Privacy Policy
Last updated: October 2026
Overview
GrainLab (“we”, “our”, or “us”) respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our service.
Information We Collect
Images You Upload
When you use GrainLab, you upload two photos: a reference photo (the style you want) and your own photo (the one you want to transform). Both images are:
- Processed in memory only
- Sent to OpenAI's API for style analysis
- Discarded from GrainLab server memory after processing
- Never stored on our servers
- Subject to OpenAI's processing policies when sent to its API
We do not control provider retention through this application. See OpenAI's API data controls for its processing and retention information.
Photos in Your Browser
Your browser keeps resized copies of both photos and the decode result in local storage so you can restore your latest draft for up to one hour. Saving a look to your library keeps its photos and settings on this browser until you delete the entry, clear site data, or the library removes an older entry to make room. An expired draft is no longer offered for restore, but remains in browser storage until you replace it, dismiss it, start over, or clear site data. These copies are not synced to other devices.
Technical Data
We collect limited technical data to operate our service:
- IP-derived quota key: A shortened SHA-256-derived key groups free decodes by network address for the rolling 24-hour allowance. IPv6 addresses are grouped by network prefix. This is pseudonymous quota data, not a guarantee of anonymity.
- Unlock Cookie: After you purchase a $3 decode pack, we set a cookie on your browser so we can count decodes against that pack without asking you to log in.
- Operational data: Aggregate server counters record analysis starts, successful quota settlements, and bounded error classes. Server logs record the requested model, outcome, elapsed time, and token counts reported by OpenAI. These usage events exclude photos, prompts, generated settings, IP addresses, cookies, and payment identifiers. Hosting access logs may separately record request metadata.
Payment Information
Payments are processed by Stripe. We never see or store your credit card details. Stripe's privacy policy applies to payment processing.
How We Use Your Information
- To decode style from your reference photo and produce a Lightroom preset
- To enforce our free tier (3 decodes per rolling 24-hour window, attributed by IP)
- To track paid-pack decode counts via a browser cookie
- To process payments for decode packs
- To diagnose failures and understand provider usage
- To respond to your support requests
Third-Party Services
We use the following third-party services:
- OpenAI: To analyze images and extract editing styles
- Stripe: To process payments
- Hosting and Redis infrastructure: To serve the application, validate protected requests, and maintain quota and payment fulfillment records
Data Retention
- Images: GrainLab does not store photos on its servers. Browser drafts and saved looks retain resized photos as described above.
- Free quota: Successful decode timestamps expire from the rolling 24-hour window. The Redis key can remain for that window plus a 120-second reservation grace period after activity.
- CSRF tokens: Expire after 15 minutes or are consumed by a protected request.
- Paid credits and recovery: Credits expire 30 days after payment. Recovery data expires with the pack. A permanent Stripe-session fulfillment marker prevents a payment from issuing credits more than once and is kept separately from the expiring balance.
- Payment Records: Retained by Stripe per their policy
Your Rights
You have the right to:
- Request deletion of any data we hold about you
- Remove browser drafts and saved looks by clearing site data or deleting saved entries
- Request information about what data we have
To exercise these rights, contact us at marawaca@agentmail.to.
Cookies
We use an essential CSRF cookie for protected requests and an HTTP-only quota cookie for paid packs. GrainLab does not install an analytics or advertising cookie integration. Drafts and saved looks use browser local storage, which is separate from cookies.
Children's Privacy
GrainLab is not intended for children under 13. We do not knowingly collect data from children.
Changes to This Policy
We may update this policy from time to time. We will notify users of significant changes by posting a notice on our website.
Contact Us
If you have questions about this privacy policy, please contact us at marawaca@agentmail.to.