Privacy Policy

Mosaicly is operated by TODO: operator legal name. This policy covers the website and the mosaic generator. Questions go to TODO: contact email.

When you create an account we store:

• Your name and email address.
• A hash of your password, if you sign up with email.
• If you sign in with Google, the profile image Google sends, plus the tokens needed to keep that sign-in linked.

We email you only to verify the address or to reset a password. We do not send marketing mail, and there is no preference to manage.

A signed-in session lasts 14 days. We store the session token, your IP address, and your browser’s user agent so we can keep the session valid and limit repeated sign-in attempts. The IP used for rate limiting is kept in memory on the server and is not written to the account database.

The preview on this website runs in your browser. That photo is not uploaded. When you generate a mosaic in the studio, you upload source images. We store those files and the mosaics we generate from them (colored page, numbered page, palette legend, and PDF) on our servers, tied to your account. Finished jobs are deleted after 72 hours. You can delete a mosaic sooner from the library. Images are processed on our servers with ordinary image software. They are not sent to an AI model and are not used to train one.

Packs are sold by Paddle, the merchant of record. Paddle collects your card details, tax information, and invoice data. We store only the Paddle customer id, the transaction id, and a ledger of generations added or used. We do not store card numbers. Free accounts receive 10 generations each month; that allowance is stored in the same ledger.

• Paddle — checkout, tax, and invoices. Paddle’s privacy policy.
• Resend — delivery of verification and password-reset email only.
• Google — only if you choose Google sign-in.
• Cloudflare — network delivery. We read the country header Cloudflare sends so prices can be shown for your country. We do not use it for advertising.

We do not use analytics or error-tracking services, and we do not set advertising cookies.

We set one essential cookie, the sign-in session. It is required to keep you signed in. We do not set analytics or preference cookies, so there is no cookie banner.

Email TODO: contact email to see the account data we hold, to correct your name or email, or to delete the account. Deleting the account removes the user record, sessions, the generation ledger, and any mosaics still stored. There is no self-serve deletion in the product yet. Paddle keeps its own billing records as the merchant of record.

Mosaicly is not for anyone under 18. We do not knowingly collect information from children.

We host the application ourselves. Paddle, Resend, Google, and Cloudflare may process data in countries other than yours. Their terms describe those transfers.

If this policy changes, we will update the effective date on this page. Continued use after that date means you accept the new policy.

TODO: operator legal name — TODO: contact email.