Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, and password when you register
• Profile information: Profile photo, display name, and preferences you set
• Payment information: Billing details processed by Stripe (we do not store full card numbers)
• Content inputs: Text prompts, reference images, and other creative inputs you submit for AI generation
• Generated content: Images, videos, and other media created through the Service
• Communications: Messages you send to us via email or support channels

1.2 Information Collected Automatically

• Usage data: Features used, generation history, credit consumption, and interaction patterns
• Device information: Device type, operating system, browser type, and screen resolution
• Log data: IP address, access times, pages viewed, and referring URLs
• Approximate location at signup: When you create an account, we derive your country (not a precise location) from your IP address, to apply region-specific rules such as whether marketing-email consent requirements under EU/EEA/UK law apply to you. We store only the resulting two-letter country code, not the IP address itself, for this purpose
• Cookies and similar technologies: Essential cookies for sign-in, payments, bot protection and fraud prevention, and (subject to your choices) analytics cookies for service improvement — see Section 6.5
• Fraud-prevention identifiers: To stop one person from opening several accounts to collect extra free credits, our site sets a first-party cookie that holds a random device identifier. It lasts up to 400 days, cannot be read by other websites, and is not used for advertising or analytics. When you create an account, we record that identifier together with a keyed, one-way hash of the IP address you signed up from (we do not store the address itself). If a new account appears linked to an earlier free account, we may limit its free allowances or take back free promotional credits it has not spent. Credits you paid for are never taken back this way. We do this on the basis of our legitimate interest in preventing fraud and abuse of free offers. If you think we got it wrong, contact us (Section 12) and a person will review it. See Section 4.2 for how long these records are kept
• Error reports: When something breaks, technical details of the error (browser, page, stack trace) are sent to our error-monitoring provider, with prompt text and email addresses removed
• Session recordings (only with your consent): If you turn on "Session replay" in Cookie settings, we record how you interact with pages (clicks, scrolling, page changes) to find and fix problems. Everything you type is masked, and text that looks like an email address, phone number or card number is masked. Recording never starts without your opt-in, and it stays off whenever your browser sends a Global Privacy Control or Do Not Track signal. Recordings may be analysed by automated AI tools operated by our analytics provider (PostHog) and its sub-processors, including Google, to find usability problems

1.3 Information from Third Parties

• Authentication providers: If you sign in with Google, Apple or Microsoft, we receive your name and email address from that service
• Fraud and abuse prevention: When you sign up, your email address may be checked with an email-reputation service to detect disposable or abusive addresses
• Payment processor: Stripe provides us with transaction confirmations and subscription status
• Operational notifications: When you sign up, a notification containing your name and a redacted form of your email address may be sent to our team's internal messaging channel (Telegram) so we can monitor new registrations. This is used only for operational awareness and abuse monitoring
• YouTube (optional): If you connect a YouTube account to publish content, we store the OAuth access and refresh tokens needed to upload on your behalf. We request only the upload scope, and tokens are revoked and deleted when you disconnect or delete your account

Google API Services. FXI Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to upload the videos you choose to publish; we do not use it for advertising, sell it, or use it to train AI models.

1.4 Biometric and Facial Information

If you use features that register a character from a selfie or photo (e.g. Cast registration, subject segmentation), you provide images that contain facial features. We use these solely to generate and edit your requested content. To do so, these images are transmitted to third-party AI processors (our image-generation and image-segmentation providers — see Section 3) that perform the generation or segmentation on our behalf. We do not use facial data for identification, and we do not sell it.

Outputs created from images of your face are private by default and are only made public if you publish them. We do not use facial images to identify you, until and unless you enrol in verified self-likeness, which will be governed by a separate biometric notice and consent.

Photos you upload through selfie registration are kept in private storage and shared with providers only through short-lived links. Other character and reference photos, including most characters registered before that flow existed, are stored as files at unlisted web addresses: anyone who has the exact link to one of these files can open it, and that link is what we send to the provider. Deleting your account removes the character images stored in your account's folders. Deleting a single character currently removes it from your account but does not yet erase its image files from storage; to have them erased, email privacy@fxi.studio and we will delete them within 30 days.

