Privacy Policy

Who we are

Sceneshift is operated by Gokul Gopalakrishnan, an individual sole trader, and is available at getsceneshift.com. For the purposes of the UK and EU General Data Protection Regulation, that individual is the data controller for the information described here.

You can reach us about anything on this page at support@getsceneshift.com.

What we collect

When you create an account:

• Your email address.
• Your password, stored only as a salted cryptographic hash. We never see, store, or are able to recover the password itself.
• If you sign in with Google instead, the email address and account identifier Google gives us. We do not receive your Google password, and we ask Google for nothing beyond your email address and basic profile.
• If you redeemed an early-access code, which code it was.

When you use the product:

• The product photos you upload.
• The images generated from them.
• A record of each generation: which scene you chose, whether it succeeded or failed, any error message, how long it took, what it cost us to run, and when it happened.
• Your remaining credit balance.

Collected automatically, by the services we run on:

• Supabase records sign-in times and the IP address a sign-in came from, to secure your account.
• Vercel records ordinary web-server request logs, including IP address and browser user-agent, and keeps them for a short period.

If you joined the waitlist before creating an account, we also hold that email address and the date you submitted it.

What we do not collect

We do not run analytics, advertising, tracking pixels, or third-party cookies. The only cookies Sceneshift sets are the ones that keep you signed in, which is why you are not asked to consent to them — they are strictly necessary to provide a service you asked for, and they are not used to profile you.

We do not collect payment card details. Paid plans are not yet available. When they are, card details will be handled entirely by our payment processor and will never reach our servers.

We do not knowingly collect anything from children. See “Age” below.

Why we are allowed to use it

If you are in the UK or EU, GDPR requires us to name a lawful basis for each use:

• To provide the product you signed up for — performance of a contract. This covers your account, your uploads, the images we generate, and your credit balance.
• To keep accounts secure and prevent abuse of a paid API — our legitimate interests. This covers sign-in logs, rate limits, and per-generation cost records.
• To email you about the product before you had an account — consent, given when you joined the waitlist, and withdrawable at any time.

Who else sees your data

Sceneshift is a small operation built on other companies' infrastructure. These are every third party that processes your data, and all of them are in the United States:

• Supabase — stores your account, your uploaded photos, and the generated images.
• fal.ai — runs the image generation. See the paragraph below for exactly what it gets.
• Vercel — hosts the site and processes every request you make to it.
• Resend — sends account emails such as sign-in confirmations.
• Cloudflare — provides DNS and sits in front of the domain.
• Google — only if you choose to sign in with Google.

We do not sell your personal data, share it for advertising, or give it to anyone not listed above, except where we are legally required to.

What happens to a photo you upload

Your uploads and your generated images are held in private storage. They are not publicly listed and cannot be reached by guessing a URL.

When you press Generate, we create a temporary link to your photo that expires after five minutes, and give that link to fal.ai so it can fetch the image and run the model. The generated result is written back to private storage. When we show you a finished image, we create another temporary link that expires after one hour.

fal.ai processes the photo to produce your image. Its own handling of that data is governed by its privacy policy, which we suggest you read if this matters to you.

We do not use your photos or generated images to train any model, and we do not publish them anywhere. The example images on our marketing pages are our own products, photographed by us.

How long we keep it

We keep your account, your uploads, and your generated images for as long as your account exists, so that your gallery still works when you come back. We do not currently delete them on a timer.

If you ask us to delete your account, email support@getsceneshift.com and we will delete your account, your uploads, your generated images, and your generation history within 30 days. There is no self-service delete button yet — this is handled manually, and we will confirm when it is done.

Waitlist emails are kept until you ask us to remove them, or until the waitlist is retired.

Some records may survive briefly in encrypted infrastructure backups after deletion, and are overwritten as those backups rotate.

Your rights

Wherever you are, you can ask us to:

• Tell you what data we hold about you.
• Give you a copy of it.
• Correct anything wrong.
• Delete it.
• Stop using it for a particular purpose, or withdraw consent you previously gave.

Email support@getsceneshift.com and we will respond within 30 days. We will not charge you or make you justify the request.

If you are in the UK or EU and think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first so we can fix it.

If you are a California resident: we do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioural advertising. The rights listed above are available to you regardless of whether the CCPA currently applies to a business of our size.

Where your data goes

Every provider listed above operates in the United States, so if you are outside the US your data is transferred there and processed under US law. We rely on those providers' standard contractual clauses for transfers out of the UK and EU. If that is not acceptable to you, please do not use Sceneshift.

Security

Passwords are hashed, never stored in readable form. Database access is restricted per row, so one account's queries cannot reach another account's data even if the client application were tampered with. Uploaded and generated images live in private buckets reachable only through short-lived links scoped to their owner.

None of that makes any system perfectly secure, and we will not pretend otherwise. If you find a vulnerability, please tell us at support@getsceneshift.com before telling anyone else.

Age

Sceneshift is a business tool and is not directed at children. You must be at least 18 to create an account. If we learn that we hold data from a child under 13, we will delete it promptly.

Changes

If we change this policy we will update the date at the top of the page. If a change materially affects how we use data you have already given us, we will email you about it rather than quietly editing this page.