Legal
Privacy Policy
What we collect, why, and who else sees it.
Version 0.9. Last updated October 28, 2026.
This is our current policy. It is being reviewed by an attorney and may be updated; we will tell you about material changes.
The short version
We collect what we need to run your account and make your work, and nothing we do not use. We send some of it to the companies that run the AI tools and the payments. We do not run advertising on OnDuel. You can ask us for your data or ask us to delete it.
What we collect from you
- Account: your email address, your name, your @name, and anything you add to your profile (like a bio or picture).
- Sign-in: a one-time 6-digit code we email you. We store a scrambled copy of it, and it stops working after 10 minutes. When you sign in we set a cookie in your browser that keeps you signed in for up to 90 days, or until you sign out.
- Your device: a random identifier kept in your browser (local storage) so your actions on this device can be connected to your account.
- What you make: the prompts you type, the files you upload, and the images, video, audio, 3D models and websites you make, with their settings.
- Credits and payments: your balance, what you spent credits on, and your purchases. When you pay, you type your card into a Stripe page. We never see or store your full card number.
- Social: your posts, comments, likes, follows, messages, blocks, and reports you send, when those features are open to your account.
- Messages to us: what you write on the contact page and the email address you give.
- Technical data: our servers and hosting provider record normal request information (like your IP address, browser type and the pages you open), and we record errors so we can fix them.
How we use it
- To make your account work, keep you signed in, and keep it secure.
- To run your requests: we send your prompt and files to the AI provider that makes the result, and store the result for you.
- To take payments, keep your credit balance correct, and refund failed jobs.
- To answer you when you contact us, and to send you messages about your account (sign-in codes, receipts, changes to our terms).
- To find and fix problems, stop abuse and fraud, and follow the law.
- To improve OnDuel, using counts and patterns of how features are used.
Who else gets it
We use outside companies to run OnDuel. They receive only what they need to do their job. The full list, and what each one does, is on the Subprocessors page. In short: hosting, the database, file storage, payments, email, and the AI model providers that make your results.
Each AI provider has its own rules about what it does with what we send it. We choose providers whose terms allow us to run the service, but we cannot control their systems.
We may share information if the law requires it, to protect people's safety, to respond to a copyright notice, to report child sexual abuse material to the authorities, or if OnDuel is sold or merged (we will tell you if that changes who holds your data).
We do not run third-party advertising on OnDuel, and we do not sell your personal information.
How long we keep it
Sign-in codes expire after 10 minutes. A signed-in session lasts up to 90 days. Everything else, such as your account, your files and your work, we keep while your account is open, until you or we delete it, or until a cleanup removes it. We may keep a record of a payment, or something we need for legal or safety reasons, for longer. Deleted data can stay in backups for a while.
Cookies and local storage
We use a sign-in cookie and some browser storage, such as your device identifier and unsent drafts, to make the app work. If you clear them you will be signed out. The visit counter we sell to website owners is a separate product; it is described below. You can use your browser settings to block or clear cookies.
The visit counter on customers' websites
Website owners can add the OnDuel visit counter to their own sites. It is not added automatically. When it runs on a visitor's browser it keeps one random identifier in a cookie and in local storage (for up to 400 days) and a session identifier. It records the page address and title, the site that sent the visitor (without anything after a "?"), any campaign tags in the link, the label of buttons and links clicked, the name of forms sent (never what is typed into them), the screen width, and whether the browser looks automated. It does not read what you type in forms. It does not run when your browser sends a Do Not Track or Global Privacy Control signal, unless the site owner overrides that. We do not read or store the visitor's IP address for this; we keep the country and region our host reports. The website owner decides to use the counter and is responsible for telling their visitors.
Your choices and rights
You can ask us to show you the information we hold about you, correct it, give you a copy, or delete it. Use the contact page and say which you want. We may need to confirm it is you. We aim to answer within 30 days. Deleting your account removes your credits, and we cannot restore them afterwards.
Depending on where you live, you may have more rights, such as to object to how we use your information or to complain to a privacy regulator. We will not treat you worse for using your rights.
Children
OnDuel is for people 13 and older. We do not knowingly collect information from anyone younger. If you think a child has made an account, tell us and we will remove it.
Security
We use reasonable measures to protect your information, such as storing only scrambled copies of sign-in codes and keeping files in private storage. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.
Where information is stored
OnDuel and its providers may process information in the United States and other countries.
Changes to this policy
We may update this policy. When a change matters, we will tell you by email or in the app. The version number and date are at the top of this page.
Contact
For privacy questions or requests, use the contact page and pick "Privacy request".