1.4A Camera Tools (Atmosphere and CRT Cam)

In short: Atmosphere and CRT Cam are free browser tools that use your device camera. Everything they do to your camera picture, including on-device background segmentation, happens in your browser, and nothing from your camera is sent to us while you use them. A single frame leaves your device only if you are signed in and choose "Turn this into a video — free." That frame is kept in private storage that only your account can access, and it is deleted automatically. These tools do not perform facial recognition, and they do not identify you.

• When the camera turns on: Only after you click to start a tool and your browser asks for, and you grant, camera permission. You do not need an account to use the tools. The camera stops when you stop the tool, leave the page, or switch away from the tab. Camera access is limited to fxi.studio pages: embedded content from other websites cannot use it through our pages
• Processing on your device: Effects and background segmentation run in your browser. Segmentation estimates, frame by frame, which pixels show a person and which show the background, so the tool can change the background. That mask stays on your device and is not sent to us. Our session-recording tool (Section 6.5) is configured not to record the camera picture
• No biometric identifiers: We do not use these tools, or any frame you send us from them, to recognize or identify anyone. We do not create a scan of face geometry, a faceprint or any other biometric identifier or template from them, and we do not match camera images against other images or people
• If you turn a frame into a video: Choosing "Turn this into a video — free" (which requires signing in) uploads one frame to a private storage area that only your account can access; it is not published or publicly reachable. To make your video, the frame is shared with our AI video providers (Section 3) through a link that expires after about one hour. Those providers handle it under their own retention terms (Section 6.3)
• How long we keep the frame: Whether or not you go on to make a video, the uploaded frame is deleted automatically once it is 24 hours old, by a cleanup that runs every day, so it is gone no later than 48 hours after upload. The same private, automatically deleted staging is used for images you stage for a storyboard in Board Chop
• The video you make: A video you create from the frame is a generation like any other, and it may show you. It is stored, scanned and displayed under the same rules as your other generations (Sections 2, 2.2 and 4): it is private by default on every plan and becomes public only if you choose to publish it. You can delete it at any time (Section 4.2)
• Legal bases (EEA/UK): Camera use relies on your consent, which you give by starting a tool and granting browser permission. Uploading a frame and making a video relies on performing the service you asked for (contract). Storing and safety-scanning the resulting video rely on the same bases as your other generations (Section 8)
• Your controls: You can withdraw camera permission at any time in your browser or device settings; the tools then stop working until you grant it again. To delete a video made from a frame, delete it from your library; to have an uploaded frame deleted before it expires, email privacy@fxi.studio. Your other rights are described in Section 6
• Children: Like the rest of the Service, the camera tools are not directed to children under 18 (Section 9). Do not use them to capture other people without their permission

2. How We Use Your Information

We use collected information for the following purposes:

• Provide the Service: Process your prompts through AI models, store your generated content, manage your account and credits
• Improve the Service: Analyze usage patterns to optimize features, fix bugs, and develop new capabilities
• Billing and support: Process payments, manage subscriptions, and respond to your inquiries
• Communication: Send transactional emails (account verification, password reset, billing receipts) and, with your consent, marketing communications
• Safety and compliance: Detect and prevent fraud, abuse, and violations of our Terms of Service
• Legal obligations: Comply with applicable laws and respond to legal requests
• Visibility of your content: Content you create on FXI Studio is private by default on all plans. It is not shown on our public pages and is visible in the Service only to you; a collection you share shows other people only the items in it that you have published. Media files themselves are stored at unlisted web addresses (Section 4.1): anyone who has the exact link to a file can open it. When a published item becomes private, we move its file to a new unlisted address and ask our content delivery network to drop cached copies of the old address; this can take a short time to complete. If you choose to Publish an item, it and its title may be displayed publicly on FXI Studio, for example on community pages. Prompts are not displayed publicly unless you choose to include them. You can unpublish at any time; we will remove the item from our public pages promptly, though copies others have already made or cached may persist for a period. If you opt in to have your work considered for Featured, and we select it, we may display it on our website and marketing channels with the credit you choose, under the licence in our Terms. Do not include personal or sensitive information in content you publish
• Legal basis for publication: Publishing relies on your consent, which you give by choosing Publish for an item. You can withdraw it at any time by unpublishing the item
• Publish confirmations: When you publish an item you confirm that you have the rights to it and that everyone recognisable in it agreed to it being public. We keep a record of that confirmation (your account, the item, the time and your IP address) to handle rights and abuse complaints
• Items that were public before October 2026: When we made all content private by default, we made items that had been public on free accounts private. For 30 days after that change you can republish them in one step from your library; an item becomes public again only once it has passed our automated safety scan, and items that were never scanned are scanned first

