Privacy Policy

1. Information we collect

We collect:

• Account data — your email address, username and authentication details, managed through our authentication provider (Supabase). If you sign in with Google, we receive your email address and name from Google.
• Content you provide — the pictures, videos and audio you upload, the prompts you write, and your messages to the Studio's prompt assistant (the agent) with any files you attach for it.
• Generated content — the videos and pictures produced for you.
• Your agreements — when you confirmed, before your first upload, that you have the rights to what you upload and the consent of the people in it: which version of that promise and when.
• Reports — if you report content, what you tell us, your name and your email address, so we can act on it and reply.
• Billing data — purchase and subscription records. Card details are handled entirely by our payment processor (Dodo Payments); we do not see or store your card number.
• Usage and technical data — log data such as IP address, request times, and basic device/browser information, used for security, rate limiting, and debugging; error reports when something breaks; and product analytics (which pages are visited and which buttons are used), for which a random identifier is stored in your browser.

2. How we use your information

We use your information to: provide and operate the Service; process your generations (which involves sending your content to third-party AI providers); process payments; prevent abuse and enforce our policies; communicate with you about your account; and comply with legal obligations.

Before some generations, we automatically detect faces in your pictures and place a mark over them. This happens on our own servers. It does not identify anyone, and we keep no face data, only the marked copy of the picture, which is deleted along with the original.

Every video and picture we make carries a label inside the file saying it was made with AI by Dreamrift. The label holds no personal information.

3. Service providers we share data with

We share data only with providers that help us run the Service:

• Supabase — database, authentication, and file storage.
• Replicate — runs the AI models that make your videos and pictures. The prompt and the pictures, video or audio you attach to a generation are sent to Replicate and, through it, to the company that makes the model you choose (for example ByteDance for Seedance, Kuaishou for Kling, OpenAI for GPT Image, Google for Nano Banana), to fulfill your request.
• Higgsfield — runs some of the video models, for example when you remix a video or use a video as a reference. The prompt and the pictures, video or audio for that generation are sent to Higgsfield to fulfill your request.
• Anthropic — runs the Studio's prompt assistant (the agent), using its Claude models. When you message the agent, what you write, the files you attach for it, the pictures and settings on your prompt box and your chat with it so far are sent to Anthropic so it can answer, under Anthropic's commercial terms. When the agent searches the web or reads a page for you, Anthropic runs that search or reads that page. To know what is said in a video you show the agent, the video's sound is turned into text through Replicate.
• ScrapeCreators — searches TikTok, TikTok's ad library and Meta's Ad Library when the agent looks for real examples during your chat. Only the search words the agent chooses are sent; not your account, your files or your chat.
• Cloudflare Workers AI — turns what you say with the microphone button into text, using the open-source Whisper model. The recording and the prompt before your cursor are sent to Cloudflare to do it; Cloudflare does not store them or use them to train models.
• Dodo Payments — payments and tax, as Merchant of Record.
• Google — sign-in, only if you choose to sign in with Google.
• Resend — sends our emails: sign-in and account emails, and the content reports you send us, which are emailed to us.
• PostHog — product analytics. Sign-in codes and tokens are removed from page addresses before anything is sent.
• Sentry — error reports, so we can find and fix problems. Reports describe the error and the page it happened on; sign-in codes and tokens are removed before anything is sent.
• Hosting providers (Cloudflare and Railway) — to run the application.

AI apps you connect. If you connect an AI app like Claude, ChatGPT or Grok, that app sees what it sends to Dreamrift and what Dreamrift sends back (your project and picture names, picture previews, prompts, prices and links) and handles it under its own terms. You can disconnect it at any time on the Connections page.

Voice typing. If you speak your prompt with the microphone button, Dreamrift never keeps your voice, only the words once they are in the prompt box. Your recording passes through our servers to Cloudflare, where the open-source Whisper model writes it down and sends back the words; neither we nor Cloudflare store the recording, and Cloudflare does not use it to train models. When that is not available, your browser turns your speech into text with its own service (Google, Microsoft or Apple), under that company's terms, or it is done on your own device by an open-source model, downloaded once from jsDelivr and Hugging Face, and then your voice does not leave your device.

We do not sell your personal information.

4. Data retention

We keep account data for as long as your account is active. Reference images and generated clips are stored so you can access them in your library; you can delete them, and deletion removes them from active storage. Temporary processing files are removed automatically after generation. Billing records are retained as required for accounting and legal purposes.

Your chats with the agent are kept so you can open them again, and a record of each message and its reply is kept so we can check what it was charged and fix problems.

5. Your rights

Depending on where you live (including under the EU/UK GDPR), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights — including deleting your account and associated data — email us at [email protected] and we will respond within a reasonable time.

6. International transfers

Your data may be processed in countries other than your own, including by the providers listed above. Most of them are in the United States, so your data is stored and processed there and may be accessed by courts, law enforcement and other authorities there under their laws. Where required, we rely on appropriate safeguards for such transfers.

7. Security

We use industry-standard measures including encrypted connections, private storage buckets, row-level access controls, and scoped credentials. No system is perfectly secure, but we work to protect your data and limit access to it.

8. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children.

9. Changes

We may update this Policy; material changes are reflected by updating the effective date above.

10. Contact and complaints

Our Privacy Officer, Dreamrift is responsible for this Policy and for how we handle personal information. For privacy questions or requests, contact them at [email protected]. This Policy is governed by the laws of the Province of Ontario, Canada.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca), or, in the EU or UK, to your local data protection authority.