TINY DESK AI

TINY DESK AI · LEGAL

Privacy Policy

This policy describes what information Tiny Desk AI handles, why we use it, and how to contact us about your privacy.

Effective date: October 27, 2026 · Last updated: October 27, 2026

This Privacy Policy applies to tinydeskai.cc and Tiny Desk AI (the "Service"). In this policy, "we," "us," and "our" refer to the operator of the Service. For privacy questions or requests, contact support@tinydeskai.cc.

This policy covers the Service's account, AI video generation, and one-time credit purchases. Waffo Pancake provides the hosted checkout used for those purchases.

Information We Handle

  • Google sign-in information. If you sign in with Google, Google provides your name, email address, profile image, verified-email status, and Google account identifier. We store account details and a hashed session token to keep you signed in.
  • Portraits submitted for generation. When you generate a video, your selected image is resized in your browser and uploaded to a private R2 bucket. Tiny Desk AI gives OpenRouter a temporary signed URL so it can fetch the image and create the requested video. We remove the input image from R2 after the task completes or fails. An R2 lifecycle rule can remove uploads left behind if a task is abandoned. OpenRouter processes the image under its own terms and privacy practices.
  • Generation records and results. We store the chosen resolution and pack, prompt, provider task identifier, status, credit amount, and generated video URL so we can run the task, return failed-generation credits, and show the result. The generated video is hosted by OpenRouter; provider-hosted video URLs may expire under the provider's retention behavior.
  • Credit and purchase information. We store the selected pack, order number, amount, currency, payment status, Waffo transaction identifier, and resulting credit balance changes. Waffo processes payment credentials such as card details on its hosted checkout.
  • Technical and security information. Our hosting and security providers may process request timestamps, browser/device details, IP address, and diagnostic information needed to deliver and protect the website.
  • Messages to support. If you email us, we receive the email address, message, and any information you choose to include.

How We Use Information

  • To authenticate you, maintain sessions, and protect account security.
  • To operate the website, portrait preview, and requested features.
  • To send the image and generation settings to OpenRouter, return the generated video, and maintain task and credit records.
  • To process one-time Waffo purchases, credit balances, failed-generation credit returns, support questions, and payment disputes.
  • To respond to support requests, enforce our Terms of Service, and comply with legal obligations.

Google Sign-In and Cookies

When you choose Google sign-in, your browser communicates with Google. We receive the basic profile information listed above. Google handles its own services under its privacy policy.

We use essential, HTTP-only cookies for your sign-in session and short-lived cookies to protect the Google OAuth sign-in flow. The sign-in session expires after 30 days. These cookies support authentication and security; they are not used by Tiny Desk AI for advertising.

The site also requests font files from Google Fonts. Google may receive technical request information, such as your IP address and browser details, when your browser fetches those files.

When Information May Be Shared

We do not sell personal information or share it for cross-context behavioral advertising. We may share limited information with:

  • Google when you choose Google sign-in or your browser loads Google Fonts.
  • Hosting, database, and security providers that operate the Service and protect accounts and requests.
  • OpenRouter and its model providers when you submit a photo for video generation.
  • Waffo Pancake when you purchase a one-time video pack through hosted checkout.
  • Authorities or professional advisers when needed to comply with law, protect people, or enforce our rights.
  • A successor if the Service is involved in a merger, acquisition, or transfer, subject to applicable law.

Retention

We keep account information while your account is active and for as long as reasonably necessary to operate the Service, protect users, resolve disputes, and meet legal obligations. Sign-in sessions expire after 30 days; temporary OAuth security cookies expire after 10 minutes.

A portrait is uploaded to a private R2 bucket only when you submit a generation request. Tiny Desk AI removes it after the task reaches a terminal state; we recommend configuring a one-day R2 lifecycle rule to clean up abandoned uploads. We retain generation metadata, credit transactions, and the provider-hosted result URL as needed to operate the task, show the result, prevent abuse, resolve disputes, and comply with law. OpenRouter and upstream providers may retain operational copies or generated media under their own policies, and provider-hosted result URLs may expire.

Purchased credits, when available, are valid for 180 days. Credit expiry does not by itself determine how long we must keep transaction records.

Your Choices and Privacy Rights

Depending on where you live, you may be able to request access to, correction of, or deletion of personal information, or exercise other rights provided by local law. To make a request, email support@tinydeskai.cc from your account email, use the subject "Privacy Request," and describe what you need. We may ask you to verify your identity.

You can remove a selected portrait from the current preview using the remove control, or close the page to clear the browser preview. We may keep limited records where needed for security, accounting, fraud prevention, legal compliance, or disputes.

Security and International Processing

We use reasonable technical and organizational safeguards designed to protect information. No internet service can guarantee absolute security. Service providers may process information in countries other than your own; where required, we will use appropriate safeguards for such transfers.

Children

The Service is not directed to children under 13, and children under 13 may not create accounts or use the Service. If we learn that we have collected personal information from a child under 13, we will take steps to delete it. Contact support@tinydeskai.cc if you believe this has happened.

Changes to This Policy

We may update this policy when the Service, our data practices, or legal requirements change. We will post the updated version on this page and revise the date above. If a change materially affects your rights, we will provide additional notice where required.

Contact

For privacy questions or requests, contact Tiny Desk AI at support@tinydeskai.cc or visit tinydeskai.cc.