Privacy Policy

Last updated: August 2, 2026

This Privacy Policy describes the policies and procedures of Tipitylabs ("we," "us," or "our") on the collection, use, and disclosure of your information when you use Tipity AI ("Service") and tells you about your privacy rights and how the law protects you.

1. Information We Collect

We may collect the following types of information:

Personal Data: Email address, name (if provided), and authentication credentials when you create an account via email/password or Google Sign-In.
Usage Data: IP address, browser type, device information, pages visited, time spent on pages, and other diagnostic data collected automatically.
Generated Content: The text prompts you submit to generate or edit images, and any photo you upload for editing. On the website, prompts are sent to our server, which calls Google's Gemini AI model. In the Android app, prompts (and any uploaded photo) are sent directly from your device to Google's Gemini AI model via Firebase AI Logic — our server is never involved in generating your image on Android. Neither platform permanently stores your prompts or uploaded photos associated with your account.
Voice Input (Android app only): If you use the microphone button to describe an image by speaking, your device's built-in speech recognition converts your speech to text locally on your device before it's used as a prompt. We do not receive or store audio recordings.
Payment Information: Payment details are processed by our third-party payment processors (Stripe for web, Google Play Billing for Android). We do not store full credit card numbers or payment credentials on our servers. We retain transaction records (amount, date, credit tier purchased) for accounting purposes.
Device Integrity (Android app only): The Android app uses Google Play Integrity to confirm requests come from a genuine, unmodified install of the app, as part of preventing abuse. This does not identify you personally beyond your existing account.
Cookies and Tracking (website only): We use cookies and similar tracking technologies to maintain your session, remember preferences, and analyze usage patterns through Firebase Analytics. The Android app does not use cookies.

2. How We Use Your Information

To provide, maintain, and improve our Service
To manage your account and credit balance
To process transactions and send transaction confirmations
To communicate with you about updates, security alerts, or service-related notices
To monitor usage patterns and analyze trends to improve user experience
To detect, prevent, and address technical issues or fraudulent activity
To comply with legal obligations and enforce our Terms of Service
To respond to support requests

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, our legal basis for collecting and using your personal information depends on the data and the context:

Consent: You have given us permission to process your data (e.g., by creating an account)
Contract Performance: The processing is necessary for the performance of our agreement with you (e.g., providing the Service, processing payments)
Legitimate Interests: The processing is in our legitimate business interests (e.g., improving the Service, preventing fraud) and not overridden by your rights
Legal Obligation: We need to process your data to comply with applicable law

4. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this Privacy Policy:

Account information: Retained while your account is active. Upon account deletion, all personal data is removed immediately except as noted below.
Transaction records: Retained for 7 years after the transaction date for tax and legal compliance as required by law.
Usage logs: Retained for 90 days, then automatically purged.
Generated images: Not permanently stored on our servers. Images exist only during generation and are delivered directly to your browser (website) or device (Android app). Shared images are stored until you delete your account.
Support correspondence: Retained for 2 years after resolution.

5. Your Data Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of your personal data we hold
Rectification: Request correction of inaccurate or incomplete data
Erasure: Request deletion of your personal data ("right to be forgotten"). You can do this instantly via the "Delete Account" option in your account menu.
Restriction: Request restriction of processing your data
Portability: Request transfer of your data in a machine-readable format
Objection: Object to processing of your data based on legitimate interests
Withdraw Consent: Withdraw consent at any time where we relied on consent as our legal basis

To exercise these rights, contact us at support@tipitylabs.com or use the self-service account deletion feature. We will respond within 30 days. If we cannot fulfill your request, we will explain why.

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

Right to Know: What personal information is collected, used, shared, or sold
Right to Delete: Request deletion of personal information
Right to Opt-Out: Opt out of the sale or sharing of personal information. We do not sell or share your personal information with third parties for cross-context behavioral advertising.
Right to Non-Discrimination: We will not discriminate against you for exercising your rights
Right to Correct: Request correction of inaccurate personal information

To exercise your CCPA/CPRA rights, email support@tipitylabs.com. We will verify your identity before processing requests.

7. Disclosure of Your Personal Data

We do not sell, rent, or trade your personal information to third parties. We may share your information with:

Service Providers: Google (Gemini AI for image generation, Firebase for hosting and authentication, Analytics for usage data), Stripe (payment processing for web purchases), Google Play (payment processing for Android purchases)
Legal Requirements: When required by law, court order, subpoena, or government request
Business Transfers: In connection with a merger, acquisition, or sale of assets, in which case you will be notified
Protection of Rights: To protect the rights, property, or safety of Tipitylabs, our users, or others

These service providers are contractually obligated to use your data only as necessary to provide their services to us and in accordance with their own privacy policies.

8. International Data Transfers

Your information may be transferred to and processed in the United States and other countries where our service providers operate. These countries may have different data protection laws than your country of residence. By using the Service, you consent to this transfer. We ensure that data transfers comply with applicable law and that your data receives adequate protection.

9. Security of Your Personal Data

The security of your personal data is important to us. We implement commercially reasonable security measures including:

Encryption of data in transit (TLS/HTTPS)
Encryption of data at rest in our databases
Access controls limiting who can view personal data
Regular security monitoring and logging
Authentication token-based API access

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

10. Children's Privacy

Our Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@tipitylabs.com, and we will promptly delete such information from our systems.

11. Cookies and Tracking Technologies

We use the following types of cookies and tracking technologies:

Essential Cookies: Required for the Service to function (authentication, session management). These cannot be disabled.
Analytics Cookies: Firebase Analytics collects anonymous usage data to help us understand how the Service is used and improve it. This data is aggregated and does not identify individual users.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept essential cookies, you will not be able to use the Service. We do not use advertising cookies or third-party tracking for ad targeting.

12. Do Not Track

We do not currently respond to "Do Not Track" browser signals because there is no industry-standard interpretation. We do not track users across third-party websites.

13. Third-Party Links

Our Service may contain links to other websites that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We strongly advise you to review the Privacy Policy of every site you visit.

14. Data Breach Notification

In the event of a data breach that affects your personal information, we will:

Notify affected users via email within 72 hours of becoming aware of the breach
Notify relevant supervisory authorities as required by applicable law (GDPR, state breach notification laws)
Provide information about what data was affected and steps you can take to protect yourself

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. For significant changes that affect how we use your data, we will provide prominent notice via the Service or email notification.

Your continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have any questions about this Privacy Policy, your data, or wish to exercise your rights, contact us at support@tipitylabs.com. We aim to respond to all inquiries within 30 days.