1. Introduction

This Privacy Policy describes how Iconwiz ("we," "us," or "our") collects, uses, and discloses your personal information when you use our website and services at iconwiz.app (the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. We encourage you to read this Privacy Policy carefully before using our Service.

2. Definitions

Service: The Iconwiz website operated at iconwiz.app.
Personal Data: Data about a living individual who can be identified from those data.
Usage Data: Data collected automatically by our infrastructure providers or optional analytics services.
Cookies: Small files stored on your device (computer or mobile device).

3. Commitment to Privacy

We at Iconwiz are deeply committed to protecting your privacy. We want to be unequivocally clear: we do not and will never sell your personal information to any third parties.

4. Information We Collect

4.1 Account Information

When you create an account, we collect:

Email address (required for account registration, communication, and marketing)
Password (stored in hashed form, we cannot see your actual password)

4.2 Content You Provide

Uploaded Images: Source images you upload for icon generation (stored in cloud for paid users, or locally in your browser for free users)
AI Generation Prompts: Text prompts you provide for AI image generation
Generated Content: Icons and AI-generated images created through our Service

4.3 Payment Information

Payment information (credit card details, billing address) is processed directly by our payment processor Creem. We do not store your full payment card information on our servers. We only receive transaction confirmations and subscription status from Creem.

4.4 Automatically Collected Information

Our infrastructure provider Cloudflare automatically collects certain information for security and performance purposes:

IP address (for security, rate limiting, and regional content delivery)
Request logs (for DDoS protection and abuse prevention)

If you have opted into analytics (optional), we may also collect anonymous, aggregated usage data such as page views and general device information through our self-hosted analytics service.

5. Cookies

5.1 Essential and Preference Cookies

We use only essential cookies and user-requested preference cookies that are necessary for the Service to function or remember your choices:

Authentication Cookies: To keep you logged in and secure your session
Security Cookies: For bot protection (Cloudflare Turnstile, when enabled)
Language Preference Cookie: To render the interface in the language you selected

5.2 What We Don't Use

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. Your preferences may be stored locally in your browser's localStorage and, for language selection, in a first-party preference cookie.

5.3 Cookie-Free Analytics

If enabled, our analytics service (Umami) and error monitoring (Sentry) are self-hosted and do not use cookies. You can opt out of these services in your account settings.

5.4 How to Control Cookies

You can instruct your browser to refuse all cookies. However, if you do so, you will not be able to log in to your account, as authentication requires essential cookies.

6. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our Service
Process your icon generation and AI image requests
Manage your account and subscription
Process payments through our payment processor
Send transactional emails (account verification, password reset, subscription notifications)
Send marketing communications about new features, promotions, and updates (you can opt out anytime)
Respond to your support requests
Detect, prevent, and address technical issues and security threats
Comply with legal obligations

Marketing Opt-Out: You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at support@iconwiz.app. Note that you will continue to receive transactional emails related to your account.

7. Legal Basis for Processing (GDPR)

If you are from the European Economic Area (EEA), our legal basis for processing your data:

Contract Performance: To provide the Service you signed up for
Legitimate Interests: For security, fraud prevention, service improvement, and marketing communications about our services (where not overridden by your rights)
Legal Obligation: To comply with applicable laws
Consent: For optional features like analytics (you can opt out anytime)

You have the right to object to marketing communications at any time. See the "Marketing Opt-Out" section above.

8. Third-Party Services

We use the following third-party services to provide our Service:

8.1 Cloudflare

We use Cloudflare for hosting, content delivery, security, and performance. Cloudflare processes IP addresses and request data to protect against attacks and ensure service availability. See Cloudflare's Privacy Policy.

8.2 Creem (Payment Processing)

Creem (operated by Armitage Labs OÜ) processes all payments. Your payment information is sent directly to Creem and is not stored on our servers. See Creem's Privacy Policy.

8.3 AI Image Generation (Replicate)

When you use AI image generation, your prompts are sent to Replicate for processing by AI models (such as SeedDream, Google Imagen).

Important:

Your prompts and generated images are processed by Replicate and model providers
These third parties have their own privacy policies
Generated images may be temporarily stored on Replicate's servers
Do not include sensitive or personal information in your prompts

See Replicate's Privacy Policy.

8.4 Optional Analytics (Self-Hosted)

If enabled, we may use self-hosted Umami (analytics) and Sentry (error tracking). These services:

Do not use cookies
Do not collect personally identifiable information
Store all data on our own servers (not shared with third parties)
Can be opted out of in your account settings

9. Data Storage and Retention

9.1 Where Your Data is Stored

Your data is stored on Cloudflare's global infrastructure. This means your data may be processed in data centers outside your jurisdiction.

9.2 Retention Periods

Account Data: Retained while your account is active, deleted immediately upon account deletion
Uploaded Images & Generated Content:
- Free users: AI-generated images stored in cloud for 30 days, plus permanent local storage in your browser. Uploaded images stored locally only.
- Creator plan: Unlimited Cloud Sync for up to 1,000 items
- Pro/Premium plan: Unlimited Cloud Sync with higher item limits

9.3 Subscription Expiration & Grace Period

If your Pro or Premium subscription expires or you downgrade:

You receive a 30-day grace period during which your materials are preserved
After the grace period, materials exceeding your new plan's limits will be automatically deleted (oldest first)
We recommend downloading any important content before your subscription expires

9.4 Data Deletion

You can delete your account at any time from your account settings. Upon deletion, your personal data, uploaded images, and generated content are deleted immediately from our servers.

10. Data Disclosure

We may disclose your information only when:

Required by law or legal process
Necessary to protect our rights, property, or safety
Necessary to prevent fraud or security threats
You have given explicit consent

We do not sell, rent, or trade your personal information.

11. Data Security

We implement appropriate security measures to protect your data:

All data transmitted over HTTPS
Passwords stored using secure hashing
Regular security updates and monitoring

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

12. Your Rights (GDPR)

If you are in the European Economic Area (EEA), you have the right to:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data (you can delete your account anytime)
Restriction: Request limitation of processing
Portability: Request your data in a portable format
Objection: Object to certain processing
Withdraw Consent: Withdraw consent for optional processing (e.g., analytics)

To exercise these rights, contact us at support@iconwiz.app. You also have the right to lodge a complaint with your local data protection authority.

13. Children's Privacy

Our Service is not intended for anyone under 18 years old. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "last updated" date.

Your continued use of the Service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

Email: support@iconwiz.app