Privacy Policy

• Account details — your email address and display name. If you sign in with Google, Google passes us your email and name; we never receive your Google password.
• Photos you upload — the images from each session, up to 250 per session. These are stored so we can curate them, show you the results, and keep your session library and history available to you.
• Session content and feedback — session names, session types, the content types you request, the generated captions and copy, your star ratings, and your per-frame “keeper” / “not quite” marks.
• A personalisation (style) profile — a short set of descriptive traits built up over time from the frames and results you respond well to, used to make future curations feel more like your work.
• Subscription status — your plan, free sessions used, and Stripe customer and subscription identifiers. We do not see or store your card number, CVC or bank details — those go directly to Stripe.
• Basic technical data — standard server and error logs (such as request times and error messages) needed to keep the app running and secure.

We collect only what we need in order to:

• create and secure your account and sign you in;
• run curation on a session and generate the content you asked for;
• keep your past sessions available in your library;
• improve the results we give you personally, using your own feedback;
• manage your free tier, subscription and billing;
• respond to your support requests and meet our legal obligations.

We do not sell your personal information, and we do not use it for advertising or profiling unrelated to the service.

This is the part that matters most, so we'll be direct about it. When you upload a session:

• your images are stored in our backend infrastructure (Supabase) under your account;
• downsized copies of them are sent to Google Gemini, via Lovable's AI gateway, so the model can score them for focus, light and storytelling strength and pick the strongest frames;
• a small number of frames you responded positively to may be sent again to that same AI service to describe the look and feel of your work (words like “warm” or “moody”) for your personalisation profile;
• the full-resolution versions you see in the gallery are shown from your own uploads and are never published anywhere by us.

Because a third-party AI provider processes your images, please don't upload photos you aren't comfortable being processed that way, or that you don't have the necessary rights or subject consent for. You retain full ownership of every image; we take no license beyond what is needed to run the service for you.

We use a small number of trusted providers. Some of them store or process data outside Australia, which means your information may be handled overseas (including in the United States and the European Union). We take reasonable steps to use reputable providers with their own security and privacy commitments.

• Supabase — database, authentication and file storage for your account, photos and sessions.
• Stripe — subscription payments, card processing and the customer portal.
• Google (Gemini) — AI analysis of uploaded photos and generation of captions and content.
• Lovable — hosting, infrastructure and the AI gateway that routes requests.

We may also disclose information where we're required to by Australian law, or where it's necessary to prevent serious harm or investigate unlawful activity.

• Photos and sessions — kept while your account is open so your library stays useful. Delete a session and its images and results are removed.
• Account and profile data — kept while your account is open.
• Feedback and style profile — kept while your account is open, so personalisation keeps working; removed with your account.
• Billing records — retained by us and by Stripe for as long as required for tax and financial record-keeping obligations in Australia (generally five years), even after you cancel.
• Deletion requests — we action account deletion within 30 days of your request, other than records we're legally required to keep.

Access to your data is restricted to your own account through row-level database security, and traffic is encrypted in transit. Payment card data never reaches our systems. No online service can promise perfect security, so please use a strong, unique password and let us know immediately if you suspect a problem.

You can, at any time:

• Access your personal information — ask us for a copy of what we hold about you;
• Correct anything inaccurate or out of date, either in the app or by asking us;
• Delete your sessions and photos in the app, or ask us to delete your account and associated data entirely;
• Complain if you think we've mishandled your information.

Email bsquire61@gmail.com for any of the above. We'll respond within a reasonable time, usually within 30 days. If you're not satisfied with how we handle a privacy complaint, you can escalate it to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Treetop Creative is a professional tool for people aged 18 and over. We don't knowingly collect information from minors. If you believe a minor has created an account, please contact us and we'll remove it.

We use only what's needed to run the app: a session token stored in your browser so you stay signed in, and Stripe's own cookies during checkout. We don't run advertising or cross-site tracking cookies.

As the service evolves we may update this policy. When a change materially affects how we handle your information, we'll update the “as of” date at the top and notify you by email or in the app before it takes effect. Our Terms of Service cover the rest of your agreement with us.

Privacy contact: bsquire61@gmail.com.