Privacy Policy
Last updated: 22 October 2026. This policy covers the polycreator.si website and the PolyCreator desktop app.
Who we are
PolyCreator operates this service. Reach us at noreply@polycreator.si. If you live in the EU, the UK or Switzerland, this policy also describes how we meet our obligations under the GDPR and the UK GDPR.
What we collect
What you give us
| Data | Why | Where it lives |
|---|---|---|
| Email address | Signing in, resetting a password, verifying an address, transactional mail | Cloudflare D1 |
| Display name | Shown on your account page | Cloudflare D1 |
| Password | Stored as a salted hash (better-auth) — we cannot turn it back into the password | Cloudflare D1 |
| Whether the address is verified | Decides whether a desktop app may attach itself to the account | Cloudflare D1 |
What using the desktop app produces
| Data | Why | Where it lives |
|---|---|---|
| Desktop bearer tokens (stored as a SHA-256 hash only) | So the desktop app does not ask you to sign in again | Cloudflare D1 |
| Device-code hashes | The one-time device authorization flow | Cloudflare D1 (10-minute lifetime) |
| Session records | Keeping you signed in | Cloudflare D1 |
A raw token is never stored. It exists only in the memory of the device that holds it; the desktop app writes an encrypted copy to its own disk and the plain token never touches the disk.
Anonymous usage statistics
The site records the path you visited, the host name of the referrer (for example google.com — never the full URL, which would carry your search terms), and a human / bot verdict.
Not recorded: IP address, user agent, cookies, sessions, or any identifier of any kind. Two requests from the same person are indistinguishable from two requests from two people.
This is only collected when we have provisioned the statistics dataset ourselves. A default deployment collects nothing.
What we do not collect
We do not collect your canvas contents, the work you generate, or the API keys you configure for model providers. We do not sell or share your personal information.
Who handles it
| Party | What it is | What it handles |
|---|---|---|
| Cloudflare | Hosting, database (D1), email, object storage | Hosting, account data, transactional mail, downloads |
| Turnstile (Cloudflare) | Bot check | Only when you sign up, sign in, reset a password or ask for a verification mail — it decides whether you are a bot |
| GitHub | Public repository API | We only read public repositories to list plugins and themes; nothing of yours is sent |
| The mail sender (Cloudflare Email) | Sending transactional mail | The recipient address and the message |
How long we keep it
| Data | Kept for |
|---|---|
| Account (user / account) | Until you delete it |
| Sessions | 7 days (the cookie's Max-Age), then cleaned up |
| Email verification / password reset links | 1 hour |
| Desktop device codes | 10 minutes |
| Desktop tokens | 90 days without use, then expired; every use slides it 90 days out |
| Rate-limit counters | About 1 minute (sliding window) |
| Anonymous statistics | For as long as the site operates (see "Where the data lives") |
Where the data lives
Personal data is stored in Cloudflare D1 (United States, in the Cloudflare region you are served from), with backups managed under Cloudflare's retention policy. This policy covers polycreator.si; we do not transfer personal data outside it.
Your rights
Export it yourself
Account page → "Export my data" downloads a JSON file with your account details, your devices and your session metadata. The password is a hash and cannot be recovered, so there is nothing to export; the desktop tokens are the same — only a SHA-256 hash of each is stored, and the device id below is a prefix of that hash.
Correct it
The account page lets you change your display name and password, and your email once it is verified.
Delete it yourself
Account page → "Delete account" removes your account, sessions and desktop tokens immediately. It cannot be undone.
Object, or withdraw consent
If you gave consent for something (registering is itself consent), you can withdraw it at any time: email noreply@polycreator.si and we will act within 30 days.
Complain
If you think we have handled your data badly, you can complain to your local data protection authority. EU residents can find theirs on the EDPB site.
Cookies
| Name | Purpose | Lifetime |
|---|---|---|
better-auth.session_token |
Keeping you signed in | 7 days, HttpOnly, Secure, SameSite=Lax |
theme |
Remembering the light/dark preference | Persistent |
We use no advertising cookies, do no cross-site tracking, and load no third-party analytics scripts — unless you have configured Cloudflare Web Analytics yourself.
What the desktop app keeps locally
The desktop app's files stay on your own machine, and we cannot see them:
- plugins you installed, assets you imported, the work you generated and its thumbnails
- the encrypted account token (
auth.json) - logs (in the
logs/directory) - the model-provider API keys you configured (stored encrypted)
Uninstalling the app removes these directories; to be thorough, delete the application data directory as well.
Children
The service is for adults, not for children under 13, and we do not knowingly collect their data.
Changes
When the policy changes materially we update the date at the top. Changes to the purposes of processing or the retention periods are announced on the site.
Contact us
noreply@polycreator.si — for privacy questions, data exports and deletion requests.