Privacy Policy

What we collect

To generate your pet's monster card, Critling processes:

• The photo you upload (compressed in your browser before transmission).
• An anonymous session identifier stored in your browser (localStorage) to prevent abuse and apply generation quotas.
• Your approximate country (derived from your IP via a third-party geo service) to enforce regional availability.
• Payment information is handled entirely by Creem (our Merchant of Record). Critling never sees your card number, billing address, or full name; we only receive a payment status and the product purchased.

Why we collect it

To provide the core service (generate the card), to enforce the per-session free quota, and to comply with payment-processor regional rules.

Third parties we share data with

• fal.ai — to generate the AI illustration from the card description. Your photo is not sent to fal.ai; only a text description derived from it.
• OpenRouter / OpenAI — to extract structured visual features (species, color, etc.) from your photo. The photo is sent to the vision provider and is not retained by us after feature extraction.
• Supabase — to persist card metadata (rarity, attributes, anonymized features) and your purchase history.
• Creem — to process payments on our behalf as Merchant of Record.
• ipapi.co — to look up your country from your IP for regional compliance. Your IP is sent to ipapi.co; they do not receive your photo or any other Critling data.

Cookies and storage

We use a single first-party cookie (critling_geo) to cache your country for 24 hours so we don't re-query the geo provider on every page load. We do not use advertising cookies or third-party tracking cookies.

Retention

Your uploaded photo is not stored on our servers; it is processed in memory to extract features and generate the card. The generated card metadata (no photo) is kept so you can revisit your card via the same browser session. Generated illustrations are cached by image hash to avoid re-generation.

Your rights

You can request deletion of your data at any time by emailing us from the address associated with your purchases (or for anonymous sessions, simply clear your browser storage — your data is then unreachable). You can also request a copy of the data we hold about you.

Children

Critling is not directed to children under 13, and we do not knowingly collect data from them.

Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected by a new effective date at the top of this page.

This is a template document intended for operator review. Consult legal counsel before public launch. Operator: Luffy · Contact: critling.support@gmail.com