2.1 AI Content Processing

Your text prompts and reference images are transmitted to third-party AI model providers solely for the purpose of generating content you request. We do not use your prompts or generated content to train our own AI models. Third-party providers may have their own data processing practices — see Section 3 for details.

2.1A AI Content Labels

Files generated through the Service carry a machine-readable label identifying them as AI-generated (an industry-standard "digital source type" value and the tool name "FXI Studio"). The label does not contain your name, email, account ID, prompt, or location. It stays in the file when you download or share it, so anyone who receives the file can see that it was made with AI.

2.2 Automated Safety Scanning

All generations, including private ones, are automatically scanned for safety and legal compliance. The scan looks at the prompt and the generated image or sampled video frames (for audio, the prompt). Our trust and safety team may review content the scan flags, and we keep records of enforcement decisions. Scanning never makes private work public: your visibility settings still decide who can see it.

3. Third-Party Services

We share information with the following categories of service providers, each acting on our behalf under its own privacy terms. We describe recipients by category (GDPR Art. 13(1)(e)); a current list of the specific providers is available on request from privacy@fxi.studio.

4. Data Storage and Retention

4.1 Storage

Your data is stored with our cloud database, storage and hosting providers, primarily in the United States. Your account and generation records are protected by database access rules tied to your account, so private records are visible only to you (public generations are visible to everyone). Media files are stored differently: generated images, videos and audio, and the reference images and other files you upload, are stored as files at unlisted, hard-to-guess web addresses and served through our content-delivery network. Anyone who has the exact link to a file can open it, whether the generation is public or private, and those links are what we send to AI providers to process your request. Photos from selfie registration, editing masks and editor exports are kept in private storage and shared only through short-lived links.

4.2 Retention

• Account data: Retained while your account is active and for 30 days after deletion
• Generated content: Retained while your account is active; deleted upon account deletion (see Section 6.3). Deleting a single generation from your library removes its output files right away; reference images you uploaded for it are removed when you delete your account. Hiding a generation is not deleting it: hidden items are kept and may be permanently deleted 30 days after you hide them
• Cached copies: After a file is deleted, copies cached by our content-delivery network can stay reachable at the old link for up to 30 days, and copies may remain in the browser caches of people who viewed it
• Usage logs: Retained for up to 12 months for analytics and debugging
• Signup and security logs: The IP address, browser details and email address recorded at signup or during abuse checks are removed after 90 days, or as soon as you delete your account if sooner. A one-way hash of the email address may be kept to block repeat abuse
• Fraud-prevention records: The hashed signup IP address and device identifier recorded for an account (Section 1.2) are deleted after 90 days, or as soon as you delete your account if sooner
• Payment records: Retained as required by tax and financial regulations (typically 7 years)
• Waitlist data: Email addresses retained until the waitlist is closed or you request removal

We keep records of content moderation and enforcement decisions for as long as needed to enforce our policies, handle appeals, and meet legal obligations: generally 3 years after a warning expires and 7 years after an account is terminated. Content reported to the National Center for Missing & Exploited Children is preserved as the law requires. Content subject to a legal hold is kept until the hold is released.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/HTTPS) for all data transmission
• Encryption at rest for stored data
• Database access rules (row-level security) so that your private account and generation records are visible only to you; media files are reachable by anyone with their link, as described in Section 4.1
• Secure authentication with hashed passwords and optional social sign-in
• API keys stored in encrypted secrets management, never exposed to clients

No system is completely secure. While we strive to protect your data, we cannot guarantee absolute security and are not responsible for unauthorized access resulting from factors beyond our reasonable control.

