Privacy Policy

Service and privacy contact

This notice covers information processed through VisualRoleplay. For privacy questions, access or deletion requests, and complaints, contact the service operator at [email protected].

Information we process

• Account and sign-in information: your email address, account identifier, verification and sign-in records, and session information needed to keep you signed in.
• Identity photos: the images and names you save to your Identity collection, plus the photo IDs needed to load them for you.
• Face-swap content: target photos, the red-circle drawing you add, your selected identity reference, prompts, generated results, and job and credit records.
• Album imports: the URL and album details you submit, imported image files, and selection or generation metadata.
• Support and billing: support messages and attachments, plan and order details, payment and membership references, and payment status. Whop and its payment partners collect and process card details; VisualRoleplay does not receive or store the full card number.
• Technical and security data: request timestamps and limited connection, browser, and error information processed by our hosting and security providers.

How face-swap processing works

Identity photos are sent to our private Cloudflare R2 storage when you save them. To create a face swap, we send the full target photo with your visible red circle, your selected identity reference photo, and the generation instructions to the Comfy API. The red circle is included in the submitted image to identify the person to edit; the request does not send a cropped face or a separate face mask. Face images are used to perform the edit you request; we do not use the service to determine who a person is, authenticate them, or perform biometric identification.

Comfy states that API inputs and outputs are deleted from its servers after 24 hours, except where it must retain content longer by law. We save completed results in private R2 storage for up to 30 days. Face-swap target images and batch reference copies are subject to the seven-day storage lifecycle. See Comfy's current API data-retention information.

Identity photos, imported albums, and support files

• Identity photos are kept in private storage until you delete them or request account removal.
• Private albums you import are stored in private R2 storage and expire after seven days. Import them again if they expire.
• Published album images in the public Remix catalog remain available until an administrator removes the album; they do not have an automatic expiry.
• Support messages and attachments are stored with the support ticket. They do not currently have an automatic deletion date; contact us to request removal.

Support staff may access ticket information to answer your request. Private image objects are served through authenticated application routes rather than a public bucket URL.

Other retention

Account, generation, security, usage, and billing records may remain after images expire so we can operate your account, calculate credits, prevent duplicate charges, resolve disputes, provide support, and meet legal or accounting obligations. We do not currently publish a fixed deletion date for these records. We may retain specific records longer to investigate abuse, handle a chargeback, or comply with law.

Why we use information

• To create and manage your account, saved identities, private album imports, and face-swap jobs.
• To send images to the generation provider, retrieve results, and return them to your authenticated account.
• To manage subscriptions and credits, process purchases, prevent fraud, and handle payment reversals.
• To provide support, maintain security, troubleshoot problems, and improve reliability.
• To meet legal obligations and establish or defend legal claims.

Where applicable privacy law requires us to state a legal basis, we process account, identity, album, and generation information as needed to provide the features you request; rely on our legitimate interests to secure, troubleshoot, prevent abuse, and measure aggregate service use; retain billing records to meet legal obligations; and use consent where a specific feature or local law requires it.

Service providers and analytics

We use Supabase for account authentication and database services; Cloudflare for hosting and private image storage; Comfy for image processing; Whop and its payment partners for checkout and payment administration; and the email provider configured to deliver sign-in codes. These providers process information under their own terms and privacy practices.

We use Simple Analytics for aggregate website and product measurements. The browser script records page-level metrics on production pages except administration and API routes, so it includes sign-in and dashboard pages. Metrics can include page paths, referrers, campaign parameters, and broad browser, device, screen-size, language, and timezone information. UUIDs in page paths are normalized, and the script does not send your email or image content. Purchase reporting sends a purchase event and timestamp without your account email or payment details. Simple Analytics says it does not set cookies, store IP addresses, or create persistent visitor identifiers; our script is configured to omit visits where Do Not Track is enabled. See Simple Analytics' data collection details.

We do not sell personal information or use it for targeted advertising. We may disclose information if required by law, to respond to valid legal requests, or to protect users, the service, and our rights.

Cookies and browser storage

We use essential cookies for sign-in and short-lived session storage for checkout handoff and support notices. Browser storage also remembers whether you have dismissed the photo guide and which identity you last used. These settings stay in your browser and can be cleared there. We do not use advertising cookies.

Your choices and rights

You can delete an identity photo in the Identity section and can ask us to access, correct, export, or delete your account information by emailing [email protected]. We may need to verify your account and may retain information required for payment records, security, or legal compliance. If we rely on consent for a feature, you can withdraw that consent for future processing. Depending on where you live, you may also have rights to restrict or object to certain processing or to complain to a data-protection authority.

Age and policy changes

The service is for people aged 18 or older. We do not knowingly create accounts for children. If you believe a child has provided account information, contact us so we can review it.

We may update this policy as the service changes. We will post the latest version here and update the date above. If a change materially affects how we use information, we will provide notice through the service or by email where appropriate.