio link) captured when you sign up through our sign-in provider.
• Uploaded content: Product photos, character (face) reference photos, style references, brand assets, and any other images or files you upload. Face reference photos may include images of real people, which can constitute biometric or sensitive data (see "Faces and Likeness" below).
• Generated content: The images and videos Icarus produces for you, along with the briefs, prompts, and settings used to make them.
• Chat messages: The conversations you have had with Icarus in the app, including instructions and feedback, so it can act on your requests and remember context.
• Texts with Icarus: If you message Icarus in iMessage, Telegram, Slack, Discord or Instagram: your phone number (or the email your iMessage uses), or your account id in that app (and your name on Telegram and Instagram), the messages, photos and files you send, and the replies. In a Telegram group, a Slack channel or a Discord server, Icarus keeps only the messages meant for it; the rest are dropped unread.
• Memory & instructions: The facts you ask Icarus to remember, the instructions you write for it in Settings, and whether you have turned Memory off.
• Taste & feedback: The looks you save, like, or rate, which we use to tailor future results to your taste.
• Connected-app data: If you connect a third-party app (for example Gmail, Google Drive, Notion, or Slack), we receive the access tokens and the specific data needed to perform the actions you ask for. Tokens are encrypted and never shared.
• Billing data: Your plan, your balance, and your transaction history. Card details are handled directly by our payment processor; we do not store full card numbers.
• Agreement records: When you agree to our Terms, we record who agreed, the date and time, the version of the Terms, and the IP address and browser used. We keep this so we can show what was agreed if a payment is ever disputed.
• Usage & device data: How you interact with the platform (generations, credit usage, features used), plus standard technical data such as IP address, browser type, and log events, used for analytics, security, and debugging.

How & Why We Use Your Information

We use your information for these purposes, each with a plain-language legal basis:

• To generate images and videos and run the studio (to perform our contract with you).
• To manage your account, workspace, credits, and subscription (to perform our contract with you).
• To route and answer your messages in the app and by text (to perform our contract with you).
• To send essential communications such as invitations, receipts, and security alerts (to perform our contract, and our legitimate interest in operating the service).
• To tailor results to your taste and improve the product experience (our legitimate interest; you can ask us to stop).
• To detect, prevent, and address abuse, fraud, or unauthorized access (our legitimate interest in keeping the platform safe).
• To answer a payment dispute or chargeback, by showing our bank and yours what was agreed, what was paid, and what was delivered (our legitimate interest in defending a legal claim, and compliance with payment network rules).
• To meet tax, accounting, and other legal obligations (compliance with a legal obligation).

We do not sell your personal data, and we do not show you third-party advertising.

AI Models & Training

Icarus does not build its own foundation models. To generate images and videos and to answer chat messages, we send your uploads, prompts, and messages to third-party AI providers (listed below), who process them to return a result. We use their APIs under commercial terms.

We do not use your uploads, generated images, or messages to train foundation models, and we instruct our AI providers not to train their models on your content where that option is available. We do use your saved looks and feedback to personalize your own results, but this is retrieval-based tailoring, not foundation-model training.

Faces & Likeness

When you upload a face reference photo, you confirm you have the right to use that person's image and their consent to generate new images of their likeness. Depending on where you live, facial images can be treated as sensitive or biometric data. We process them only to produce the images you request, we do not use them for facial recognition or identity matching, and you can delete them at any time. We never sell photos, faces, or the images and videos you make. Never upload a photo of someone who has not agreed to it.

If an image or video on Icarus shows you without your consent, see Takedown requests to have it removed.

Shared Content

When you share a video to the Icarus Library, it becomes public: the video, the photos it was made from, its prompt, and your workspace name can be seen by everyone who uses Icarus and on our public Library pages. It stays public until you unshare it or we take it down. Only share photos of people who have agreed to it. Unsharing removes it from the Library and our public Library pages.

Third-Party Sub-Processors

We rely on trusted vendors to run the platform. Each processes data only to provide its service to us and is bound by its own data protection terms. Grouped by purpose:

