1. Scope
This Privacy Policy explains how Cheap.dev collects, uses, discloses, and protects personal information when you visit our website, authenticate, use our APIs or model tools, request support, or otherwise interact with the Services. It does not govern third parties’ independent privacy practices.
2. Information you provide
We collect information you choose to provide, such as support messages and account details. When you use generative-media features, you may submit prompts, images, video, audio, text, URLs, and other Inputs. Do not submit personal information you are not authorized to process.
3. Google login information
If you sign in with Google, we receive your stable Google account identifier and verified email address. We use these details to identify your account and display your email in the site header. We do not store the Google OAuth access token after completing the login request. Authentication state is maintained in a signed, Secure, HttpOnly cookie.
4. Information collected automatically
We and our infrastructure providers may collect IP address, browser and device type, operating system, referring pages, timestamps, request identifiers, API routes, response status, security signals, and diagnostic logs. We also measure model selection, request volume, actual token usage, processing time, and related usage records needed to operate and price the Services.
5. How we use information
We use information to provide and authenticate the Services; route and process model requests; return and retain results as configured; measure actual-token usage; process payments and maintain payment records; provide support; communicate service and security notices; detect abuse, fraud, and incidents; debug and improve reliability; comply with law; and protect users, providers, and our rights.
6. How we disclose information
We may disclose information to infrastructure, hosting, model, storage, identity, security, analytics, support, and payment providers that process it for us; to professional advisers; when required by law or valid legal process; to protect rights, safety, and security; or in connection with a merger, financing, acquisition, reorganization, or sale of assets. We may share aggregated or de-identified information that reasonably cannot identify you.
7. Model providers and international processing
A request may be sent to the model or infrastructure provider needed to perform it. Providers and servers may be located in countries other than yours, where privacy laws may differ. Where required, we use appropriate safeguards for international transfers. Review what you submit and avoid unnecessary personal or confidential information.
8. Cookies and analytics
We use essential cookies for OAuth state validation and signed login sessions. We also use Google Analytics 4 to understand website visits and interactions; Google may set or read analytics identifiers and receive technical information such as browser, device, page, referral, and approximate location data. You may block or clear these technologies through your browser or applicable privacy controls. Where law requires, we will provide additional notice or choice before using non-essential technologies.
9. Retention
We keep account identifiers and email while needed to provide your account and for a reasonable period afterward for security, legal, and operational purposes. OAuth state expires after approximately ten minutes and the current signed login cookie after approximately thirty days. API Inputs, Outputs, logs, and usage records are retained only as long as reasonably needed for processing, retrieval, abuse prevention, support, accounting, and legal obligations. Provider retention periods may differ.
10. Security
We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, secret-bound credentials, signed cookies, access controls, and monitoring. No system is completely secure, and we cannot guarantee absolute security. Keep API tokens confidential and contact us promptly if you suspect compromise.
11. Your choices and rights
You may stop using the Services, clear browser cookies, or contact us to request access, correction, deletion, restriction, objection, or portability where applicable. You may also have the right to complain to a local privacy regulator. We may need to verify your identity and may retain information where required by law, necessary for security, or exempt from a request.
12. Children
The Services are not directed to children under 18 or the age of legal majority where they live, and we do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can review and take appropriate action.
13. Changes to this Policy
We may update this Policy as the Services, providers, or legal requirements change. We will post the revised version with a new “Last updated” date and provide additional notice for material changes when appropriate.
14. Contact
For privacy questions or requests, email contact@cheap.dev. Please describe your request and the account email involved, but do not send passwords, API tokens, payment credentials, or sensitive media by email.