Privacy Policy

Last updated: October 10, 2026

This policy explains how Rumpelstiltskin Dance (the "Service"), operated by an individual developer ("we", "us"), handles personal data when you use rumpelstiltskindance.org. We keep this short on purpose: the Service does one thing, and we collect only what that thing needs.

1. Data we collect

• Account data. When you sign in with Google we receive your email address, display name and profile picture. When you sign in with an email magic link we receive your email address. We also store the time your account was created and last signed in.
• Uploaded photos. The photo you upload to generate a clip. This is sensitive data because it shows a person's face or a pet, and we treat it accordingly (see Retention).
• Generated videos. The clip produced from your photo, plus the options you chose (style, subject type, output spec) and the time it was generated.
• Credit and order data. Your credit balance, credit holds and charges per generation, the pack you bought, the amount, currency, date and Stripe's order and session identifiers. We never receive or store your card number; Stripe handles it.
• Technical data. IP address, browser user agent, approximate country derived from IP, timestamps and request logs. We use IP addresses to enforce the free-tier limit of three new accounts per IP per day and to detect abuse.
• Usage analytics. Pages viewed, buttons clicked and similar aggregate events collected through Google Analytics, subject to your cookie choices.
• Support messages. Anything you send to support@rumpelstiltskindance.org.

We do not collect free-text prompts, because the Service does not accept them.

2. Why we use it

• To run the Service: sign you in, send your photo to the AI model, deliver the result, and show your clips in your dashboard.
• To process payments, grant credits and return credits for failed generations.
• To prevent abuse: enforce free-tier limits, block disposable email addresses, stop bots and detect fraud.
• To moderate: check uploads against our rules on minors, nudity, public figures and consent, and act on takedown requests.
• To answer support and refund requests.
• To understand how the site is used so we can improve it.
• To comply with legal obligations, such as tax and accounting rules for payment records.

Our legal bases under the GDPR are performance of a contract (providing the Service you asked for), legitimate interests (security, abuse prevention, analytics in aggregate, improving the Service), consent (analytics cookies, where required) and legal obligation (payment records).

3. How long we keep it

• Uploaded photos are deleted from our storage within 24 hours of upload. They are sent to our AI provider only for the time needed to generate the clip.
• Generated clips are kept in your dashboard until you delete them. A clip opened through a share link by a visitor who is not signed in is available for 30 days from generation. Deleting a clip removes the file and disables its link.
• Account data is kept while your account exists. When you delete your account we delete your profile, clips and remaining credit balance within 30 days, except for records we must keep by law.
• Order and payment records are kept for as long as tax and accounting law requires, typically up to 7 years, in a form that excludes your photos and clips.
• Technical logs are kept for up to 90 days.
• Support emails are kept for up to 2 years so we can follow up on earlier cases.

4. Who we share data with

We share data only with processors that are needed to run the Service, and only the data each one needs:

• fal.ai (AI video generation): receives your uploaded photo and the fixed prompt, returns the video.
• Cloudflare R2 (file storage): stores uploaded photos until deletion and generated clips.
• Cloudflare Turnstile (bot protection): processes browser signals and IP address to tell humans from bots.
• Stripe (payments): processes your card or wallet payment, receives your email address and order details.
• Resend (email): sends magic-link sign-in emails and transactional emails to your address.
• Google (sign-in and analytics): Google Sign-In provides your profile data; Google Analytics collects usage events.

We do not sell personal data and we do not share it with advertisers. We may disclose data if the law requires it, to enforce our terms, or to protect someone's safety.

5. International transfers

Our processors operate in the United States and elsewhere. Where data leaves the European Economic Area or the United Kingdom we rely on the processors' standard contractual clauses or equivalent safeguards.

6. Cookies

We use a strictly necessary cookie to keep you signed in and a Cloudflare Turnstile cookie for bot protection. Google Analytics sets analytics cookies only where we are permitted to use them; where consent is required you will see a banner and can decline. You can also block cookies in your browser; the Service still works, but you will need to sign in again more often.

7. Your rights

Depending on where you live, you may have the right to access the data we hold about you, correct it, receive a copy in a portable format, have it deleted, restrict or object to certain processing, and withdraw consent. If you are in the EEA or UK you may also complain to your local data protection authority. If you are a California resident you have the right to know what personal information we collect and how it is used, to delete it, and to be free from discrimination for exercising those rights; we do not sell or share personal information for cross-context behavioural advertising.

You can delete individual clips and your whole account from your dashboard without contacting us. For anything else, email support@rumpelstiltskindance.org from the address on your account and we will respond within 30 days.

8. People in photos who are not our users

If someone uploaded a photo of you and you did not consent, you can ask us to remove the resulting clip. Email support@rumpelstiltskindance.org with the clip link. We do not need your account; we will verify that the clip shows you and remove it.

9. Children

The Service is for adults aged 18 and over. We do not knowingly collect data from anyone under 18, and we reject photos that appear to show minors. If you believe a minor's photo has been uploaded, email us and we will delete it.

10. Security

Data is encrypted in transit with TLS and at rest by our storage provider. Access to production systems is limited to the operator and protected by multi-factor authentication. Photos are deleted on a fixed schedule rather than kept indefinitely. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any regulator as the law requires.

11. Changes to this policy

We will post updates here and update the date at the top. For material changes we will also notify you by email or with a notice on the site before they take effect.

12. Contact

Email: support@rumpelstiltskindance.org. The Service is operated by an individual developer; we do not publish a postal address.