Privacy Policy

1. Information we collect

We only handle what is needed to run the service:

• Photos and prompts. The photo you choose to edit and the text prompt describing the edit, sent when you generate a prank.
• Generated images. The AI-edited results, which are saved in your browser on your device and in private storage on our servers (see Section 3).
• Sign-in details (optional). If you choose to sign in with Apple or Google, we receive an account identifier from that provider and, if you allow it, your name and email address. When you sign in, your email and name are kept in the signed session cookie on your device and in our account database, and your account ID is stored with your Stripe customer record so your subscription can follow you across devices. Apple and Google receive nothing from us beyond the standard sign-in. You can use TrickerAI without signing in.
• Subscription information. If you subscribe, our payment provider Stripe collects your payment details and email address. We receive your Stripe customer ID and your subscription status (plan, trial and renewal), never your full card number. To enforce the weekly limit, we keep the times of your recent generations with your subscription record at Stripe. If you are signed in, your account identifier (and your name and email, if shared) is stored there too, so signing in on another device restores your subscription.
• Technical data. Like any website, our hosting provider receives standard request information such as your IP address, browser type and the time of each request.

We keep this information in our own database and private file storage as described in Section 3, and we don't collect anything beyond what is listed here.

2. How your photo is processed

When you generate a prank, your photo and prompt are sent over an encrypted connection to our server, which forwards them to xAI's Grok image API to create the edited image. The result is sent back to your browser, and our server saves your photo, your prompt and the generated image in private storage (see Section 3) so you can find your pranks again. xAI processes the image under its own terms and privacy policy, available at https://x.ai/legal/privacy-policy. The create screen tells you this next to the Generate button, and sending your photo to xAI is part of the service you ask for when you tap it.

Because your photo leaves your device for this step, only upload photos of yourself or of people who have agreed, and don't upload sensitive images (for example ID documents, photos of minors, or anything you wouldn't want processed by a third-party AI service).

3. Where your data lives

Your pranks (the photo you used and the edited result) are stored in your browser's storage (IndexedDB) on your device, and app preferences, such as whether you've finished onboarding, are kept in your browser's local storage.

We also keep a copy on our servers: your photos and the edited results are stored in private file storage on Vercel Blob (private storage, United States region), which is never publicly accessible; the app shows them to you through links that expire after about an hour. Your prompts, prank details, account details (account identifier, name and email if shared) and subscription status (Stripe customer ID, plan, trial and renewal dates) are stored in a Postgres database hosted by Neon (United States region). This data is linked to your Apple or Google account if you are signed in, otherwise to this browser through a random identifier in a cookie. When you sign in, pranks made in this browser before signing in are moved to your account, so you can see them on your other devices when signed in.

We keep this data until you delete it. Data that isn't linked to a signed-in account is deleted automatically after 90 days without any activity from that browser.

While you check out, the photo and prompt you prepared are kept temporarily in your browser's session storage so the app can finish your prank when you return; session storage is cleared when you close the tab. Settings → Delete all data removes your pranks and app data from this browser and from our servers (for your account if you are signed in, and for this browser) and signs you out (deleting the session cookie). Deleting a single prank removes its photos from our servers too. You can also ask us to delete your data by emailing sigsten.gustavii@gmail.com. It doesn't cancel your subscription: you can get it back on this browser by signing in again or with an access link.

4. Cookies

We only use first-party cookies that are strictly necessary to provide the service you asked for. They can't be read by scripts on the page, and the ones that hold data are signed so they can't be tampered with:

• tk_sess (up to a year): set when you subscribe or sign in. It contains your Stripe customer ID and, if you signed in, your account identifier, name and email, so our server can recognize your subscription.
• tk_dev (up to a year): a random identifier for this browser, set when you create your first prank. It links pranks made without an account to this browser, so you can see them again, and binds a locked free preview to the browser that created it.
• tk_fp (up to a year): records that this browser has used its free preview.
• tk_co (up to a day): a one-time code that ties a Stripe checkout to the browser that started it, so nobody else can claim your purchase.
• tk_apple_req (up to 10 minutes, only while signing in with Apple): a one-time security code that protects the sign-in from being hijacked.

We don't use advertising, analytics or tracking cookies, and we don't sell your data or share it for advertising. Apple, Google and Stripe may use their own cookies on their sign-in and payment pages, under their own policies.

5. Using TrickerAI on another device

To use your subscription on another device, sign in there with the same Apple or Google account, or use Settings → Copy access link. The access link is signed and valid for 30 days, and anyone who has it can use your subscription on their device, so keep it private and only open it on your own devices.

6. Third-party services we use

• xAI (Grok API) processes photos and prompts to generate edited images.
• Stripe processes subscription payments, stores your billing details and subscription, and runs the billing portal. See stripe.com/privacy.
• Apple and Google provide optional sign-in (Sign in with Apple, Sign in with Google). They confirm your identity and share the details described in Section 1.
• Vercel hosts this website and the server functions that relay requests to xAI and Stripe, and stores your photos and generated images in private Vercel Blob storage (United States region). Vercel logs standard request metadata (such as IP address, browser type and timestamps) for operations and security.
• Neon hosts our Postgres database (United States region) with your account details, prank details and subscription status. See neon.com/privacy-policy.

These providers may process data in the United States and other countries. Where required, they rely on safeguards such as the EU Standard Contractual Clauses.

7. Legal bases (EEA and UK)

If you are in the EEA or the UK, we process your data to provide the service you asked for (generating pranks, which includes sending the photo you choose to xAI to create the edit, and running your subscription), to meet legal obligations (for example keeping billing records), and for our legitimate interest in keeping the service secure and working (hosting logs).

8. How long we keep data

• Photos, prompts and generated images: kept in our private storage until you delete them (a single prank, or everything with Delete all data) or ask us to. If you are not signed in, they are deleted automatically after 90 days without activity from your browser.
• Account and subscription details in our database: until you use Delete all data or ask us to delete them; for browsers without a signed-in account, 90 days after the last activity.
• Pranks on your device: until you delete them, clear your browser's site data, or use Delete all data.
• Sign-in details: in the cookie on your device until it expires (a year after your last visit) or you clear it, and with your subscription record at Stripe if you subscribe while signed in.
• Subscription and billing records: kept by Stripe while your subscription is active and afterwards as required for tax, accounting and legal purposes.
• Generation times: used only to enforce the rolling weekly limit.
• Hosting logs: kept by Vercel for a limited period as part of normal operations.

9. Your choices and rights

You can delete your pranks, app data and session cookie at any time with Settings → Delete all data (which also deletes the copies on our servers) or clear this site's data in your browser, and sign out with Settings → Log Out. You can cancel your subscription at any time from Settings → Subscription, which opens the Stripe billing portal.

Depending on where you live (for example in the EEA or the UK), you have the right to access, correct, delete or port your personal data, to object to or restrict its processing, to withdraw your consent, and to lodge a complaint with your data protection authority. Settings → Delete all data deletes your photos, pranks and account details from our servers as well as from this browser; you can also email sigsten.gustavii@gmail.com to access or delete your data. For subscription data, contact us and we'll help, including with requests to Stripe.

10. Children

TrickerAI is only for people aged 18 and over. It is not directed at children and we don't knowingly collect information from children. If you believe a child has used the service, contact us and we will help remove any related data.

11. Changes to this policy

If this policy changes, we will update the "Last updated" date above and, for material changes, let you know in the app before they take effect.

12. Who is responsible and how to contact us

The data controller is Sigsten Gustavii, Sweden (TrickerAI). Questions about this policy or your data, or to use your data protection rights: sigsten.gustavii@gmail.com. You can also complain to the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.