• Hosting & storage: Supabase (managed PostgreSQL database), Bunny CDN (image and video storage and delivery).
• Authentication: Google Firebase Authentication (sign-in and account security).
• Payments: Stripe (subscriptions and credit purchases).
• AI generation: Google (Gemini), OpenAI, Anthropic, fal.ai, and Higgsfield for image, video, and text generation, reached directly or through the Vercel AI Gateway. Anthropic also runs Icarus by text and holds each text conversation while it is open.
• Texting: Sendblue (carries iMessages between you and Icarus), Telegram (carries Telegram messages), Slack (carries Slack messages), Discord (carries Discord messages), Meta (carries Instagram messages) and Microsoft Azure (hosts the server that answers them).
• Integrations: Composio (secure OAuth and actions for connected apps such as Gmail, Drive, Notion, and Slack), Jina (reading a public web page to pull brand assets), Google Maps (locations for virtual studios), and Pinterest and Cosmos (reference and moodboard search).
• Memory: The memory you save with Icarus is kept by Supermemory or in our own database on Supabase. For notes in our database, OpenAI turns each one into a search fingerprint.
• Analytics & monitoring: PostHog (product analytics, screen recordings of signed-in use when you allow usage stats, logs, error monitoring, and AI observability), Vercel (visit counts and page speed), Agnost AI (AI-conversation analytics, which receives your chat messages to and replies from Icarus, along with a user and session identifier, to help us measure and improve the product), and Slack (internal signup notifications to our team).
• Email: Resend (transactional emails such as invitations and receipts).
• Support: Crisp (in-app support chat).
• Advertising: Google Ads and Whop (measuring which ads lead to sign-ups and purchases, only with your consent).

Data Storage & Security

We encrypt data in transit (HTTPS/TLS) and encrypt sensitive secrets, such as connected-app tokens and any API keys you store, at rest. API keys are stored only as hashes, never in plain text. Generated media is delivered through a global content delivery network for fast, reliable access. No system is perfectly secure, but we work to protect your information at every stage and limit access to it.

Data Retention

• Uploads & generated content: Retained while your account is active. You can delete individual items, or your entire account, at any time.
• Account & chat data: Kept while your account is active. After deletion, we retain minimal records briefly for recovery and abuse prevention, then permanently erase them. We keep a small record of deleted accounts to prevent ban evasion and repeated free-credit signups.
• Texts with Icarus: A text conversation, and the photos and files sent in it, are kept until you start a new one (text /new) or sign out (text /unlink). Then they are deleted. Shots made by text stay with your other generated content.
• Payment & billing records: Retained as required by applicable tax and financial regulations.
• Agreement records: Kept for as long as a payment can still be disputed, and for as long as we must keep the payment it relates to. These records are only ever added to, never edited.

International Transfers

Your data may be processed in the United States, India and other countries where our providers operate, which may be outside the country you live in. Where required, we rely on appropriate safeguards for these transfers.

Cookies

Cookies and browser storage are small files a site keeps in your browser. The first kind below is always on, because the site does not work without it. In the EU, the UK and Switzerland, and wherever we cannot tell your country, the rest stay off until you say yes. Everywhere else, usage stats and support chat start on and advertising stays off until you say yes. You can change your answer any time in Cookie settings.

• Essential: Google Firebase Authentication keeps you signed in. A security cookie from our server blocks forged requests. We also remember your theme, your workspace, a few layout choices, your cookie choice and your country, so the right cookie rules apply. Payments happen on Stripe's own checkout page, under Stripe's cookie rules.
• Usage stats: PostHog records which pages you open, what you click and errors you hit, using cookies and browser storage. When you are signed in, PostHog also records your screen as you use the app, so we can see where things go wrong. Anything you type is hidden in these recordings. Vercel Web Analytics and Speed Insights count visits and measure page speed without cookies.
• Support chat: Crisp runs our support chat and sets cookies to keep your conversation. With your yes it starts in the background so replies reach you. Without it, Crisp starts only when you open the chat.
• Advertising: The Google Ads tag and the Whop pixel tell Google and Whop when a visit leads to a sign-up or a purchase, so we can measure our ads. Whop can pass this to Meta. If your browser sends a Global Privacy Control signal, this stays off.

Cookie settings opens your choices. It is also at the bottom of every page.

Your Rights

You are in control of your data. Depending on where you live, you may:

• Access: Request a copy of the personal data we hold about you.
• Export: Request an export of your data in a portable format.
• Delete: Delete your account and associated data from Settings, or ask us to do it for you.
• Correct: Fix inaccurate information through your account settings or by contacting us.
• Object or restrict: Ask us to stop or limit certain processing, such as taste personalization. For Icarus by text, you can turn Memory off yourself in Settings.

To exercise any of these, email us at the address below. We will respond within the timeframe required by applicable law.

Children

Icarus is intended for adults. It is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a minor has used the platform, contact us and we will remove the account.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the platform. The "Effective" date at the top always reflects the most recent revision.

Contact

Questions about this policy or your data? Reach out at [email protected]. We aim to respond within 48 hours. For legal notices, contact Plaitr Technology LLC at [email protected].