Your colors. Your privacy.

SU YU, an independent developer operating bracescolors at bracescolors.xyz, is the data controller for the information described here. Contact jacksnow17ice@gmail.com for privacy questions or requests. This policy covers our website and service; providers may also process data under their linked notices.

• Account and security: your name, email, hashed password, account identifiers and timestamps; session tokens, expiry, IP address and browser information; and request counts for abuse prevention. Registration requests confirmation of age eligibility and any required guardian permission, without asking for a birth date or identity document.
• Photos and colors: uploaded files and any embedded metadata, filenames, formats and sizes; selected colors, saved recipes, generated images, generation status, errors, timestamps and related point usage.
• Purchases: pack, amount, currency, order/payment references, status, credited points and refunds. Waffo handles the card and billing details you enter at checkout.
• Support and technical requests: messages and attachments you send us; hosting and security request information such as IP addresses, browser information, request times and errors.

Account information is necessary to register. Photos are optional unless you request a personal AI preview. Do not include documents, medical records or unrelated sensitive information. We do not use facial recognition to identify you or create a biometric identity profile.

We use this data to sign you in, save colors and photos, generate requested previews, deliver points, reconcile payments and refunds, answer support requests and prevent abuse. Where a legal basis is required, processing relies on providing your requested service, legitimate interests in security and support, legal obligations, or consent where required.

We do not sell personal information or share it for cross-context behavioral advertising. We do not currently run advertising trackers, analytics trackers or a marketing mailing list. Service and support messages are separate from promotional communications.

Uploading alone does not submit a photo to AI. When you start a preview, our server sends a prepared copy and a braces-color prompt to Tuzi's image editing API. That request does not include your bracescolors email, password or payment details. We save the result in your private photo collection.

We do not train our own models on your photos. We have not verified a provider-wide no-training commitment or fixed deletion period from Tuzi, so we cannot extend either assurance to the provider. Deletion here removes our active copy, not necessarily a previously processed provider copy. Contact us before uploading if you need further information; illustrated color exploration does not require sending a personal photo to an AI provider.

Vercel

Website and server hosting, request delivery and operational logs.

Vercel privacy notice

Neon (Databricks)

Postgres storage for accounts, sessions, saved colors, photo metadata, generations, purchases and points. Our current database is in US East (Ohio).

Neon / Databricks privacy notice

Cloudflare

Private R2 image storage. Turnstile also processes browser and request signals to verify registration attempts and reduce automated abuse.

Cloudflare privacy policy

Tuzi

Processes the selected photo and braces-color editing request when you start AI generation. The AI section below explains the limits of our provider-retention information.

Tuzi service website

Waffo Pancake

Hosted checkout and merchant-of-record services. Receives your account email and checkout/order references, handles payment and billing details, and returns payment/refund status. We do not store full card details on bracescolors servers.

Waffo privacy policy

Google Gmail

Hosts the support mailbox and processes emails and attachments you send us.

Google privacy policy

The operator may access relevant information for service operation, support, security investigations or legal obligations. We may disclose information when required by law or to address fraud or a security incident. Photos are not placed in a public gallery.

A necessary session cookie keeps you signed in; blocking it prevents account features from working. The studio uses browser tab session storage for your selected photo ID and colors, not image bytes. You can clear site data in your browser, which may sign you out or reset choices. Waffo checkout and Cloudflare verification have their own cookie and request processing practices.

A shared color link contains color selections, not your account or photos. Anyone possessing a private photo link can view it until it expires and may download a copy. Share these links carefully.

These are the current retention rules. Expiry of a link or session does not delete all associated records.

Accounts and saved colors

Kept while your account is in use. Deleting a saved recipe removes it from the active database. Full account deletion is handled by email after ownership verification; there is no automatic inactivity deletion or self-service account deletion button.

Original photos and generated previews

Stored until you delete each image or request account deletion. Successful deletion removes that image from active R2 storage. Deleting an original does not delete its generated previews; remove those separately. File metadata and generation history can remain after image removal, pending an account/privacy review.

Unfinished uploads: 1 day

Temporary upload objects are configured for deletion after 1 day; the storage provider's lifecycle processing may take additional time. A completed photo is stored separately and is not affected by this rule. Successful uploads also remove their temporary copy.

Sessions and temporary access

Login sessions have a 7-day lifetime and may renew with active use. Signing out ends the current session; expiration does not guarantee immediate removal of every database record. Upload links last 5 minutes; private image links last up to 10 minutes. Images may be cached privately by your browser for 60 seconds. Link expiry does not delete an image.

Browser selections

Studio choices use tab session storage, normally cleared when the tab closes, subject to browser restore settings. Clearing site data removes these choices; it does not delete photos or account records on the server.

Orders, points, generation history and security records

Kept to calculate balances, deliver purchases, return points and resolve errors or disputes. These records currently have no automatic time-based purge. On a privacy or account-deletion request, we review what can be deleted or de-identified and explain any continuing payment, security or legal reason for retention. No fixed automatic deletion deadline is currently implemented.

Support emails, provider records and backups

Support correspondence remains in the mailbox until manually removed; no scheduled purge is configured. Provider logs and backup copies follow their own settings and obligations. We have not established one deletion deadline covering all providers. Deleting an image here does not itself delete previously processed AI-provider copies or copies downloaded by you or a recipient.

You can delete individual photos and recipes in your account. For account deletion, access to or a copy of your data, corrections or another request, email jacksnow17ice@gmail.com from your account address. We may verify ownership first. Do not send passwords or full card numbers.

Depending on your location, you may have rights to portability, restriction, objection, withdrawal of consent and complaint to your local data-protection authority. Withdrawal does not undo prior lawful processing. We respond within applicable legal deadlines and explain verification needs, lawful extensions or retention exceptions. We do not discriminate against you for exercising applicable privacy rights.

You must be at least 13 to register or use personal photo features. If you are under 18 or the age of majority where you live, a parent or legal guardian must consent to your use, photo processing and purchases. Any higher local age of independent consent also applies.

Do not register if you are under 13 or upload photos of children under 13. For another minor aged 13 or above, obtain their parent or guardian's permission. Registration uses a self-declaration, not identity or guardian verification. Report suspected use contrary to these rules to support so we can investigate and arrange appropriate removal or account restrictions.

Our Neon database is in the United States; other providers use infrastructure in multiple countries. Data may be processed outside your country under different laws. Provider notices above explain their international processing. We have not confirmed every Tuzi processing location or a specific transfer safeguard for that service. Contact us before photo generation if you require a particular processing location or transfer arrangement.

The production site uses HTTPS and hashed passwords. Account APIs check ownership of private records and photos; R2 storage is private and photo access links expire. Database and API credentials stay on the server. These measures reduce risk without guaranteeing absolute security. We will notify affected people and authorities of a personal-data incident where and when required by applicable law.

We update this page's date and version when the policy changes. Material changes will be highlighted on the website before taking effect, and we will seek consent where required. Contact SU YU at jacksnow17ice@gmail.com with questions or complaints. Our terms of service and acceptable-use policy also describe account and photo permissions.