6. Your Rights and Choices

6.1 Access and Portability

You may access your account data, generation history, and stored content through the Service at any time. You may export your generated media from the library.

6.2 Correction

You may update your account information through your profile settings.

6.3 Deletion

You may delete your account in your account settings (accounts that use Google, Apple or Microsoft sign-in confirm with a code we email to you), or request deletion by contacting privacy@fxi.studio. We will process deletion requests within 30 days, except where retention is required by law. Account deletion removes your profile, your generation records, and the generated and uploaded files stored in your account's folders; cancels any active subscription; and deletes your customer record (including billing email) at our payment processor, which keeps its own invoice and transaction records as tax and financial law require. Signup and security logs are de-identified, and content-safety logs are retained without your media, as described in Section 4.2.

Some data is not yet removed automatically when you delete your account: a small number of files stored outside your account's folders (for example some character sheets, character reference images and duet images), your analytics profile, and records held by our email delivery provider. Email privacy@fxi.studio and we will delete these within 30 days. Copies cached by our content-delivery network can stay reachable for up to 30 days after deletion (see Section 4.2). Files and prompts sent to third-party AI providers are kept or deleted under those providers' own retention terms.

6.4 Marketing Opt-Out

You may unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email. Transactional emails (billing, security alerts) cannot be opted out of while your account is active.

Unfinished checkouts. If you start a purchase, tick the box at checkout to receive news and offers, and then leave without paying, the checkout eventually expires. We may then send you one reminder email with a link to pick up where you left off; the link works for up to 30 days. We send it only if you ticked that box, have not unsubscribed from our marketing emails, and have not since bought the same item. To make the link work, our payment processor (Stripe) keeps the email address and the items from your unfinished checkout. You can unsubscribe at any time using the link in that email.

When a checkout expires unpaid, we also record an analytics event, whether or not you agreed to marketing emails, so we can understand why purchases are not completed. It contains the price, currency and plan or pack, the payment methods that were offered, the billing country if you entered one, how many minutes the checkout was open, and whether a reminder link was available. It contains no card details, name or email address, and it is not linked to your account or analytics profile. We record it on the basis of our legitimate interest in improving checkout.

6.5 Cookie Controls and Session Recording

Essential cookies (sign-in, payments, bot protection) are always on. Analytics is off by default for visitors in the EU, EEA and UK until they accept it, and can be turned off by anyone. Session recording is off for everyone until you opt in. You can change these choices at any time with the Cookie settings link in the site footer. If your browser sends a Do Not Track signal, we turn off product analytics and session recording entirely. If it sends a Global Privacy Control signal, we keep session recording off. You may also control cookies through your browser settings; disabling essential cookies will break sign-in.

Separately from analytics cookies, our servers record anonymised, aggregate service metrics (such as which tools and settings are used, how long generations take and whether they succeed) that are not linked to your identity, to keep the service reliable. These metrics contain no prompts, media, email addresses or IP addresses.

7. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to delete: Request deletion of your personal information
• Right to opt-out: Opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information)
• Non-discrimination: We will not discriminate against you for exercising your rights

We do not sell or share personal information for cross-context behavioral advertising, and we do not use sensitive personal information for purposes that would require offering a right to limit.

To exercise these rights, contact us at privacy@fxi.studio or use the mechanisms described in Section 6.

8. International Users

The Service is operated from the United States, and your information is processed in the United States and in other countries where our service providers operate. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable). You can ask us for a copy of the relevant safeguards at privacy@fxi.studio.

For users in the European Economic Area (EEA) or United Kingdom, we process personal data based on: (a) your consent, (b) contractual necessity to provide the Service, (c) our legitimate interests in operating and improving the Service, and (d) compliance with legal obligations. You also have the right to lodge a complaint with the data protection authority where you live or work, or, in the UK, with the Information Commissioner's Office.

If you are in the EEA or the United Kingdom, you can contact us directly about your personal data at privacy@fxi.studio or at the postal address in Section 12. If we appoint a representative in the EU or the UK, we will name them in this section.

9. Children's Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at privacy@fxi.studio.

10. Using FXI from AI Assistants (MCP Connector)

FXI Studio can be connected to AI assistants such as ChatGPT and Claude through a hosted connector at mcp.fxi.studio, built on the Model Context Protocol. This section describes what happens when you use FXI through that connector, in addition to the rest of this Policy.

10.1 Connecting and Signing In

Adding the FXI connector in a supported assistant takes you to a sign-in and consent screen hosted on fxi.studio. You sign in to your existing FXI account (or create one) and approve access for that assistant. Approving issues the assistant a short-lived access token and a longer-lived token it can use to stay connected without asking you to sign in again, both scoped only to using FXI's tools. We never share your FXI password or browser session with the assistant, only these scoped tokens, and we store only a one-way hash of each token, never the plaintext value. Some AI coding tools (for example Claude Code or Cursor) instead use a personal key you generate yourself in FXI account settings, which works the same way and can be managed from the same place described in Section 10.5 below.

10.2 What We Receive

• Tool requests: Each action you ask the assistant to take (for example, generating an image or video, checking your credit balance, or looking up a past generation) sends us only the specific fields that action needs, such as a text prompt, a reference image URL, a model choice, or a generation ID
• What we do not receive: The connector does not give FXI access to the rest of your conversation with the assistant. We see only the structured request for the specific action you invoke, not your broader chat history with ChatGPT, Claude, or any other assistant

10.3 What We Store

• Access and refresh tokens: The access token issued at sign-in expires after 1 hour. The refresh token that renews it expires after 60 days and can only be used once; using it issues a new one and invalidates the old one, and any attempt to reuse an already-used refresh token automatically ends that assistant's access as a safeguard against theft
• Prompts and generated media: Requests made through the connector create the same kind of generation record described in Sections 1.1 and 4.2 above (prompt, model, resulting media URL, credits used), stored and retained the same way as generations made through the website or app
• Connection activity log: We keep a record of each tool call (which action was used, your account ID, whether it succeeded, the generation ID and error code if any, credits spent, response time, and basic connection details such as IP address and user agent when the assistant provides them) for security and debugging. This log stores a hash of the request parameters rather than the raw prompt text, and it is deleted automatically after 90 days
• In-progress task state: Multi-step actions, such as chaining several video scenes together, are tracked in a temporary task record so the assistant can check on progress. This record holds the planned steps and their progress and is kept alongside your generation records

10.4 Moderation

Prompts and requests sent through the connector pass through the same automated safety and content-moderation checks described in Section 2.2, regardless of which assistant you used to send them.

10.5 Revoking Access

You can disconnect an assistant at any time from Settings → Connected assistants → Connected apps in your FXI account. Disconnecting there immediately revokes its access and refresh tokens, ending its ability to act on your behalf. If you connected using a personal key instead, you can revoke that key from the same settings page. You can also remove the connector from within the assistant itself, though disconnecting it in FXI settings as well ensures the underlying token stops working. Questions can be sent to privacy@fxi.studio.

10.6 Your AI Assistant's Provider

When you use FXI through an AI assistant, your conversation, including your requests to FXI and the results FXI returns (such as image or video links, generation details and your credit balance), is processed by that assistant's provider under its own terms and privacy policy, not this one. FXI does not control how that provider stores or uses your conversation.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. For significant changes, we may also notify you by email. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

For questions or concerns about this Privacy Policy or our data practices, contact us at:

Fueled by Imagination, LLC
PO Box 25553, Newark, NJ 07101
Email: privacy@fxi.studio